mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
59 lines
1.9 KiB
Markdown
59 lines
1.9 KiB
Markdown
# Workflows - BloodHound CE Reconnaissance
|
|
|
|
## Complete Reconnaissance Workflow
|
|
|
|
```
|
|
1. Deployment
|
|
├── Pull BloodHound CE Docker images
|
|
├── Start services with docker compose up -d
|
|
├── Access web UI and set admin password
|
|
└── Verify API connectivity
|
|
|
|
2. Data Collection
|
|
├── Choose collector: SharpHound v2 (Windows) or BloodHound.py (Linux)
|
|
├── Run All collection method for comprehensive data
|
|
├── Run Session collection in loop for user mapping
|
|
├── Collect from all reachable domains
|
|
└── Exfiltrate ZIP data to analysis workstation
|
|
|
|
3. Import and Setup
|
|
├── Upload ZIP files via BloodHound CE web interface
|
|
├── Wait for data processing to complete
|
|
├── Mark owned/compromised principals
|
|
└── Set high-value targets
|
|
|
|
4. Analysis
|
|
├── Run built-in attack path queries
|
|
├── Execute custom Cypher queries
|
|
├── Identify ACL abuse opportunities
|
|
├── Map delegation configurations
|
|
├── Find Kerberoastable / AS-REP roastable accounts
|
|
└── Discover GPO modification paths
|
|
|
|
5. Attack Planning
|
|
├── Prioritize paths by hop count and stealth
|
|
├── Identify tools needed per hop
|
|
├── Plan OPSEC for each technique
|
|
└── Document execution plan
|
|
|
|
6. Reporting
|
|
├── Export graph visualizations
|
|
├── Generate path summaries
|
|
├── Document all findings with evidence
|
|
└── Provide remediation recommendations
|
|
```
|
|
|
|
## Stealthy Collection Workflow
|
|
|
|
```
|
|
Low-Noise Collection:
|
|
1. DCOnly mode: Only queries domain controllers via LDAP
|
|
SharpHound.exe -c DCOnly
|
|
|
|
2. Targeted collection: Specific container/OU
|
|
SharpHound.exe -c All --searchbase "OU=Servers,DC=domain,DC=local"
|
|
|
|
3. Session loop: Passive session enumeration over time
|
|
SharpHound.exe -c Session --loop --loopduration 04:00:00 --loopinterval 00:05:00
|
|
```
|