mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.4 KiB
1.4 KiB
API Reference: Attack Pattern Library from CTI Reports
Technique Extraction Patterns
| Technique | Regex Pattern |
|---|---|
| T1566.001 | spearphish.*attach |
| T1059.001 | powershell, invoke-expression |
| T1053.005 | scheduled task, schtasks |
| T1547.001 | registry run key, CurrentVersion\\Run |
| T1003.001 | lsass, credential dump, mimikatz |
| T1486 | ransomware encrypt |
| T1048 | exfiltration, data theft |
IOC Extraction Regex
| IOC Type | Pattern |
|---|---|
| IPv4 | \b(?:\d{1,3}\.){3}\d{1,3}\b |
| Domain | [a-zA-Z0-9-]+\.(?:com|net|org) |
| MD5 | [a-fA-F0-9]{32} |
| SHA-256 | [a-fA-F0-9]{64} |
| Defanged URL | hxxps?://[^\s]+ |
| Explicit technique | T\d{4}(?:\.\d{3})? |
STIX Attack Pattern
{
"type": "attack-pattern",
"name": "Spearphishing Attachment",
"external_references": [
{"source_name": "mitre-attack", "external_id": "T1566.001"}
],
"kill_chain_phases": [
{"phase_name": "initial-access"}
]
}
Library Output Structure
| Field | Description |
|---|---|
technique_frequency |
Count per technique across reports |
technique_report_map |
Which reports mention each technique |
total_unique_techniques |
Distinct techniques found |
MITRE ATT&CK STIX Data
https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json