@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/techniques/blockchain-investigation.md

@@ -0,0 +1,247 @@
+# Blockchain Investigation Module
+
+> **Module ID:** BLKCHAIN-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Cryptocurrency & Blockchain Transaction Intelligence
+
+---
+
+## 1. Overview
+
+Blockchain and cryptocurrency investigation for OSINT. Covers transaction tracing, wallet analysis, scam address detection, exchange identification (off-ramp), cross-chain investigation, and visual flow mapping. All primary tools are free with no authentication required for basic use.
+
+**Key use cases:** Ransomware payment tracking, fraud victim recovery support, darknet market wallet attribution, identifying exchange cash-out addresses, linking on-chain activity to real-world entities.
+
+---
+
+## 2. Tool Inventory
+
+### 2.1 Blockchair — Multi-Chain Explorer
+**URL:** https://blockchair.com/
+
+Supports Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Ripple, Stellar, Monero, Dogecoin, and 10+ others. Privacy-focused explorer with SQL-like query interface.
+
+- **Usage:** Search by address, transaction hash, or block number; use advanced search for cross-chain queries
+- **Strength:** Single interface across 15+ chains; supports complex data queries
+- **Limitation:** API rate limits on free tier; Monero tracing is fundamentally limited by protocol privacy
+
+### 2.2 Etherscan — Ethereum Explorer
+**URL:** https://etherscan.io/
+
+The canonical Ethereum blockchain explorer. Shows transactions, ERC-20/ERC-721 token transfers, internal transactions, contract source code, and gas usage.
+
+- **Usage:** Paste ETH address or transaction hash → full history, token holdings, contract interactions
+- **Strength:** Labeled addresses (exchanges, protocols, known scammers); token approval tracking
+- **Limitation:** Ethereum only; requires API key for programmatic access beyond basic queries
+
+### 2.3 WalletExplorer — Bitcoin Wallet Clustering
+**URL:** https://www.walletexplorer.com/
+
+Groups Bitcoin addresses by common ownership using change address heuristics. Identifies if an address belongs to a known exchange, service, or wallet cluster.
+
+- **Usage:** Paste BTC address → see full wallet cluster, labeled entity name if known
+- **Strength:** Identifies exchange deposit addresses and mixing services by cluster label
+- **Limitation:** Heuristics can be defeated by CoinJoin and careful UTXO management
+
+### 2.4 OXT.me — Bitcoin Visual Analysis
+**URL:** https://oxt.me/
+
+Bitcoin blockchain visualization and analysis platform. Provides transaction flow graphs, wallet clustering, and path-finding between addresses.
+
+- **Usage:** Paste BTC address → interactive transaction flow graph showing funds in/out
+- **Strength:** Visual representation makes fund flow immediately readable; path-finding between two addresses
+- **Limitation:** Bitcoin only; graph rendering slow for high-volume addresses
+
+### 2.5 Chainabuse — Scam Address Database
+**URL:** https://www.chainabuse.com/
+
+Community-driven database of cryptocurrency addresses flagged for fraud, scams, ransomware, and theft. Multi-chain. Submit reports and search existing ones.
+
+- **Usage:** Search any address → see scam reports, category (phishing/ransomware/rug pull), victim count
+- **Strength:** First-stop check before deeper analysis; reveals known bad actors instantly
+- **Limitation:** Only covers reported addresses; new or unreported scam addresses return no results
+
+### 2.6 Breadcrumbs — Multi-Chain Investigation Platform
+**URL:** https://www.breadcrumbs.app/
+
+Multi-chain visual investigation tool with entity labels and transaction graph mapping. Free tier supports basic tracing.
