mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.7 KiB

Raw Blame History

Adversary-in-the-Middle (AiTM) Phishing Detection - API Reference

AiTM Attack Overview

AiTM phishing uses a reverse proxy between the victim and legitimate login page to intercept session cookies in real-time, bypassing MFA. Common frameworks: Evilginx2, Modlishka, Muraena.

Attack Chain:

Victim clicks phishing link
Reverse proxy forwards request to real login page
Victim enters credentials and completes MFA
Proxy captures session cookie
Attacker replays session cookie from different location

Export via Microsoft Graph API

GET https://graph.microsoft.com/v1.0/auditLogs/signIns

Key Fields

Field	Type	Description
`userPrincipalName`	string	User email
`createdDateTime`	ISO-8601	Sign-in timestamp
`ipAddress`	string	Source IP address
`location.latitude`	float	Geo-location latitude
`location.longitude`	float	Geo-location longitude
`deviceDetail.displayName`	string	Device name
`correlationId`	string	Session correlation ID
`userAgent`	string	Browser user agent

Detection Methods

Impossible Travel

Calculates Haversine great-circle distance between consecutive logins. If distance / time > 900 km/h (commercial flight speed) and distance > 100km, flags as suspicious.

Suspicious Inbox Rules

AiTM attackers commonly create rules to:

Forward emails to external address (forwardTo, redirectTo)
Delete incoming emails (moveToDeletedItems, permanentDelete)
Auto-read messages (markAsRead)
Filter on keywords: invoice, payment, wire, bank, password

Token Replay Detection

Multiple IPs and devices in a short timeframe for the same user session indicates stolen session token replay.

Inbox Rules Format

[
  {
    "displayName": "rule1",
    "mailboxOwner": "user@example.com",
    "actions": {"forwardTo": [{"emailAddress": {"address": "attacker@evil.com"}}]},
    "conditions": {"subjectContains": ["invoice", "payment"]},
    "createdDateTime": "2024-01-15T10:00:00Z"
  }
]

Haversine Formula

from math import radians, cos, sin, asin, sqrt
def haversine_km(lat1, lon1, lat2, lon2):
    lat1, lon1, lat2, lon2 = map(radians, [lat1, lon1, lat2, lon2])
    dlat, dlon = lat2 - lat1, lon2 - lon1
    a = sin(dlat/2)**2 + cos(lat1) * cos(lat2) * sin(dlon/2)**2
    return 2 * 6371 * asin(sqrt(a))

Output Schema

{
  "report": "aitm_phishing_detection",
  "total_sign_ins_analyzed": 5000,
  "total_findings": 8,
  "severity_summary": {"critical": 3, "high": 5},
  "findings": [{"type": "impossible_travel", "severity": "critical"}]
}

CLI Usage

python agent.py --logs signin_logs.json --inbox-rules rules.json --output report.json

2.7 KiB Raw Blame History