mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.7 KiB
1.7 KiB
EZ Tools Forensic Analysis Report Template
Case Information
| Field | Value |
|---|---|
| Case Number | |
| Examiner | |
| Date of Analysis | |
| Evidence Source | |
| Evidence Hash (SHA-256) | |
| EZ Tools Version |
Artifacts Processed
| Artifact | Tool Used | Status | Records Parsed |
|---|---|---|---|
| $MFT | MFTECmd | ||
| $J (USN Journal) | MFTECmd | ||
| Prefetch Files | PECmd | ||
| LNK Files | LECmd | ||
| Jump Lists | JLECmd | ||
| Event Logs | EvtxECmd | ||
| Registry Hives | RECmd | ||
| Shellbags | SBECmd | ||
| Recycle Bin | RBCmd | ||
| Amcache | AmcacheParser | ||
| ShimCache | AppCompatCacheParser |
Key Findings
Program Execution Evidence
| Executable | First Execution | Last Execution | Run Count | Source |
|---|---|---|---|---|
Timestomping Indicators
| File | $SI Created | $FN Created | Anomaly |
|---|---|---|---|
User Activity Timeline
| Timestamp | Activity | Artifact Source | Details |
|---|---|---|---|
Lateral Movement Indicators
| Timestamp | Source IP | Target System | Logon Type | Event ID |
|---|---|---|---|---|
USB Device Connections
| Device | Serial Number | First Connected | Last Connected | Volume Name |
|---|---|---|---|---|
Conclusion
(Summary of findings based on artifact analysis)
Chain of Custody
| Date/Time | Action | Performed By | Notes |
|---|---|---|---|