+
+- **Usage:** Paste address → visual graph of transaction flows with labeled entities (exchanges, DeFi protocols)
+- **Strength:** Cross-chain visibility; entity labeling simplifies off-ramp identification
+- **Limitation:** Free tier limits graph depth; advanced features require paid subscription
+
+---
+
+## 3. Chain-Specific Explorers
+
+| Chain | Explorer | URL |
+|-------|---------|-----|
+| Ethereum | Etherscan | https://etherscan.io/ |
+| Bitcoin | Blockchain.com | https://www.blockchain.com/explorer |
+| Solana | Solscan | https://solscan.io/ |
+| BNB Chain | BSCScan | https://bscscan.com/ |
+| Polygon | Polygonscan | https://polygonscan.com/ |
+| Avalanche | Snowtrace | https://snowtrace.io/ |
+| Tron | Tronscan | https://tronscan.org/ |
+| Multi-chain | Blockchair | https://blockchair.com/ |
+| Multi-chain EVM | Breadcrumbs | https://www.breadcrumbs.app/ |
+
+---
+
+## 4. Investigation Workflow
+
+```
+Step 1: Identify blockchain from address format
+  └─ BTC: starts with 1 (P2PKH), 3 (P2SH), or bc1 (Bech32/Taproot)
+  └─ ETH/EVM: starts with 0x, 42 hex characters total
+  └─ SOL: base58 encoded, 32–44 characters
+  └─ XRP: starts with r, ~34 alphanumeric characters
+  └─ If unsure: paste into Blockchair — it auto-detects chain
+
+Step 2: Scam database check (Chainabuse)
+  └─ Search address before spending time on deeper analysis
+  └─ If flagged → document report count, category, and first report date
+  └─ Note: absence of report does NOT clear the address
+
+Step 3: Transaction history exploration (Blockchair or chain-specific explorer)
+  └─ Record: first transaction date, total received, total sent, current balance
+  └─ Identify funding sources (first inbound transactions)
+  └─ Identify destinations (outbound transactions, especially large ones)
+  └─ Flag exchange deposit addresses — these represent fiat off-ramps
+
+Step 4: Wallet clustering (WalletExplorer for BTC; Etherscan labels for ETH)
+  └─ Find related addresses controlled by same entity
+  └─ Note any labeled clusters (Binance, Coinbase, known mixers)
+  └─ Calculate total funds across full cluster, not just target address
+
+Step 5: Visual flow mapping (OXT.me for BTC; Breadcrumbs for multi-chain)
+  └─ Generate transaction flow graph
+  └─ Identify patterns: peel chains, consolidation, mixing service usage
+  └─ Use path-finding between suspect address and known exchange address
+
+Step 6: Cross-reference with external OSINT
+  └─ Google the address in quotes — check forum posts, Pastebin, GitHub issues
+  └─ Search address in ransomware payment trackers (ransomwhe.re)
+  └─ Check if address appears in darknet market references
+  └─ Link to domain/email if found in phishing kit source or scam page HTML
+```
+
+---
+
+## 5. CLI Commands & Expected Output
+
+```bash
+# Blockchair API — Bitcoin address summary (free, no key required)
+curl -s "https://api.blockchair.com/bitcoin/dashboards/address/<BTC_ADDRESS>" \
+  | jq '.data["<BTC_ADDRESS>"].address | {balance, received: .received, spent: .spent, transaction_count}'
+
+# Expected output:
+# {
+#   "balance": 150000,
+#   "received": 5000000,
+#   "spent": 4850000,
+#   "transaction_count": 47
+# }
+# Note: values in satoshis (divide by 100000000 for BTC)
+
+# Blockchain.com API — BTC address details (free, no key)
+curl -s "https://blockchain.info/rawaddr/<BTC_ADDRESS>?limit=5" \
+  | jq '{balance: .final_balance, n_tx: .n_tx, total_received: .total_received}'
+
+# Expected output:
+# {
+#   "balance": 150000,
+#   "n_tx": 47,
+#   "total_received": 5000000
+# }
+
+# Blockchair — Ethereum address summary
+curl -s "https://api.blockchair.com/ethereum/dashboards/address/<ETH_ADDRESS>" \
+  | jq '.data["<ETH_ADDRESS>"].address | {balance, transaction_count}'
+
+# Blockchair — multi-chain address search (auto-detects chain)
+curl -s "https://api.blockchair.com/search?q=<ADDRESS>" | jq '.data'
+
+# Ransomware address lookup (ransomwhe.re — free, no key)
+curl -s "https://api.ransomwhe.re/export" \
+  | jq --arg addr "<BTC_ADDRESS>" '.result[] | select(.address == $addr)'
+
+# Expected output if found:
+# {
+#   "address": "1BoatSLRHtKNngkdXEeobR76b53LETtpyT",
+#   "family": "LockBit",
+#   "reportedAt": "2023-11-20T14:33:00Z"
+# }
+```
+
+---
+
+## 6. Analysis & Interpretation Guidance
+
+### Address Format Quick Reference
+
+| Format | Chain | Example Prefix | Length |
+|--------|-------|---------------|--------|
+| P2PKH | Bitcoin | `1` | 26–34 chars |
+| P2SH | Bitcoin | `3` | 34 chars |
+| Bech32 | Bitcoin SegWit | `bc1q` | 42 chars |
+| Taproot | Bitcoin | `bc1p` | 62 chars |
+| EVM | Ethereum/BSC/Polygon | `0x` | 42 chars |
+| Base58 | Solana | varies | 32–44 chars |
+| Base58 | Ripple XRP | `r` | ~34 chars |
+
+### Transaction Pattern Recognition
+
+| Pattern | Description | Significance |
+|---------|-------------|-------------|
+| Peel chain | Long chain of single-output transactions, each peeling off a small amount | Layering; funds moving through intermediary wallets |
+| Fan-out | One address sending to many addresses simultaneously | Distribution to victims (airdrop scam) or layering |
+| Consolidation | Many addresses sending to one | Aggregating funds before exchange deposit |
+| Round numbers | Transactions in exactly 1.0 BTC, 10 ETH, etc. | Often OTC trades or structured payments |
+| Mixer usage | Funds enter/exit CoinJoin or Tornado Cash | Deliberate obfuscation; note entry and exit addresses |
+| Exchange deposit | Outbound tx to known exchange cluster | Off-ramp attempt; document exchange name and deposit address |
+
+### Exchange Identification
+
+Deposits to centralized exchanges (Binance, Coinbase, Kraken, etc.) represent the most actionable off-ramp intelligence. Identified exchange addresses can support legal requests for KYC data.
