mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# API Reference — Hunting for Registry Persistence Mechanisms
|
|
|
|
## Libraries Used
|
|
- **subprocess**: Execute `reg query /s` to enumerate registry persistence keys
|
|
- **re**: Pattern matching for suspicious values in registry entries
|
|
- **json**: Baseline file I/O and structured output
|
|
|
|
## CLI Interface
|
|
|
|
```
|
|
python agent.py scan [--categories run_keys winlogon ifeo] [--save-baseline out.json]
|
|
python agent.py compare --baseline baseline.json
|
|
```
|
|
|
|
## Core Functions
|
|
|
|
### `scan_persistence_keys(categories=None)`
|
|
Enumerates registry persistence keys across 8 categories and flags suspicious entries.
|
|
|
|
**Parameters:**
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `categories` | list | Optional subset of categories to scan (default: all 8) |
|
|
|
|
**Returns:** dict with `categories` map, `all_suspicious` list, and `total_suspicious` count.
|
|
|
|
### `compare_baseline(baseline_file, current_scan=None)`
|
|
Compares current registry state against a saved baseline to detect new persistence entries.
|
|
|
|
**Parameters:**
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `baseline_file` | str | Path to baseline JSON file from previous scan |
|
|
|
|
**Returns:** dict with `baseline_entries` count, `new_entries` count, and `findings` list.
|
|
|
|
## Registry Categories Scanned
|
|
|
|
| Category | Keys | MITRE Technique |
|
|
|----------|------|----------------|
|
|
| `run_keys` | Run, RunOnce, RunOnceEx | T1547.001 |
|
|
| `winlogon` | Winlogon Shell, Userinit | T1547.004 |
|
|
| `ifeo` | Image File Execution Options | T1546.012 |
|
|
| `appinit` | AppInit_DLLs | T1546.010 |
|
|
| `shell_extensions` | ShellExecuteHooks | T1546.015 |
|
|
| `browser_helpers` | Browser Helper Objects | T1176 |
|
|
| `com_hijack` | CLSID overrides in HKCU | T1546.015 |
|
|
| `boot_execute` | BootExecute, Session Manager | T1542.003 |
|
|
|
|
## Dependencies
|
|
No external packages required — uses Python standard library and `reg.exe`.
|