mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
85 lines
2.5 KiB
Markdown
85 lines
2.5 KiB
Markdown
# Active Breach Containment API Reference
|
|
|
|
## CrowdStrike Falcon - Host Containment
|
|
|
|
```bash
|
|
# Contain a host (network isolation)
|
|
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
|
|
-H "Authorization: Bearer $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"ids": ["device_id_here"]}'
|
|
|
|
# Lift containment
|
|
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=lift_containment" \
|
|
-H "Authorization: Bearer $TOKEN" \
|
|
-d '{"ids": ["device_id_here"]}'
|
|
```
|
|
|
|
## Microsoft Defender for Endpoint - Isolation
|
|
|
|
```powershell
|
|
# Isolate machine via API
|
|
$body = @{ Comment = "Breach containment INC-2025-001"; IsolationType = "Full" } | ConvertTo-Json
|
|
Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
|
|
-Method Post -Headers @{Authorization = "Bearer $token"} -Body $body -ContentType "application/json"
|
|
|
|
# Release from isolation
|
|
Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/unisolate" `
|
|
-Method Post -Headers @{Authorization = "Bearer $token"} `
|
|
-Body (@{Comment = "Containment lifted"} | ConvertTo-Json) -ContentType "application/json"
|
|
```
|
|
|
|
## Active Directory - Credential Actions
|
|
|
|
```powershell
|
|
# Disable compromised account
|
|
Disable-ADAccount -Identity "jsmith"
|
|
|
|
# Reset password
|
|
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (ConvertTo-SecureString "NewP@ss!" -AsPlainText -Force)
|
|
|
|
# Revoke Azure AD sessions
|
|
Revoke-AzureADUserAllRefreshToken -ObjectId "user-object-id"
|
|
|
|
# KRBTGT double reset (first reset)
|
|
Reset-KrbtgtKeys -Server DC01 -Force
|
|
```
|
|
|
|
## Network Containment - iptables
|
|
|
|
```bash
|
|
# Block C2 IP
|
|
iptables -A INPUT -s 185.220.x.x -j DROP
|
|
iptables -A OUTPUT -d 185.220.x.x -j DROP
|
|
|
|
# Isolate host from network (allow management only)
|
|
iptables -A FORWARD -s 10.10.5.12 -d 10.10.0.1 -j ACCEPT
|
|
iptables -A FORWARD -s 10.10.5.12 -j DROP
|
|
|
|
# Block SMB lateral movement
|
|
iptables -A FORWARD -p tcp --dport 445 -j DROP
|
|
```
|
|
|
|
## DNS Sinkholing
|
|
|
|
```bash
|
|
# Add sinkhole entry
|
|
echo "127.0.0.1 evil.example.com" >> /etc/hosts
|
|
|
|
# Unbound DNS sinkhole
|
|
unbound-control local_zone "evil.example.com" redirect
|
|
unbound-control local_data "evil.example.com A 10.0.0.99"
|
|
```
|
|
|
|
## Evidence Collection
|
|
|
|
```bash
|
|
# Memory dump (Linux)
|
|
sudo dd if=/proc/kcore of=/evidence/memory.raw bs=1M
|
|
|
|
# Volatile data collection
|
|
ps auxww > /evidence/processes.txt
|
|
ss -tunap > /evidence/network.txt
|
|
cat /proc/net/arp > /evidence/arp.txt
|
|
```
|