+
+- WalletExplorer and Breadcrumbs label known exchange deposit addresses
+- Exchange addresses typically receive from many senders (aggregation pattern)
+- Confirm via Etherscan "Name Tag" on ETH addresses
+
+### Mixer & Privacy Tool Detection
+
+| Tool | Chain | Detection |
+|------|-------|-----------|
+| CoinJoin | BTC | Many equal-value inputs and outputs in one tx |
+| Wasabi Wallet | BTC | Characteristic CoinJoin structure with 0.1 BTC outputs |
+| Tornado Cash | ETH | Transactions to/from known Tornado Cash contract addresses |
+| Monero | XMR | All transactions are private by protocol; tracing not feasible |
+| Zcash shielded | ZEC | Transactions to/from shielded pool (z-addresses) |
+
+---
+
+## 7. Confidence Ratings
+
+| Finding | Confidence | Notes |
+|---------|-----------|-------|
+| Address balance and transaction count | HIGH | On-chain, immutable data |
+| Exchange deposit address label | HIGH | Confirmed by cluster analysis |
+| Chainabuse scam report | MEDIUM-HIGH | Community-sourced; verify report quality |
+| Wallet cluster attribution | MEDIUM | Heuristics can fail with CoinJoin/careful UTXO use |
+| Ransomwhe.re family attribution | MEDIUM-HIGH | Researcher-verified submissions |
+| AI geolocation of entity from chain data | LOW | Indirect inference only |
+
+---
+
+## 8. Related Techniques
+
+- [scam-check.md](scam-check.md) — Broader fraud and scam investigation workflow
+- [threat-intel.md](threat-intel.md) — Correlate wallet addresses with threat actor profiles
+- [web-dns-forensics.md](web-dns-forensics.md) — Link blockchain addresses found in web/DNS artifacts
+
+---
+
+*Blockchain Investigation Module v1.0.0*
+*Part of CTI Expert Skill - Phase 5 Enhancement Modules*

package/skills/cti-expert/techniques/cloud-audit.md

@@ -0,0 +1,175 @@
+# Cloud Infrastructure Audit Module
+
+> **Module ID:** CLD-AUD-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Cloud Security Misconfiguration & Exposure Assessment
+
+---
+
+## 1. Overview
+
+Audits cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, public exposure, and compliance gaps. Use during organizational exposure assessments, pre-engagement recon, or when cloud assets surface during OSINT investigation.
+
+**When to use:** Target org uses cloud services, subdomain enumeration reveals cloud-hosted assets, job postings mention cloud stack, or client requests infrastructure security review.
+
+**Ethical boundary:** Only audit accounts or projects the user has authorized access to. Flag active compromise evidence immediately.
