iron-edge 1.0.0

package/squads/squad-cybersecurity/knowledge-base/threat-intelligence-reference.md

@@ -0,0 +1,176 @@
+# Threat Intelligence Reference
+
+## Purpose
+
+Reference guide for threat intelligence concepts, adversary categorization, common attack patterns, and defensive priorities. Used across all Cyber Defense Squad agents for consistent threat understanding.
+
+---
+
+## Threat Actor Categories
+
+### Nation-State / APT (Advanced Persistent Threat)
+- **Motivation:** Espionage, intellectual property theft, geopolitical advantage, sabotage
+- **Resources:** State-funded, highly skilled, custom tooling, zero-day capabilities
+- **Persistence:** Months to years of dwell time
+- **Examples:** APT28 (Fancy Bear), APT29 (Cozy Bear), APT41, Lazarus Group
+- **Defense priority:** Detection of lateral movement, data exfiltration monitoring, supply chain integrity
+
+### Cybercrime / Financially Motivated
+- **Motivation:** Financial gain — ransomware, fraud, theft, extortion
+- **Resources:** Moderate to high, growing sophistication, RaaS (Ransomware as a Service)
+- **Persistence:** Days to weeks, opportunistic targeting
+- **Examples:** REvil, Conti, LockBit, FIN7, Scattered Spider
+- **Defense priority:** Email security, endpoint protection, backup integrity, access control
+
+### Hacktivists
+- **Motivation:** Political or social agenda, disruption, public embarrassment
+- **Resources:** Low to moderate, often use known tools and techniques
+- **Persistence:** Short campaigns, high visibility
+- **Examples:** Anonymous, various issue-specific groups
+- **Defense priority:** DDoS protection, web application security, data leak prevention
+
+### Insider Threats
+- **Motivation:** Financial gain, revenge, ideology, negligence
+- **Resources:** Existing access to systems and data
+- **Persistence:** Varies — may be one-time or sustained
+- **Types:** Malicious insider, negligent insider, compromised insider
+- **Defense priority:** DLP, behavioral analytics, access monitoring, least privilege
+
+---
+
+## Common Attack Patterns (by Kill Chain Stage)
+
+### Initial Access (TA0001)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| Phishing with attachment | T1566.001 | Very High | Email security, user training |
+| Phishing with link | T1566.002 | Very High | URL filtering, user training |
+| Exploit public-facing app | T1190 | High | Patching, WAF, pentest |
+| Valid accounts | T1078 | High | MFA, credential monitoring |
+| Supply chain compromise | T1195 | Medium | Vendor assessment, SCA |
+| Drive-by compromise | T1189 | Medium | Browser isolation, patching |
+
+### Execution (TA0002)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| PowerShell | T1059.001 | Very High | Script block logging, AMSI, constrained mode |
+| Command shell | T1059.003 | High | Process monitoring, EDR |
+| User execution | T1204 | High | User training, application control |
+| Scheduled task/job | T1053 | High | Scheduled task monitoring |
+
+### Persistence (TA0003)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| Scheduled task/job | T1053 | Very High | Scheduled task monitoring |
+| Registry run keys | T1547.001 | High | Registry monitoring |
+| Web shell | T1505.003 | High | File integrity monitoring, web server hardening |
+| Account creation | T1136 | Medium | Account creation alerting |
+
+### Privilege Escalation (TA0004)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| Exploitation for privilege escalation | T1068 | High | Patching, least privilege |
+| Access token manipulation | T1134 | High | Token monitoring, EDR |
+| Abuse elevation control mechanism | T1548 | Medium | UAC enforcement, sudoers review |
+
+### Lateral Movement (TA0008)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| Remote services (RDP, SSH, SMB) | T1021 | Very High | Network segmentation, MFA |
+| Pass-the-Hash | T1550.002 | High | Credential Guard, LAPS |
+| Remote desktop protocol | T1021.001 | High | NLA, MFA, network segmentation |
+| SMB/Windows admin shares | T1021.002 | High | Disable admin shares, segmentation |
+
+### Exfiltration (TA0010)
+| Technique | ATT&CK ID | Prevalence | Primary Defense |
+|-----------|-----------|------------|----------------|
+| Exfiltration over C2 channel | T1041 | Very High | Network monitoring, DLP |
+| Exfiltration over web service | T1567 | High | Cloud access security, DLP |
+| Exfiltration over DNS | T1048.003 | Medium | DNS monitoring, DNS security |
+
+---
+
+## Top Vulnerability Categories (Recurring)
+
+### Web Applications
+1. **Broken Access Control** — IDOR, privilege escalation, forced browsing
+2. **Injection** — SQLi, XSS, command injection, SSTI
+3. **Authentication weaknesses** — Weak passwords, missing MFA, session issues
+4. **Security misconfiguration** — Default creds, verbose errors, missing headers
+5. **Cryptographic failures** — Weak TLS, plaintext storage, poor key management
+
+### Cloud Infrastructure
+1. **Overprivileged IAM** — Wildcard permissions, unused admin roles
+2. **Public storage** — S3 buckets, Azure blobs, GCS buckets with public access
+3. **Missing encryption** — Data at rest without encryption, weak TLS
+4. **Missing logging** — CloudTrail disabled, no flow logs
+5. **Insecure defaults** — Default VPC, IMDSv1, permissive security groups
+
+### Network
+1. **Flat networks** — No segmentation, lateral movement trivial
+2. **Overpermissive firewalls** — any/any rules, unused rules
+3. **Missing monitoring** — No IDS/IPS, no network flow analysis
+4. **Legacy protocols** — SSLv3, TLS 1.0, telnet, FTP, SNMPv1
+5. **Exposed management interfaces** — SSH/RDP to internet, unprotected admin panels
+
+---
+
+## Indicator of Compromise (IOC) Types
+
+| IOC Type | Examples | Enrichment Sources | TTL (Time to Live) |
+|----------|---------|-------------------|-------------------|
+| IP Address | Malicious C2, scanner IPs | VirusTotal, AbuseIPDB, Shodan | Days to weeks |
+| Domain | Phishing domains, C2 domains | WHOIS, PassiveDNS, URLhaus | Days to months |
+| URL | Malware download, phishing pages | URLhaus, PhishTank | Hours to days |
+| File Hash (SHA256) | Malware samples, tools | VirusTotal, MalwareBazaar | Months to years |
+| Email Address | Phishing sender, C2 contact | HIBP, reputation services | Weeks to months |
+| JA3/JA3S | TLS fingerprints for C2 | ja3er.com, threat intel feeds | Months |
+| User Agent | Malware communication patterns | Custom analysis | Weeks to months |
+
+### IOC Confidence Levels
+
+| Level | Definition | Action |
+|-------|-----------|--------|
+| **Confirmed** | Directly observed in verified malicious activity | Block immediately, hunt in environment |
+| **Probable** | Strong circumstantial evidence, multiple sources agree | Block at perimeter, alert on internal |
+| **Possible** | Limited evidence, single source | Monitor only, do not block (false positive risk) |
+| **Unknown** | Insufficient data to assess | Collect more data before acting |
+
+---
+
+## Defense Prioritization Framework
+
+### Quick Wins (Highest ROI)
+1. **MFA everywhere** — Blocks credential-based attacks
+2. **Patch critical vulns within 48h** — Reduces exploitation window
+3. **Email security** — Gateway filtering, DMARC, user training
+4. **Endpoint protection** — EDR on all endpoints
+5. **Backup integrity** — 3-2-1 rule, tested restoration
+
+### Foundation (Must-Have)
+1. **Asset inventory** — Cannot protect what you do not know
+2. **Network segmentation** — Limits blast radius
+3. **Log collection** — Cannot detect what you do not see
+4. **Access control** — Least privilege, regular reviews
+5. **Vulnerability management** — Regular scanning and remediation
+
+### Advanced (Maturity Indicators)
+1. **Threat hunting** — Proactive search beyond detections
+2. **Detection engineering** — Custom rules mapped to ATT&CK
+3. **Zero trust architecture** — Identity-centric access
+4. **Red team exercises** — Realistic adversary emulation
+5. **Automated response** — SOAR for common incident types
+
+---
+
+## Ethical Guidelines — MANDATORY
+
+All threat intelligence work within the Cyber Defense Squad operates under these non-negotiable principles:
+
+1. **Intelligence serves defense** — All analysis is conducted to improve defensive posture, never to enable attacks
+2. **No unauthorized collection** — Intelligence gathering respects legal boundaries and privacy
+3. **Responsible disclosure** — New vulnerabilities discovered are reported through proper channels
+4. **TLP compliance** — Information sharing respects Traffic Light Protocol classifications
+5. **No offensive action** — Threat intelligence informs defense; it does not authorize retaliation
+6. **Attribution caution** — Attribution is difficult; report confidence levels, avoid speculation
+7. **Privacy respect** — Personal data encountered during analysis is handled per applicable data protection laws

