mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
89 lines
2.1 KiB
Markdown
89 lines
2.1 KiB
Markdown
# AWS Credential Exposure Detection API Reference
|
|
|
|
## TruffleHog CLI
|
|
|
|
```bash
|
|
# Scan local git repo
|
|
trufflehog git file:///path/to/repo --json
|
|
|
|
# Scan GitHub organization
|
|
trufflehog github --org my-org --token $GITHUB_TOKEN --json
|
|
|
|
# Scan GitHub repo
|
|
trufflehog git https://github.com/org/repo.git --json
|
|
|
|
# Scan filesystem (non-git)
|
|
trufflehog filesystem /path/to/dir --json
|
|
|
|
# Scan S3 bucket
|
|
trufflehog s3 --bucket my-bucket --json
|
|
|
|
# Only show verified credentials
|
|
trufflehog git file:///repo --only-verified --json
|
|
```
|
|
|
|
## git-secrets CLI
|
|
|
|
```bash
|
|
# Install hooks in repo
|
|
git secrets --install
|
|
git secrets --register-aws
|
|
|
|
# Scan repo history
|
|
git secrets --scan-history
|
|
|
|
# Scan specific file
|
|
git secrets --scan /path/to/file
|
|
|
|
# Add custom pattern
|
|
git secrets --add 'PRIVATE KEY'
|
|
git secrets --add-provider -- cat /path/to/patterns.txt
|
|
```
|
|
|
|
## AWS IAM CLI - Key Management
|
|
|
|
```bash
|
|
# Check key last used
|
|
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXXXXXXXXXX
|
|
|
|
# List access keys for user
|
|
aws iam list-access-keys --user-name jsmith
|
|
|
|
# Deactivate exposed key
|
|
aws iam update-access-key --access-key-id AKIAXXXXXXXXXXXXXXXX \
|
|
--user-name jsmith --status Inactive
|
|
|
|
# Delete key
|
|
aws iam delete-access-key --access-key-id AKIAXXXXXXXXXXXXXXXX \
|
|
--user-name jsmith
|
|
|
|
# Create new key (after rotation)
|
|
aws iam create-access-key --user-name jsmith
|
|
```
|
|
|
|
## AWS Access Key Regex Patterns
|
|
|
|
```
|
|
Access Key ID: AKIA[A-Z0-9]{16}
|
|
Temp Key ID: ASIA[A-Z0-9]{16}
|
|
Secret Key: [A-Za-z0-9/+=]{40}
|
|
```
|
|
|
|
## GuardDuty Credential Findings
|
|
|
|
| Finding Type | Description |
|
|
|-------------|-------------|
|
|
| `UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS` | Instance creds used outside AWS |
|
|
| `UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B` | Console login from unusual IP |
|
|
| `Recon:IAMUser/MaliciousIPCaller.Custom` | API calls from threat intel IPs |
|
|
|
|
## AWS CloudTrail - Credential Abuse Queries (Athena)
|
|
|
|
```sql
|
|
SELECT eventtime, useridentity.accesskeyid, sourceipaddress, eventname
|
|
FROM cloudtrail_logs
|
|
WHERE useridentity.accesskeyid = 'AKIAXXXXXXXXXXXXXXXX'
|
|
ORDER BY eventtime DESC
|
|
LIMIT 100;
|
|
```
|