mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.4 KiB
2.4 KiB
Active Directory Security Assessment Checklist
Pre-Assessment Preparation
- Obtain written authorization for AD security assessment
- Identify domain controllers and AD forest/domain topology
- Create dedicated scan account with Domain Admin read access
- Document assessment scope (domains, OUs, forests)
- Schedule assessment during maintenance window if using active scanning
PingCastle Assessment
- Run PingCastle --healthcheck against all in-scope domains
- Review overall score and category breakdown
- Document all findings with points >= 10
- Export report as XML for automated processing
- Check trust relationship security
- Verify AdminSDHolder integrity
BloodHound Assessment
- Deploy SharpHound collector
- Run full collection (All methods)
- Upload data to BloodHound CE
- Run shortest path to Domain Admin queries
- Identify Kerberoastable admin accounts
- Map unconstrained delegation hosts
- Check for AS-REP roastable accounts
- Analyze GPO abuse paths
- Document all attack paths with 3 or fewer hops
Purple Knight Assessment
- Run Purple Knight community edition
- Review score across all five categories
- Document indicators below 75% score threshold
Critical Findings Checklist
Kerberos Security
- No user accounts with SPNs in admin groups (Kerberoasting)
- Kerberos pre-authentication enabled for all accounts
- No unconstrained delegation on non-DC computers
- AES-256 encryption enabled; RC4 and DES disabled
- Kerberos ticket lifetime <= 10 hours
Privileged Accounts
- Domain Admins group has <= 5 members
- Enterprise Admins group has <= 3 members
- Schema Admins group is empty (only populated during schema changes)
- All admin accounts have password expiration enabled
- Protected Users group configured for Tier 0 accounts
- Tiered admin model implemented (Tier 0/1/2)
Password Policy
- Minimum password length >= 14 characters
- Password history >= 24 passwords
- Account lockout threshold set (10-15 attempts)
- Fine-grained password policy for admin accounts (25+ chars)
Infrastructure Security
- LDAP signing required on all domain controllers
- LDAP channel binding set to Required
- SMB signing required on DCs
- NTLMv2 only (LM and NTLMv1 disabled)
- All DCs running supported OS versions
- LAPS deployed for local admin passwords