+
+---
+
+## 2. Tool Inventory
+
+| Priority | Tool | Coverage | Install |
+|----------|------|----------|---------|
+| Primary | `aws` CLI | AWS IAM, S3, EC2, VPC, CloudTrail | Pre-installed or `pip3 install awscli` |
+| Primary | `gcloud` CLI | GCP IAM, GCS, Compute, Audit Logs | `curl https://sdk.cloud.google.com \| bash` |
+| Primary | `az` CLI | Azure AD, Blob, VM, Activity Log | `curl -sL https://aka.ms/InstallAzureCLIDeb \| bash` |
+| Secondary | ScoutSuite | Multi-cloud automated audit | `pip3 install scoutsuite` |
+| Secondary | Trivy | Container/IaC vulnerability scan | `apt install -y trivy` |
+| Manual | IaC Review | Terraform/CloudFormation/Pulumi grep | No install — file review |
+
+---
+
+## 3. Investigation Workflow
+
+```
+1. Scope — identify provider(s), account(s), regions, CLI vs IaC review
+2. IAM audit — root MFA, credential age, wildcard permissions, overprivileged roles
+3. Network audit — security groups, open SSH/RDP, VPC flow logs, public subnets
+4. Storage audit — public buckets, encryption, versioning, lifecycle policies
+5. Compute audit — IMDSv2, disk encryption, public IPs, patch age, container security
+6. Logging audit — CloudTrail/Audit Logs enabled, encrypted, GuardDuty/Defender active
+7. Secrets audit — hardcoded creds in source/env/IaC, KMS rotation, Secrets Manager usage
+8. Correlate findings by severity and blast radius
+9. Generate prioritized remediation plan
+```
+
+---
+
+## 4. CLI Commands & Expected Output
+
+### IAM — AWS
+
+```bash
+# Account summary
+aws iam get-account-summary
+
+# List all users
+aws iam list-users
+
+# Credential report (age, MFA, last used)
+aws iam generate-credential-report && \
+aws iam get-credential-report --output text --query Content | base64 -d
+```
+
+**Check for:** Root account without MFA, access keys >90 days, unused credentials, `"Action": "*"` wildcard permissions, overprivileged roles.
+
+### IAM — GCP
+
+```bash
+gcloud projects get-iam-policy $PROJECT_ID
+gcloud iam service-accounts list
+```
+
+**Check for:** Primitive roles (Owner/Editor) on too many principals, unused service accounts, service account keys instead of workload identity.
+
+### IAM — Azure
+
+```bash
+az role assignment list --all
+az ad user list
+```
+
+**Check for:** Excessive Owner/Contributor assignments, guest users with high privileges.
+
+### Network Security
+
+**Check for across all providers:**
+- Security groups / firewall rules allowing `0.0.0.0/0` ingress
+- Unrestricted SSH (port 22) or RDP (port 3389) from internet
+- VPC flow logs disabled
+- Databases in public subnets
+- Missing network segmentation between tiers
+
+### Storage — AWS S3
+
+```bash
+aws s3api list-buckets
+aws s3api get-public-access-block --bucket <name>
+aws s3api get-bucket-policy --bucket <name>
+aws s3api get-bucket-encryption --bucket <name>
+```
+
+**Check for:** Public buckets, missing encryption, no versioning, overly permissive bucket policies. GCP/Azure equivalents: `allUsers`/`allAuthenticatedUsers` access, anonymous blob access.
+
+### Compute
+
+- IMDSv2 enforced? (AWS: `HttpTokens = required`)
+- Unencrypted EBS volumes or disks
+- Public IP addresses on instances that don't need them
+- Outdated AMIs/images (check patch age)
+- Privileged containers, missing security contexts in Kubernetes
+
+### Logging & Monitoring
+
+- CloudTrail / Cloud Audit Logs / Activity Log enabled in all regions
+- Log storage: encrypted, immutable, adequate retention
+- GuardDuty / Security Command Center / Defender for Cloud enabled
+- Alerting for: root login, IAM changes, security group changes, large data transfers
+- VPC Flow Logs and DNS query logs enabled
+
+### Secrets Management
+
+- Hardcoded secrets in source code, environment variables, or IaC files
+- Secrets Manager / Key Vault usage for sensitive values
+- KMS key rotation configured
+
+### IaC Review
+
+```bash
+# Grep Terraform/CloudFormation for dangerous patterns
+grep -rn '"Action": "\*"' *.tf *.json
+grep -rn '"Resource": "\*"' *.tf *.json
+grep -rn 'password\|secret\|api_key' *.tf *.yaml *.json
+```
+
+---
+
+## 5. Output Format
+
+```markdown
+# Cloud Security Audit Report
+## Account(s): [account ID(s)]
+## Provider: [AWS/GCP/Azure]
+## Regions: [audited regions]
+## Date: [date]
+
+### Summary
+- Total findings: X
+- Critical: X | High: X | Medium: X | Low: X
+
+### Findings
+
+#### [SEVERITY] [Category]: [Title]
+**Resource:** [resource ARN/ID]
+**Region:** [region]
+**Issue:** [what the misconfiguration is]
+**Risk:** [what an attacker could do]
+**Evidence:** [CLI output or IaC snippet]
+**Remediation:** [specific fix command or IaC change]
+
+### Prioritized Action Plan
+1. [Critical — immediate]
+2. [High — this week]
+3. [Medium — this month]
+4. [Low — next quarter]
+```
+
+---
+
+## 6. References
+
+- CIS Benchmarks for AWS/GCP/Azure
+- AWS Well-Architected Security Pillar
+- ScoutSuite multi-cloud auditing tool
+- NIST SP 800-53 Security Controls