mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
51 lines
1.4 KiB
Markdown
51 lines
1.4 KiB
Markdown
# API Reference: Implementing MITRE ATT&CK Coverage Mapping
|
|
|
|
## ATT&CK Enterprise STIX Data
|
|
|
|
```bash
|
|
# Download latest ATT&CK STIX bundle
|
|
curl -sL "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" -o attack.json
|
|
```
|
|
|
|
## ATT&CK Navigator Layer Format
|
|
|
|
```json
|
|
{
|
|
"name": "Detection Coverage",
|
|
"domain": "enterprise-attack",
|
|
"versions": {"attack": "14", "navigator": "4.9.1"},
|
|
"techniques": [
|
|
{"techniqueID": "T1566", "score": 3, "color": "#80b1d3"}
|
|
]
|
|
}
|
|
```
|
|
|
|
## ATT&CK Tactics (Enterprise)
|
|
|
|
| ID | Tactic | Example Technique |
|
|
|----|--------|------------------|
|
|
| TA0001 | Initial Access | T1566 Phishing |
|
|
| TA0002 | Execution | T1059 Command Interpreter |
|
|
| TA0003 | Persistence | T1053 Scheduled Task |
|
|
| TA0004 | Privilege Escalation | T1078 Valid Accounts |
|
|
| TA0005 | Defense Evasion | T1027 Obfuscation |
|
|
| TA0006 | Credential Access | T1003 OS Credential Dumping |
|
|
| TA0008 | Lateral Movement | T1021 Remote Services |
|
|
| TA0011 | Command and Control | T1071 Application Layer Protocol |
|
|
|
|
## Coverage Score
|
|
|
|
| Score | Meaning | Color |
|
|
|-------|---------|-------|
|
|
| 0 | No detection | White |
|
|
| 1 | Single rule | Yellow |
|
|
| 2 | Multiple rules | Green |
|
|
| 3 | Good coverage | Blue |
|
|
| 4+ | Excellent | Red |
|
|
|
|
### References
|
|
|
|
- MITRE ATT&CK: https://attack.mitre.org/
|
|
- ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/
|
|
- ATT&CK STIX Data: https://github.com/mitre/cti
|