mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
76 lines
2.9 KiB
Markdown
76 lines
2.9 KiB
Markdown
# Standards and Framework References
|
|
|
|
## MITRE ATT&CK - Initial Access (TA0001)
|
|
|
|
| Technique ID | Name | Sub-technique |
|
|
|-------------|------|---------------|
|
|
| T1566.001 | Spearphishing Attachment | Malicious files delivered via email |
|
|
| T1566.002 | Spearphishing Link | URLs in emails directing to malicious content |
|
|
| T1566.003 | Spearphishing via Service | Phishing through third-party services |
|
|
| T1598.001 | Phishing for Information: Spearphishing Service | Info gathering via services |
|
|
| T1598.002 | Phishing for Information: Spearphishing Attachment | Credential harvesting attachments |
|
|
| T1598.003 | Phishing for Information: Spearphishing Link | Credential harvesting links |
|
|
|
|
## MITRE ATT&CK - Execution (TA0002)
|
|
|
|
| Technique ID | Name | Description |
|
|
|-------------|------|-------------|
|
|
| T1204.001 | User Execution: Malicious Link | User clicks phishing link |
|
|
| T1204.002 | User Execution: Malicious File | User opens malicious attachment |
|
|
|
|
## MITRE ATT&CK - Resource Development (TA0042)
|
|
|
|
| Technique ID | Name | Description |
|
|
|-------------|------|-------------|
|
|
| T1583.001 | Acquire Infrastructure: Domains | Register phishing domains |
|
|
| T1583.006 | Acquire Infrastructure: Web Services | Use web services for phishing |
|
|
| T1585.001 | Establish Accounts: Social Media | Create fake social media profiles |
|
|
| T1585.002 | Establish Accounts: Email Accounts | Create email accounts for sending |
|
|
| T1608.001 | Stage Capabilities: Upload Malware | Host payloads for download |
|
|
| T1608.005 | Stage Capabilities: Link Target | Prepare phishing URLs |
|
|
|
|
## PTES - Social Engineering
|
|
|
|
### Pre-text Creation
|
|
- Research-based pretext development
|
|
- Authority, urgency, and scarcity principles
|
|
- Robert Cialdini's principles of influence
|
|
- Corporate communication mimicry
|
|
|
|
### Attack Vectors
|
|
- Email-based spearphishing
|
|
- Voice phishing (vishing) support calls
|
|
- SMS phishing (smishing)
|
|
- Social media-based pretexting
|
|
|
|
## NIST SP 800-177 - Trustworthy Email
|
|
|
|
### Email Authentication Protocols
|
|
- SPF (Sender Policy Framework)
|
|
- DKIM (DomainKeys Identified Mail)
|
|
- DMARC (Domain-based Message Authentication)
|
|
|
|
### Email Security Controls
|
|
- Email gateway filtering
|
|
- URL rewriting and sandboxing
|
|
- Attachment analysis
|
|
- Domain reputation scoring
|
|
|
|
## CIS Controls v8
|
|
|
|
### Control 14: Security Awareness and Skills Training
|
|
- 14.1: Establish and Maintain a Security Awareness Program
|
|
- 14.2: Train Workforce Members to Recognize Social Engineering Attacks
|
|
- 14.3: Train Workforce Members on Authentication Best Practices
|
|
|
|
## Email Security Bypass Techniques Reference
|
|
|
|
| Technique | Bypasses | Risk Level |
|
|
|-----------|----------|------------|
|
|
| HTML Smuggling | Email attachment scanning | High |
|
|
| Domain Age/Reputation | New domain blocking | Medium |
|
|
| Legitimate Service Abuse | Domain reputation filters | High |
|
|
| SPF/DKIM/DMARC Alignment | Email authentication checks | Medium |
|
|
| File Format Alternatives | Attachment type blocking | Medium |
|
|
| QR Code Phishing | URL analysis engines | High |
|