mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
3.7 KiB
3.7 KiB
LOLBin Threat Hunt Template
Hunt Metadata
| Field | Value |
|---|---|
| Hunt ID | TH-LOLBIN-YYYY-MM-DD-NNN |
| Analyst | |
| Date Started | |
| Date Completed | |
| Status | [ ] In Progress / [ ] Complete |
| Priority | [ ] Critical / [ ] High / [ ] Medium / [ ] Low |
Hypothesis
Hypothesis Statement: [e.g., "Adversaries are using certutil.exe to download second-stage payloads from external infrastructure, bypassing web proxy controls."]
Basis for Hypothesis:
- Threat Intelligence Report: [Reference]
- Previous Incident Finding
- MITRE ATT&CK Gap Analysis
- Red Team Exercise Result
- Anomaly in Monitoring Data
Scope
Target LOLBins:
- certutil.exe (T1140)
- mshta.exe (T1218.005)
- rundll32.exe (T1218.011)
- regsvr32.exe (T1218.010)
- msiexec.exe (T1218.007)
- bitsadmin.exe (T1197)
- cmstp.exe (T1218.003)
- wmic.exe (T1047)
- msbuild.exe (T1127.001)
- installutil.exe (T1218.004)
- forfiles.exe (T1202)
- Other: _______________
Time Range: [Start Date/Time] to [End Date/Time] Endpoints in Scope: [All / Specific OUs / High-Value Targets] Data Sources Used:
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 3 (Network Connection)
- Sysmon Event ID 7 (Image Loaded)
- Sysmon Event ID 11 (File Create)
- Windows Security 4688
- EDR Telemetry: _______________
- Network Proxy Logs
- DNS Query Logs
- Firewall Logs
Queries Executed
Query 1: [Description]
[Query text]
Results: [Count] events returned Time to Execute: [Duration]
Query 2: [Description]
[Query text]
Results: [Count] events returned Time to Execute: [Duration]
Findings
Finding 1
| Attribute | Details |
|---|---|
| Severity | [ ] Critical / [ ] High / [ ] Medium / [ ] Low |
| LOLBin | |
| MITRE ATT&CK | |
| Host(s) | |
| User(s) | |
| Command Line | |
| Parent Process | |
| Network IOCs | |
| File IOCs | |
| Timestamp | |
| Evidence |
Analysis: [Detailed description of finding] Verdict: [ ] True Positive / [ ] False Positive / [ ] Benign True Positive
Finding 2
| Attribute | Details |
|---|---|
| Severity | |
| LOLBin | |
| MITRE ATT&CK | |
| Host(s) | |
| User(s) | |
| Command Line | |
| Parent Process | |
| Network IOCs | |
| File IOCs | |
| Timestamp | |
| Evidence |
Analysis: [Detailed description] Verdict: [ ] True Positive / [ ] False Positive / [ ] Benign True Positive
IOC List
Network IOCs
| Type | Value | Context |
|---|---|---|
| IP | ||
| Domain | ||
| URL |
File IOCs
| Type | Value | Context |
|---|---|---|
| SHA256 | ||
| Filename | ||
| File Path |
Behavioral IOCs
| LOLBin | Argument Pattern | Parent Process |
|---|---|---|
Hunt Results Summary
| Metric | Count |
|---|---|
| Total Events Analyzed | |
| Anomalies Identified | |
| True Positives | |
| False Positives | |
| Benign True Positives | |
| New IOCs Discovered | |
| Detection Rules Created | |
| Detection Rules Updated |
Recommendations
- Detection Improvements: [New rules or tuning needed]
- Visibility Gaps: [Missing data sources or coverage]
- Response Actions: [Incidents to escalate, containment needed]
- Follow-up Hunts: [Related hypotheses to investigate next]
Hypothesis Outcome
- Confirmed: Evidence found supporting the hypothesis
- Partially Confirmed: Some evidence found, requires further investigation
- Refuted: No evidence found, hypothesis disproven
- Inconclusive: Insufficient data to confirm or refute