mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-02 08:57:48 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
55 lines
1.9 KiB
Markdown
55 lines
1.9 KiB
Markdown
# API Reference — Hunting for Persistence via WMI Subscriptions
|
|
|
|
## Libraries Used
|
|
- **subprocess**: Execute WMIC and PowerShell commands for WMI enumeration
|
|
- **python-evtx** (Evtx): Parse Sysmon EVTX for WMI-related events (IDs 19, 20, 21)
|
|
- **re**: Pattern matching for suspicious WMI consumer payloads
|
|
|
|
## CLI Interface
|
|
|
|
```
|
|
python agent.py enumerate # WMIC-based WMI subscription enumeration
|
|
python agent.py powershell # PowerShell Get-WMIObject enumeration
|
|
python agent.py sysmon --evtx-file <path> # Scan Sysmon EVTX for WMI events
|
|
```
|
|
|
|
## Core Functions
|
|
|
|
### `enumerate_wmi_subscriptions()`
|
|
Queries four WMI subscription classes via WMIC and flags entries matching suspicious patterns.
|
|
|
|
**Returns:** dict with `classes` (EventFilter, EventConsumer, ActiveScriptEventConsumer, FilterToConsumerBinding) and `suspicious` list.
|
|
|
|
### `scan_sysmon_wmi_events(evtx_file)`
|
|
Parses Sysmon EVTX for Event IDs 19 (WmiEventFilter), 20 (WmiEventConsumer), 21 (WmiEventBinding).
|
|
|
|
**Parameters:**
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `evtx_file` | str | Path to Sysmon .evtx file |
|
|
|
|
### `query_powershell_wmi()`
|
|
Uses PowerShell `Get-WMIObject` to enumerate WMI subscriptions in `root\Subscription` namespace.
|
|
|
|
## WMI Classes Enumerated
|
|
|
|
| Class | Description |
|
|
|-------|-------------|
|
|
| `__EventFilter` | Defines the WQL query that triggers the subscription |
|
|
| `CommandLineEventConsumer` | Executes a command when the filter matches |
|
|
| `ActiveScriptEventConsumer` | Runs VBScript/JScript when the filter matches |
|
|
| `__FilterToConsumerBinding` | Links a filter to its consumer |
|
|
|
|
## Sysmon Event IDs
|
|
|
|
| Event ID | Description |
|
|
|----------|-------------|
|
|
| 19 | WmiEvent - Filter activity detected |
|
|
| 20 | WmiEvent - Consumer activity detected |
|
|
| 21 | WmiEvent - Consumer-to-filter binding |
|
|
|
|
## Dependencies
|
|
```
|
|
pip install python-evtx # Optional, for EVTX parsing
|
|
```
|