mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

3.0 KiB

Raw Blame History

Detailed Hunting Workflow - DCSync Attack Detection

Phase 1: Enumerate Legitimate Replication Accounts

Step 1.1 - List All Domain Controllers

Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem

Step 1.2 - Find Accounts with Replication Rights

# Find all accounts with Replicating Directory Changes
Import-Module ActiveDirectory
$rootDSE = Get-ADRootDSE
$domainDN = $rootDSE.defaultNamingContext
$acl = Get-Acl "AD:\$domainDN"
$acl.Access | Where-Object {
    $_.ObjectType -eq "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" -or
    $_.ObjectType -eq "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
} | Select-Object IdentityReference, ActiveDirectoryRights, ObjectType

Step 1.3 - BloodHound Query for DCSync Rights

MATCH p=(n)-[:GetChanges|GetChangesAll]->(d:Domain)
WHERE NOT n:Domain
RETURN n.name, labels(n)

Phase 2: Deploy Detection

Step 2.1 - Enable Required Audit Policy

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

Step 2.2 - Configure SACL on Domain Object

Apply SACL to the domain root object monitoring for:

Control Access rights
Access to Replication GUIDs
By Everyone or Authenticated Users

Phase 3: Active Monitoring

Step 3.1 - Splunk Real-Time Detection

index=wineventlog source="WinEventLog:Security" EventCode=4662
| rex field=Properties "(?<guid>\{[0-9a-f-]+\})"
| where guid IN ("{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}",
    "{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}",
    "{89e95b76-444d-4c62-991a-0facbeda640c}")
| lookup dc_accounts SubjectUserName OUTPUT is_dc
| where is_dc!="true"
| eval alert_severity="CRITICAL"
| table _time SubjectUserName SubjectDomainName Computer guid alert_severity

Step 3.2 - Network-Level Detection

index=zeek sourcetype=dce_rpc
| where operation="DRSGetNCChanges"
| lookup domain_controllers src_ip OUTPUT is_dc
| where is_dc!="true"
| table _time src_ip dst_ip operation

Phase 4: Investigation

Step 4.1 - Determine Source Machine

Correlate Event 4662 with Event 4624 to identify the source workstation:

index=wineventlog EventCode=4624 LogonType=3
| where TargetUserName=[suspected_account]
| table _time TargetUserName IpAddress WorkstationName LogonType

Step 4.2 - Check for Subsequent Credential Abuse

index=wineventlog EventCode=4769
| where ServiceName="krbtgt"
| where TicketEncryptionType="0x17"
| table _time TargetUserName ServiceName IpAddress TicketEncryptionType

Phase 5: Response

Step 5.1 - Immediate Containment

Disable compromised account immediately
Rotate KRBTGT password (twice, 12 hours apart)
Reset all service account passwords
Block source IP at network level
Isolate source machine for forensics

Step 5.2 - Remediation

Remove unauthorized replication rights
Review all accounts with DCSync-capable permissions
Implement tiered administration model
Enable Microsoft Defender for Identity DCSync alerts
Deploy Protected Users security group for admin accounts

3.0 KiB Raw Blame History