mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.9 KiB
2.9 KiB
Workflows - EZ Tools Windows Forensic Analysis
Workflow 1: Full Triage Collection and Processing
Step 1: Mount forensic image as read-only drive (E:)
|
Step 2: Run KAPE with KapeTriage target
|-- Collects: $MFT, $J, Registry, Event Logs, Prefetch, LNK, Jump Lists
|
Step 3: Run KAPE with !EZParser module
|-- Processes all collected artifacts with appropriate EZ Tools
|
Step 4: Open CSV outputs in Timeline Explorer
|-- Sort by timestamp, filter by artifact type
|
Step 5: Build investigation timeline
|-- Cross-reference MFT, Event Logs, Prefetch, Registry
|
Step 6: Document findings and export filtered results
Workflow 2: Timestomping Detection
Step 1: Parse $MFT with MFTECmd
|
Step 2: Open MFT CSV in Timeline Explorer
|
Step 3: Compare $SI timestamps (Created0x10) vs $FN timestamps (Created0x30)
|-- Flag entries where Created0x10 < Created0x30
|-- Flag entries where all four $SI timestamps are identical
|
Step 4: Cross-reference flagged files with USN Journal entries
|
Step 5: Verify with event log correlation (process creation, file access)
Workflow 3: Program Execution Timeline
Step 1: Parse Prefetch with PECmd
|
Step 2: Parse Amcache.hve with AmcacheParser
|
Step 3: Parse ShimCache with AppCompatCacheParser
|
Step 4: Parse UserAssist from NTUSER.DAT with RECmd
|
Step 5: Merge and correlate execution timestamps
|-- Prefetch: Run count + last 8 execution times
|-- Amcache: First execution + SHA1 hash
|-- ShimCache: Last modified time (execution indicator)
|-- UserAssist: GUI program execution tracking
|
Step 6: Build execution timeline in Timeline Explorer
Workflow 4: Lateral Movement Investigation
Step 1: Parse Security.evtx with EvtxECmd
|-- Filter Event ID 4624 (Logon Type 3, 10)
|-- Filter Event ID 4625 (Failed logons)
|
Step 2: Parse TerminalServices event logs
|-- Microsoft-Windows-TerminalServices-LocalSessionManager
|-- Microsoft-Windows-TerminalServices-RDPClient
|
Step 3: Correlate with registry RDP MRU entries
|-- NTUSER.DAT\Software\Microsoft\Terminal Server Client\Servers
|
Step 4: Analyze LNK files for network path access
|
Step 5: Review scheduled task creation from event logs
|
Step 6: Map lateral movement path across systems
Workflow 5: USB Device Investigation
Step 1: Parse SYSTEM hive with RECmd
|-- SYSTEM\CurrentControlSet\Enum\USBSTOR
|-- SYSTEM\CurrentControlSet\Enum\USB
|-- SYSTEM\MountedDevices
|
Step 2: Parse NTUSER.DAT with RECmd
|-- MountPoints2 for user-level device associations
|
Step 3: Parse setupapi.dev.log for device installation timestamps
|
Step 4: Analyze LNK files referencing removable drive letters
|
Step 5: Check Shellbags for folder browsing on USB devices
|
Step 6: Correlate with Event Logs (Microsoft-Windows-Partition/Diagnostic)