mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.8 KiB

Raw Blame History

API Reference — Hunting for Startup Folder Persistence

Libraries Used

watchdog: Real-time filesystem monitoring — Observer, FileSystemEventHandler
hashlib: SHA-256 file hashing
subprocess: Registry Run key queries via reg query
pathlib: Cross-platform path handling and file metadata

CLI Interface

python agent.py scan
python agent.py registry
python agent.py monitor --duration 120
python agent.py full

Core Functions

`get_startup_paths()` — Enumerate startup directories

Returns user startup (%APPDATA%\...\Startup) and all-users startup (%PROGRAMDATA%\...\Startup) paths.

`analyze_file(filepath, scope)` — Single file risk analysis

Computes SHA-256 hash, checks extension against risk table, evaluates file age, size, baseline membership. Risk scoring by extension, recency, and scope.

`scan_startup_folders()` — Full startup directory scan

Iterates all files in both startup paths. Returns sorted by risk score.

`check_registry_run_keys()` — Registry autostart audit

Queries 4 Registry Run keys via reg query:

HKCU\...\Run, HKCU\...\RunOnce
HKLM\...\Run, HKLM\...\RunOnce Flags entries containing powershell, cmd.exe, temp paths, encoded commands.

`StartupMonitorHandler` — Watchdog event handler

Subclasses FileSystemEventHandler. Handles on_created, on_modified, on_deleted. Runs analyze_file() on new files and prints JSON alerts.

`monitor_startup(duration_seconds)` — Real-time monitoring

Creates Observer, schedules handler on all startup paths. Monitors for specified duration. Returns detected events.

`full_hunt()` — Comprehensive persistence hunt

Startup Folder Paths

Scope	Path
Current User	`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`
All Users	`%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup`

File Extension Risk Scores

Extension	Base Score	Notes
.ps1	45	PowerShell script
.hta	45	HTML Application
.pif	45	Program Information File
.vbs, .vbe	40	VBScript
.js, .jse	40	JScript
.wsf, .wsh	35-40	Windows Script
.bat, .cmd	35	Batch file
.exe	30	Executable
.scr	40	Screen saver (executable)
.url	20	Internet shortcut
.lnk	15	Shortcut (often legitimate)

Additional Risk Factors

Factor	Points
Created within 7 days	+25
Created within 24 hours	+15
Zero-byte file	+10
File > 10 MB	+10
Not in baseline	+10
All-users scope	+10

MITRE ATT&CK Mapping

T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Tactics: Persistence, Privilege Escalation

Dependencies

watchdog >= 3.0.0
Windows OS (startup folder paths are Windows-specific)

2.8 KiB Raw Blame History