mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

1.7 KiB

Raw Blame History

API Reference — Performing Malware IOC Extraction

Libraries Used

re: Regex patterns for 16 IOC types including defanged indicators
hashlib: MD5, SHA1, SHA256 file hashing
pathlib: File reading (text and binary)

CLI Interface

python agent.py text --file threat_report.txt
python agent.py hash --file malware.exe
python agent.py strings --file malware.exe [--min-length 6]
python agent.py report --file malware.exe [--output iocs.json]

Core Functions

`extract_iocs_from_text(text)` — Extract IOCs with defanging support

Handles defanged indicators: [.] -> ., hxxp -> http. Filters private IPs.

`extract_from_file(file_path)` — Extract IOCs from text/report files

`hash_file(file_path)` — Calculate MD5/SHA1/SHA256 hashes

`extract_strings(file_path, min_length)` — Binary string extraction

Extracts ASCII and wide (UTF-16LE) strings. Identifies suspicious API calls and keywords.

`generate_ioc_report(file_path, output)` — Full analysis report

IOC Pattern Types (16)

Type	Example
ipv4	192.168.1.1 (private filtered)
domain	evil.example.com
url	https://malware.example.com/payload
md5/sha1/sha256	File hashes
cve	CVE-2024-12345
registry_key	HKLM\Software...
file_path_windows	C:\Windows\Temp\mal.exe
mutex	Global\MutexName
mitre_technique	T1059.001
bitcoin_addr	Bitcoin wallet address
user_agent	Mozilla/5.0 strings

Suspicious String Keywords

CreateRemoteThread, VirtualAlloc, WriteProcessMemory, LoadLibrary, GetProcAddress, WinExec, ShellExecute, powershell, cmd.exe

Dependencies

No external packages — Python standard library only.

1.7 KiB Raw Blame History