mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
4.0 KiB
4.0 KiB
Malware IOC Extraction Workflows
Workflow 1: Static Analysis Pipeline
[Malware Sample] --> [Hash Generation] --> [PE Parsing] --> [String Extraction] --> [IOC Filtering]
|
v
[YARA Scanning]
|
v
[STIX Bundle]
Steps:
- Sample Acquisition: Obtain sample from MalwareBazaar, VirusTotal, or incident response
- Hash Calculation: Generate MD5, SHA-1, SHA-256, imphash, ssdeep hashes
- PE Analysis: Parse headers, sections, imports, exports, resources, timestamps
- String Extraction: Extract ASCII/Unicode strings, apply IOC regex patterns
- IOC Filtering: Remove false positives (private IPs, common DLLs, benign domains)
- YARA Classification: Scan with community and custom YARA rules
- Output: Generate STIX 2.1 bundle with extracted indicators
Workflow 2: Dynamic Analysis Pipeline
[Malware Sample] --> [Sandbox Submission] --> [Detonation] --> [Artifact Collection]
|
+------------+------------+
| | |
v v v
[Network] [File Sys] [Registry]
[PCAPs] [Changes] [Changes]
| | |
+------------+------------+
|
v
[IOC Consolidation]
Steps:
- Sandbox Setup: Configure isolated VM with network monitoring
- Sample Submission: Submit to CAPE/Cuckoo sandbox with execution parameters
- Execution Monitoring: Monitor for 3-5 minutes of runtime behavior
- Network Capture: Extract DNS queries, HTTP/HTTPS traffic, raw connections
- File System Analysis: Identify created, modified, and deleted files
- Registry Analysis: Capture registry key changes for persistence indicators
- Process Analysis: Document spawned processes, injections, privilege escalation
- Consolidation: Merge static and dynamic IOCs into unified report
Workflow 3: Automated IOC Pipeline
[Feed/Alert] --> [Auto-Download] --> [Static Analysis] --> [Sandbox] --> [Enrichment] --> [Share]
|
v
[VirusTotal Check]
|
v
[MISP/OpenCTI Upload]
Steps:
- Trigger: New sample from malware feed, email gateway, or EDR alert
- Download: Retrieve sample securely to analysis infrastructure
- Static Scan: Automated PE parsing, string extraction, YARA scanning
- Dynamic Analysis: Submit to sandbox for behavioral analysis
- Enrichment: Check hashes against VirusTotal, cross-reference with TI platforms
- Deduplication: Remove already-known IOCs from output
- Sharing: Upload new IOCs to MISP/OpenCTI for team consumption