mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
66 lines
1.7 KiB
Markdown
66 lines
1.7 KiB
Markdown
# EZ Tools Forensic Analysis Report Template
|
|
|
|
## Case Information
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Case Number | |
|
|
| Examiner | |
|
|
| Date of Analysis | |
|
|
| Evidence Source | |
|
|
| Evidence Hash (SHA-256) | |
|
|
| EZ Tools Version | |
|
|
|
|
## Artifacts Processed
|
|
|
|
| Artifact | Tool Used | Status | Records Parsed |
|
|
|----------|-----------|--------|----------------|
|
|
| $MFT | MFTECmd | | |
|
|
| $J (USN Journal) | MFTECmd | | |
|
|
| Prefetch Files | PECmd | | |
|
|
| LNK Files | LECmd | | |
|
|
| Jump Lists | JLECmd | | |
|
|
| Event Logs | EvtxECmd | | |
|
|
| Registry Hives | RECmd | | |
|
|
| Shellbags | SBECmd | | |
|
|
| Recycle Bin | RBCmd | | |
|
|
| Amcache | AmcacheParser | | |
|
|
| ShimCache | AppCompatCacheParser | | |
|
|
|
|
## Key Findings
|
|
|
|
### Program Execution Evidence
|
|
| Executable | First Execution | Last Execution | Run Count | Source |
|
|
|-----------|----------------|---------------|-----------|--------|
|
|
| | | | | |
|
|
|
|
### Timestomping Indicators
|
|
| File | $SI Created | $FN Created | Anomaly |
|
|
|------|------------|------------|---------|
|
|
| | | | |
|
|
|
|
### User Activity Timeline
|
|
| Timestamp | Activity | Artifact Source | Details |
|
|
|-----------|----------|----------------|---------|
|
|
| | | | |
|
|
|
|
### Lateral Movement Indicators
|
|
| Timestamp | Source IP | Target System | Logon Type | Event ID |
|
|
|-----------|----------|--------------|------------|----------|
|
|
| | | | | |
|
|
|
|
### USB Device Connections
|
|
| Device | Serial Number | First Connected | Last Connected | Volume Name |
|
|
|--------|--------------|----------------|---------------|-------------|
|
|
| | | | | |
|
|
|
|
## Conclusion
|
|
|
|
_(Summary of findings based on artifact analysis)_
|
|
|
|
## Chain of Custody
|
|
|
|
| Date/Time | Action | Performed By | Notes |
|
|
|-----------|--------|-------------|-------|
|
|
| | | | |
|