mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.2 KiB
2.2 KiB
Standards and References - DNS Tunneling Detection
MITRE ATT&CK References
| Technique | Name | Description |
|---|---|---|
| T1071.004 | Application Layer Protocol: DNS | DNS-based C2 communication |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | Data theft via DNS |
| T1572 | Protocol Tunneling | IP-over-DNS tunneling |
| T1568.002 | Domain Generation Algorithms | Algorithmically generated domains |
| T1132.001 | Data Encoding: Standard Encoding | Base32/64 in DNS queries |
DNS Tunneling Detection Thresholds
| Indicator | Threshold | Rationale |
|---|---|---|
| Query length | > 50 characters | Normal queries average 20-30 chars |
| Subdomain label length | > 30 characters | Max label is 63; tunneling uses near-max |
| Subdomain entropy | > 3.5 bits/char | Base32/64 encoding produces high entropy |
| Unique subdomains per domain | > 100/hour | Legitimate domains have few unique subs |
| Query volume to single domain | > 100/hour | Sustained high volume indicates tunneling |
| TXT record query ratio | > 50% to domain | TXT queries carry more data |
| NULL record queries | Any volume | Rarely used legitimately |
DNS Tunneling Tools
| Tool | Protocol | Record Types | Data Rate | Detection Difficulty |
|---|---|---|---|---|
| iodine | IP-over-DNS | NULL, TXT, CNAME, A | ~100 Kbps | Medium |
| dnscat2 | C2 over DNS | TXT, CNAME, MX | ~10 Kbps | Medium |
| DNSExfiltrator | Exfil over DNS | TXT, A | ~5 Kbps | Medium-Hard |
| Cobalt Strike DNS | C2 | A, TXT | Variable | Hard |
| dns2tcp | TCP-over-DNS | TXT, KEY | ~50 Kbps | Medium |
| Heyoka | DNS exfiltration | All types | Variable | Hard |
Zeek Log Fields for DNS Analysis
| Field | Description | Tunnel Relevance |
|---|---|---|
| query | Full DNS query name | Length and entropy analysis |
| qtype_name | Query record type | TXT/NULL/CNAME anomalies |
| answers | Response content | Response size analysis |
| rcode_name | Response code | NXDOMAIN patterns |
| id.orig_h | Source IP | Source identification |
| AA | Authoritative answer | Non-authoritative responses |
| rejected | Query rejected | Filtering effectiveness |