mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.0 KiB
2.0 KiB
API Reference: Malware Eradication
Windows Process Termination
taskkill
taskkill /F /PID 1234 # Kill by PID
taskkill /F /IM malware.exe # Kill by name
taskkill /F /T /PID 1234 # Kill process tree
PowerShell
Stop-Process -Id 1234 -Force
Get-Process -Name "malware" | Stop-Process -Force
Windows Persistence Cleanup
Registry Run Keys
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v MalwareName /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v MalwareName /f
Scheduled Tasks
schtasks /Delete /TN "MalwareTask" /F
schtasks /Query /FO CSV /V /NH
Services
sc stop MalwareService
sc delete MalwareService
sc query type= all state= all
Linux Persistence Cleanup
Crontab
crontab -l -u root # List root cron
crontab -r -u root # Remove all cron (use carefully)
ls -la /etc/cron.d/
ls -la /var/spool/cron/
Systemd Services
systemctl list-unit-files --type=service
systemctl disable malware.service
systemctl stop malware.service
rm /etc/systemd/system/malware.service
systemctl daemon-reload
Process Kill
kill -9 <pid>
pkill -f "malware_pattern"
File Quarantine Best Practices
Hash Before Move
sha256sum /path/to/malware > /quarantine/hash.txt
Secure Move
mv /path/to/malware /quarantine/sha256_filename.quarantine
chmod 000 /quarantine/sha256_filename.quarantine
Autoruns (Sysinternals)
Command Line
autorunsc.exe -a * -c -h -s -v -vt
Output Columns
| Column | Description |
|---|---|
| Entry | Autorun name |
| Image Path | Binary location |
| Signer | Code signing info |
| VT Detection | VirusTotal results |
YARA Scanning for Remaining Artifacts
Command
yara -r rules.yar /target/directory
Rule Example
rule Malware_Remnant {
strings:
$s1 = "malware_mutex" ascii
$s2 = {4D 5A 90 00}
condition:
any of them
}