mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
70 lines
2.5 KiB
Markdown
70 lines
2.5 KiB
Markdown
# Compromised Cloud Credentials Detection API Reference
|
|
|
|
## GuardDuty Credential Findings
|
|
|
|
| Finding Type | Description |
|
|
|-------------|-------------|
|
|
| `UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS` | EC2 instance creds used outside AWS |
|
|
| `UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B` | Console login from unusual location |
|
|
| `UnauthorizedAccess:IAMUser/MaliciousIPCaller` | API calls from known malicious IP |
|
|
| `Discovery:IAMUser/AnomalousBehavior` | Unusual reconnaissance API patterns |
|
|
| `Persistence:IAMUser/AnomalousBehavior` | Unusual persistence API calls |
|
|
| `InitialAccess:IAMUser/AnomalousBehavior` | Unusual initial access patterns |
|
|
|
|
## CloudTrail - Credential Abuse Investigation
|
|
|
|
```bash
|
|
# Lookup events by access key
|
|
aws cloudtrail lookup-events \
|
|
--lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAXXXXXXXXXXXXXXXX \
|
|
--start-time 2024-01-01T00:00:00Z --end-time 2024-01-02T00:00:00Z
|
|
|
|
# Lookup by username
|
|
aws cloudtrail lookup-events \
|
|
--lookup-attributes AttributeKey=Username,AttributeValue=compromised-user
|
|
|
|
# Athena query for deep investigation
|
|
SELECT eventtime, eventsource, eventname, sourceipaddress,
|
|
useridentity.arn, errorcode
|
|
FROM cloudtrail_logs
|
|
WHERE useridentity.accesskeyid = 'AKIAXXXXXXXXXXXXXXXX'
|
|
AND eventtime > '2024-01-01'
|
|
ORDER BY eventtime DESC
|
|
```
|
|
|
|
## IAM Credential Remediation
|
|
|
|
```bash
|
|
# Deactivate access key
|
|
aws iam update-access-key --access-key-id AKIAXXXX --user-name user --status Inactive
|
|
|
|
# Delete access key
|
|
aws iam delete-access-key --access-key-id AKIAXXXX --user-name user
|
|
|
|
# Revoke all sessions (inline deny policy with token age condition)
|
|
aws iam put-user-policy --user-name user --policy-name RevokeOldSessions \
|
|
--policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"DateLessThan":{"aws:TokenIssueTime":"2024-01-15T00:00:00Z"}}}]}'
|
|
|
|
# List all access keys for user
|
|
aws iam list-access-keys --user-name user
|
|
```
|
|
|
|
## Reconnaissance API Calls to Monitor
|
|
|
|
```
|
|
GetCallerIdentity, ListBuckets, DescribeInstances,
|
|
ListUsers, ListRoles, ListAccessKeys, DescribeRegions,
|
|
GetAccountAuthorizationDetails, ListFunctions,
|
|
DescribeDBInstances, ListSecrets
|
|
```
|
|
|
|
## Azure - Compromised Credential Detection
|
|
|
|
```bash
|
|
# Query risky sign-ins
|
|
az rest --method GET --url "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers"
|
|
|
|
# Revoke user sessions
|
|
az rest --method POST --url "https://graph.microsoft.com/v1.0/users/{id}/revokeSignInSessions"
|
|
```
|