mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.9 KiB
2.9 KiB
API Reference: Deploying Ransomware Canary Files
Canary File Deployment
| Function | Parameters | Returns |
|---|---|---|
deploy_canary_files(target_dirs, custom_files) |
List of directories, optional custom file dict | Manifest with deployed file paths and hashes |
compute_sha256(filepath) |
File path string | SHA-256 hex digest |
compute_entropy(filepath) |
File path string | Shannon entropy float (0-8) |
Monitoring Functions
| Function | Parameters | Returns |
|---|---|---|
start_monitoring(manifest_path, config) |
Path to manifest JSON, alert config dict | Blocks until interrupted |
verify_canary_integrity(manifest_path) |
Path to manifest JSON | Dict with intact/modified/missing counts |
simulate_ransomware_test(manifest_path) |
Path to manifest JSON | List of test results |
CanaryFileHandler Events
| Event | Handler Method | Trigger |
|---|---|---|
| File modified | on_modified(event) |
Content change detected |
| File deleted | on_deleted(event) |
Canary file removed |
| File renamed | on_moved(event) |
Canary file renamed or moved |
| New file created | on_created(event) |
Ransom note detection in monitored dirs |
Alert Channels
| Channel | Function | Required Config |
|---|---|---|
| Slack | send_slack_alert(data, webhook_url) |
slack_webhook URL |
send_email_alert(data, host, port, sender, recipients) |
SMTP server details | |
| Syslog | send_syslog_alert(data, server, port) |
Syslog server address |
| File | Automatic | Writes to canary_alerts.jsonl |
Ransomware Extension Detection
| Extensions Monitored |
|---|
.encrypted, .locked, .lockbit, .crypt, .enc |
.ransom, .pay, .aes, .rsa, .cry |
.ryk, .revil, .conti, .hive, .black, .basta |
CLI Usage
# Deploy canary files
python agent.py --action deploy --dirs /srv/shares /home/admin/Documents
# Monitor canary files with Slack alerts
python agent.py --action monitor --slack-webhook https://hooks.slack.com/...
# Verify canary file integrity
python agent.py --action verify
# Test detection pipeline
python agent.py --action test
Python Libraries
| Library | Version | Purpose |
|---|---|---|
watchdog |
>=3.0 | Filesystem event monitoring |
requests |
>=2.28 | Slack webhook integration |
psutil |
>=5.9 | Process information gathering |
hashlib |
stdlib | SHA-256 file hashing |
smtplib |
stdlib | SMTP email alerts |
References
- Elastic Security Labs: Ransomware Canary Files: https://www.elastic.co/security-labs/ransomware-in-the-honeypot-how-we-capture-keys
- Huntress Ransomware Canaries: https://support.huntress.io/hc/en-us/articles/4404005167763
- Python Watchdog Documentation: https://python-watchdog.readthedocs.io/
- CISA #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide