mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
91 lines
3.0 KiB
Markdown
91 lines
3.0 KiB
Markdown
# Detailed Hunting Workflow - T1055 Process Injection
|
|
|
|
## Phase 1: CreateRemoteThread Detection (Sysmon Event 8)
|
|
|
|
### Step 1.1 - Identify All Remote Thread Creation
|
|
```spl
|
|
index=sysmon EventCode=8
|
|
| where SourceImage!=TargetImage
|
|
| stats count by SourceImage TargetImage Computer
|
|
| sort -count
|
|
```
|
|
|
|
### Step 1.2 - Filter to High-Value Target Processes
|
|
```spl
|
|
index=sysmon EventCode=8
|
|
| where match(TargetImage, "(?i)(svchost|explorer|lsass|winlogon|spoolsv|dllhost|RuntimeBroker)\.exe$")
|
|
| where NOT match(SourceImage, "(?i)(csrss|lsass|services|svchost|MsMpEng|vmtoolsd)\.exe$")
|
|
| stats count values(Computer) as hosts by SourceImage TargetImage
|
|
| sort -count
|
|
```
|
|
|
|
## Phase 2: ProcessAccess Analysis (Sysmon Event 10)
|
|
|
|
### Step 2.1 - High-Privilege Cross-Process Access
|
|
```spl
|
|
index=sysmon EventCode=10
|
|
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF")
|
|
| where NOT match(SourceImage, "(?i)(MsMpEng|csrss|lsass|services|svchost|taskmgr|procexp)\.exe$")
|
|
| where match(TargetImage, "(?i)(lsass|svchost|explorer|winlogon)\.exe$")
|
|
| table _time Computer SourceImage TargetImage GrantedAccess CallTrace
|
|
```
|
|
|
|
### Step 2.2 - LSASS Access for Credential Theft
|
|
```spl
|
|
index=sysmon EventCode=10
|
|
| where match(TargetImage, "(?i)lsass\.exe$")
|
|
| where match(GrantedAccess, "(0x1FFFFF|0x1F3FFF|0x0040|0x143A)")
|
|
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE)\.exe$")
|
|
| table _time Computer SourceImage GrantedAccess CallTrace
|
|
```
|
|
|
|
## Phase 3: DLL Injection Detection (Sysmon Event 7)
|
|
|
|
### Step 3.1 - DLLs Loaded from User-Writable Paths
|
|
```spl
|
|
index=sysmon EventCode=7
|
|
| where match(ImageLoaded, "(?i)\\(temp|appdata|downloads|users\\[^\\]+\\desktop)\\")
|
|
| where match(Image, "(?i)(svchost|explorer|winlogon|services)\.exe$")
|
|
| table _time Computer Image ImageLoaded Hashes Signed
|
|
```
|
|
|
|
### Step 3.2 - Unsigned DLLs in System Processes
|
|
```spl
|
|
index=sysmon EventCode=7
|
|
| where Signed="false"
|
|
| where match(Image, "(?i)\\(svchost|services|lsass|explorer)\.exe$")
|
|
| table _time Computer Image ImageLoaded Hashes SignatureStatus
|
|
```
|
|
|
|
## Phase 4: Process Hollowing Detection (Sysmon Event 25)
|
|
|
|
### Step 4.1 - ProcessTampering Events
|
|
```spl
|
|
index=sysmon EventCode=25
|
|
| table _time Computer Image Type RuleName User
|
|
```
|
|
|
|
## Phase 5: Correlation and Investigation
|
|
|
|
### Step 5.1 - Build Full Attack Chain
|
|
```spl
|
|
index=sysmon (EventCode=1 OR EventCode=8 OR EventCode=10 OR EventCode=25)
|
|
| where match(SourceImage, "[suspected_injector]") OR match(Image, "[suspected_injector]")
|
|
| sort _time
|
|
| table _time EventCode Image SourceImage TargetImage CommandLine GrantedAccess
|
|
```
|
|
|
|
### Step 5.2 - Memory Analysis
|
|
For confirmed injection, capture process memory using:
|
|
- PE-sieve for automated scan of hollow/injected processes
|
|
- Moneta for memory region anomaly detection
|
|
- Volatility malfind plugin for offline memory forensics
|
|
|
|
## Phase 6: Response
|
|
|
|
1. Isolate affected endpoint via EDR
|
|
2. Capture memory dump before cleanup
|
|
3. Identify and remove injecting malware
|
|
4. Check for persistence mechanisms deployed by injected code
|
|
5. Sweep environment for same injection technique indicators
|