mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
87 lines
2.7 KiB
Markdown
87 lines
2.7 KiB
Markdown
# API Reference: T1055 Process Injection Detection with Sysmon
|
|
|
|
## MITRE ATT&CK T1055 Sub-Techniques
|
|
|
|
| Sub-technique | Method | Sysmon Event |
|
|
|---------------|--------|--------------|
|
|
| T1055.001 | DLL Injection | Event 7, 8, 10 |
|
|
| T1055.002 | PE Injection | Event 8, 10 |
|
|
| T1055.003 | Thread Execution Hijacking | Event 8 |
|
|
| T1055.004 | Asynchronous Procedure Call | Event 8, 10 |
|
|
| T1055.005 | Thread Local Storage | Event 8 |
|
|
| T1055.012 | Process Hollowing | Event 1, 10, 25 |
|
|
|
|
## Sysmon Event IDs
|
|
|
|
### Event 8 — CreateRemoteThread
|
|
| Field | Index | Description |
|
|
|-------|-------|-------------|
|
|
| SourceProcessGuid | 1 | GUID of injecting process |
|
|
| SourceProcessId | 2 | PID of injecting process |
|
|
| SourceImage | 4 | Path of injecting binary |
|
|
| TargetProcessGuid | 5 | GUID of target process |
|
|
| TargetProcessId | 6 | PID of target process |
|
|
| TargetImage | 7 | Path of target binary |
|
|
| StartAddress | 8 | Thread start address |
|
|
| StartFunction | 9 | Thread entry function |
|
|
|
|
### Event 10 — ProcessAccess
|
|
| Field | Index | Description |
|
|
|-------|-------|-------------|
|
|
| SourceProcessId | 3 | Accessing PID |
|
|
| SourceImage | 4 | Accessing binary path |
|
|
| TargetProcessId | 7 | Accessed PID |
|
|
| TargetImage | 8 | Accessed binary path |
|
|
| GrantedAccess | 10 | Access rights mask |
|
|
|
|
### Event 7 — Image Loaded
|
|
| Field | Index | Description |
|
|
|-------|-------|-------------|
|
|
| Image | 3 | Process that loaded DLL |
|
|
| ImageLoaded | 5 | DLL path |
|
|
| Signed | 6 | Signature status |
|
|
| SignatureStatus | 8 | Valid/Invalid/Unknown |
|
|
|
|
## Process Access Masks
|
|
|
|
| Mask | Right | Injection Use |
|
|
|------|-------|---------------|
|
|
| 0x0008 | PROCESS_VM_OPERATION | VirtualAllocEx |
|
|
| 0x0010 | PROCESS_VM_READ | ReadProcessMemory |
|
|
| 0x0020 | PROCESS_VM_WRITE | WriteProcessMemory |
|
|
| 0x0800 | PROCESS_SUSPEND_RESUME | Hollowing |
|
|
| 0x001F0FFF | PROCESS_ALL_ACCESS | Full control |
|
|
|
|
## Sysmon Configuration for Injection Detection
|
|
```xml
|
|
<Sysmon>
|
|
<EventFiltering>
|
|
<ProcessAccess onmatch="include">
|
|
<GrantedAccess condition="is">0x1F0FFF</GrantedAccess>
|
|
<GrantedAccess condition="is">0x001F0FFF</GrantedAccess>
|
|
</ProcessAccess>
|
|
<CreateRemoteThread onmatch="exclude">
|
|
<SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
|
|
</CreateRemoteThread>
|
|
</EventFiltering>
|
|
</Sysmon>
|
|
```
|
|
|
|
## Sigma Rule Example
|
|
```yaml
|
|
title: CreateRemoteThread into System Process
|
|
logsource:
|
|
product: windows
|
|
category: create_remote_thread
|
|
detection:
|
|
selection:
|
|
TargetImage|endswith:
|
|
- '\svchost.exe'
|
|
- '\explorer.exe'
|
|
- '\lsass.exe'
|
|
filter:
|
|
SourceImage|startswith: 'C:\Windows\System32\'
|
|
condition: selection and not filter
|
|
level: critical
|
|
```
|