mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
106 lines
2.3 KiB
Markdown
106 lines
2.3 KiB
Markdown
# API Reference: Windows CIS Benchmark Hardening
|
|
|
|
## CIS Benchmark Sections
|
|
|
|
| Section | Topic |
|
|
|---------|-------|
|
|
| 1 | Account Policies (passwords, lockout) |
|
|
| 2 | Local Policies (audit, user rights, security options) |
|
|
| 9 | Windows Firewall |
|
|
| 17 | Advanced Audit Policy |
|
|
| 18 | Administrative Templates |
|
|
| 19 | User Configuration |
|
|
|
|
## PowerShell Commands
|
|
|
|
### Password Policy
|
|
```powershell
|
|
net accounts
|
|
# or
|
|
Get-ADDefaultDomainPasswordPolicy
|
|
```
|
|
|
|
### Audit Policy
|
|
```powershell
|
|
auditpol /get /category:*
|
|
```
|
|
|
|
### Firewall Status
|
|
```powershell
|
|
Get-NetFirewallProfile | Select-Object Name, Enabled
|
|
```
|
|
|
|
### Registry Checks
|
|
```powershell
|
|
Get-ItemProperty -Path 'HKLM:\...' -Name 'ValueName'
|
|
```
|
|
|
|
## Key Registry Settings
|
|
|
|
| Path | Value | Recommended |
|
|
|------|-------|-------------|
|
|
| `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel` | DWORD | 5 (NTLMv2 only) |
|
|
| `HKLM\...\Policies\System\EnableLUA` | DWORD | 1 (UAC enabled) |
|
|
| `HKLM\...\LanManServer\Parameters\SMB1` | DWORD | 0 (disabled) |
|
|
| `HKLM\...\Policies\System\ConsentPromptBehaviorAdmin` | DWORD | 2 |
|
|
|
|
## Password Policy Settings
|
|
|
|
| Setting | CIS Recommendation |
|
|
|---------|-------------------|
|
|
| Minimum length | >= 14 characters |
|
|
| Maximum age | <= 365 days |
|
|
| Minimum age | >= 1 day |
|
|
| Complexity | Enabled |
|
|
| Lockout threshold | <= 5 attempts |
|
|
| Lockout duration | >= 15 minutes |
|
|
|
|
## Advanced Audit Policy
|
|
|
|
| Subcategory | Recommended |
|
|
|-------------|-------------|
|
|
| Credential Validation | Success and Failure |
|
|
| Logon/Logoff | Success and Failure |
|
|
| Account Management | Success |
|
|
| Process Creation | Success |
|
|
| Policy Change | Success |
|
|
|
|
## GPO Export and Analysis
|
|
|
|
### Export GPO
|
|
```powershell
|
|
gpresult /H gpo-report.html
|
|
```
|
|
|
|
### Secedit Export
|
|
```cmd
|
|
secedit /export /cfg security-config.inf
|
|
```
|
|
|
|
## Automated Tools
|
|
|
|
### Microsoft Security Compliance Toolkit
|
|
```powershell
|
|
# Download from Microsoft
|
|
# Includes GPO baselines and LGPO tool
|
|
LGPO.exe /g .\GPO-Backup
|
|
```
|
|
|
|
### CIS-CAT
|
|
```bash
|
|
# CIS Configuration Assessment Tool
|
|
cis-cat.bat -b benchmark.xml -p "CIS Windows 11 Enterprise"
|
|
```
|
|
|
|
## Windows Optional Features
|
|
|
|
### Check SMBv1
|
|
```powershell
|
|
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
|
|
```
|
|
|
|
### Disable SMBv1
|
|
```powershell
|
|
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
|
|
```
|