mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.4 KiB
1.4 KiB
Standards and References - Suspicious Scheduled Tasks
MITRE ATT&CK References
| Technique | Name | Usage |
|---|---|---|
| T1053.005 | Scheduled Task | Primary persistence/execution technique |
| T1053.003 | Cron (Linux) | Scheduled execution on Linux |
| T1078 | Valid Accounts | Tasks running under legitimate accounts |
Windows Event IDs
| Event ID | Source | Description |
|---|---|---|
| 4698 | Security | Scheduled task created |
| 4699 | Security | Scheduled task deleted |
| 4700 | Security | Scheduled task enabled |
| 4701 | Security | Scheduled task disabled |
| 4702 | Security | Scheduled task updated |
| 106 | TaskScheduler/Operational | Task registered |
| 200 | TaskScheduler/Operational | Action started |
| 201 | TaskScheduler/Operational | Action completed |
Suspicious Task Indicators
| Indicator | Description |
|---|---|
| User-writable paths | Actions executing from TEMP, AppData, Downloads |
| Encoded commands | Base64 or -EncodedCommand in arguments |
| Script interpreters | PowerShell, cmd, wscript, cscript as actions |
| Short intervals | Trigger repeating every 1-5 minutes |
| System startup trigger | Task runs at boot for persistence |
| Remote creation | Task created from remote system |
| Name mimicry | Task name similar to legitimate Windows tasks |
| Hidden SD | Security Descriptor modified to hide task |