mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.9 KiB
1.9 KiB
API Reference: YARA Rule Development for Detection
yara-python API
| Method | Description |
|---|---|
yara.compile(filepath=path) |
Compile rule from file |
yara.compile(source=string) |
Compile rule from string |
yara.compile(filepaths={ns: path}) |
Compile with namespaces |
rules.match(filepath=path) |
Scan file against compiled rules |
rules.match(data=bytes) |
Scan bytes in memory |
rules.match(filepath, timeout=30) |
Scan with timeout |
Match Object Attributes
| Attribute | Description |
|---|---|
match.rule |
Name of matching rule |
match.namespace |
Rule namespace |
match.tags |
Rule tags list |
match.meta |
Rule metadata dict |
match.strings |
List of (offset, identifier, data) |
YARA Rule Structure
rule RuleName : tag1 tag2 {
meta:
description = "..."
author = "..."
date = "2025-01-01"
hash = "sha256_of_sample"
strings:
$s1 = "string" ascii
$s2 = "wide_string" wide
$h1 = { 4D 5A 90 00 }
$r1 = /regex[0-9]+/
condition:
uint16(0) == 0x5A4D and 3 of ($s*)
}
Condition Operators
| Operator | Description |
|---|---|
X of ($s*) |
X or more strings match |
all of ($s*) |
All strings match |
any of ($s*) |
At least one matches |
uint16(0) == 0x5A4D |
PE file magic bytes |
filesize < 10MB |
File size constraint |
Python Libraries
| Library | Version | Purpose |
|---|---|---|
yara-python |
>=4.3 | Compile and scan YARA rules |
hashlib |
stdlib | SHA256 of samples |
re |
stdlib | String extraction |
References
- YARA Documentation: https://yara.readthedocs.io/en/stable/
- yara-python: https://github.com/VirusTotal/yara-python
- YARA Rules Repository: https://github.com/Yara-Rules/rules
- VirusTotal Hunting: https://www.virustotal.com/gui/hunting-overview