mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.2 KiB
2.2 KiB
Workflows: Implementing Mimecast Targeted Attack Protection
Workflow 1: URL Protect Processing
Inbound email with URLs arrives
|
v
[Pre-delivery URL check]
+-- Extract all URLs from body and attachments
+-- Check against Mimecast threat intelligence
+-- KNOWN MALICIOUS --> Hold/Block message
+-- SUSPICIOUS --> Hold for deeper analysis
+-- CLEAN --> Proceed to rewriting
|
v
[URL rewriting]
+-- Replace original URLs with Mimecast proxy URLs
+-- Preserve original URL in encoded format
+-- Apply per-policy rewriting rules
|
v
[Message delivered to user inbox]
|
v
[User clicks rewritten URL]
|
v
[Time-of-click analysis]
+-- Real-time page scan and sandbox
+-- Check for credential harvesting forms
+-- Check for malware downloads
|
v
[Decision]
+-- SAFE: Redirect to original URL
+-- MALICIOUS: Display block page
+-- SUSPICIOUS: Display warning with proceed option
Workflow 2: Attachment Protect Pipeline
Email with attachment arrives
|
v
[Static analysis]
+-- File type identification
+-- Signature matching
+-- Known malware hash check
|
v
[Policy evaluation]
+-- Safe File mode: Convert to safe format (PDF)
+-- Dynamic mode: Full sandbox detonation
+-- Bypass: Whitelisted sender/type
|
v
[Dynamic sandbox (if configured)]
+-- Execute in isolated environment
+-- Monitor for malicious behavior
+-- Check for C2 callbacks, file drops, registry changes
+-- Timeout: up to 7 minutes
|
v
[Verdict]
+-- CLEAN: Deliver original attachment
+-- MALICIOUS: Quarantine, notify admin
+-- TIMEOUT: Deliver with warning or hold per policy
Workflow 3: Impersonation Protect Analysis
Inbound email arrives
|
v
[Identifier check against VIP list]
+-- Compare display name to VIP names
+-- Check domain similarity to internal domains
+-- Verify reply-to alignment
+-- Check if sender is newly observed
|
v
[Hit scoring]
+-- Hit 1 policy (VIP): 1+ indicator match
+-- Hit 3 policy (Default): 3+ indicator matches
|
v
[Action based on hit level]
+-- QUARANTINE: High confidence impersonation
+-- TAG: Moderate confidence, add warning banner
+-- LOG: Low confidence, record for analysis
+-- DELIVER: No indicators matched