mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
MITRE ATT&CK Navigator Layer - Anthropic Cybersecurity Skills
This directory contains a MITRE ATT&CK Navigator layer file that maps the coverage of the Anthropic Cybersecurity Skills repository against the ATT&CK Enterprise matrix.
Files
| File | Description |
|---|---|
attack-navigator-layer.json |
ATT&CK Navigator layer (v4.5 format, Enterprise ATT&CK v14) |
How to View
- Open the MITRE ATT&CK Navigator
- Click Open Existing Layer
- Select Upload from local and choose
attack-navigator-layer.json - The matrix will display with blue-shaded techniques indicating coverage
Alternatively, paste the raw JSON URL into the Navigator's "Load from URL" option if this file is hosted publicly.
Coverage Statistics
| Metric | Value |
|---|---|
| Total skills scanned | 742 |
| Unique ATT&CK techniques referenced | 218 |
| Parent techniques | 94 |
| Sub-techniques | 124 |
| Tactics with coverage | 14/14 |
Coverage by Tactic
| Tactic | Techniques Covered |
|---|---|
| Defense Evasion | 36 |
| Credential Access | 33 |
| Persistence | 29 |
| Initial Access | 17 |
| Command and Control | 17 |
| Privilege Escalation | 13 |
| Discovery | 12 |
| Exfiltration | 12 |
| Reconnaissance | 11 |
| Collection | 10 |
| Lateral Movement | 9 |
| Execution | 8 |
| Resource Development | 6 |
| Impact | 5 |
Color Scale
The layer uses a blue gradient to indicate coverage depth:
- Light blue (
#cfe2f3): 1-2 skills reference this technique - Medium blue (
#6fa8dc): 3-5 skills reference this technique - Dark blue (
#3d85c6): 6-10 skills reference this technique - Deep blue (
#1155cc): 11+ skills reference this technique
Top 10 Most Covered Techniques
| Technique | Name | Skills |
|---|---|---|
| T1059.001 | PowerShell | 26 |
| T1055 | Process Injection | 17 |
| T1053.005 | Scheduled Task | 16 |
| T1566.001 | Spearphishing Attachment | 15 |
| T1558.003 | Kerberoasting | 14 |
| T1547.001 | Registry Run Keys / Startup Folder | 13 |
| T1078 | Valid Accounts | 13 |
| T1003.006 | DCSync | 13 |
| T1071.001 | Web Protocols | 12 |
| T1021.002 | SMB/Windows Admin Shares | 12 |
Methodology
Techniques were extracted by scanning all SKILL.md files in the repository for ATT&CK technique ID patterns (T1XXX and T1XXX.XXX). Each technique's score is proportional to the number of distinct skills that reference it, normalized to a 1-100 scale.
Layer Format
- Format version: 4.5
- ATT&CK version: 14 (Enterprise)
- Navigator version: 4.9.1
- Domain: enterprise-attack