package/squads/squad-cybersecurity/knowledge-base/vulnerability-management.md

@@ -0,0 +1,349 @@
+# Vulnerability Management Reference
+
+## Purpose
+
+Reference for the full vulnerability management lifecycle — CVE process, scanning tools, patch management SLAs, and remediation prioritization. Used by Breach (penetration-tester), Sentinel (soc-analyst), and Govern (compliance-officer).
+
+---
+
+## Vulnerability Management Lifecycle
+
+```
+Discovery → Assessment → Prioritization → Remediation → Verification → Reporting
+    ↑                                                                       |
+    └───────────────────── Continuous cycle ───────────────────────────────┘
+```
+
+---
+
+## CVE Process
+
+### The CVE System
+
+**CVE (Common Vulnerabilities and Exposures):** A standardized identifier system for known security vulnerabilities. Managed by MITRE Corporation with support from CISA.
+
+**CVE ID format:** CVE-[YEAR]-[NUMBER] (e.g., CVE-2021-44228 = Log4Shell)
+
+**NVD (National Vulnerability Database):** NIST-maintained database that enriches CVEs with CVSS scores, affected products (CPE), and remediation guidance. Every CVE gets scored in NVD.
+
+**CVSS (Common Vulnerability Scoring System) v3.1:**
+| Score | Severity | Remediation SLA (Production) |
+|-------|---------|------------------------------|
+| 9.0–10.0 | Critical | 24–48 hours |
+| 7.0–8.9 | High | 7 days |
+| 4.0–6.9 | Medium | 30 days |
+| 0.1–3.9 | Low | 90 days |
+| 0.0 | None | Best effort |
+
+**EPSS (Exploit Prediction Scoring System):** Complements CVSS — predicts the probability a vulnerability will be exploited in the wild within the next 30 days. A CVSS 7.0 vulnerability with EPSS > 50% should be treated as critical-urgency. Check at: https://api.first.org/data/v1/epss
+
+---
+
+## Vulnerability Scanning
+
+### Scanning Architecture
+
+```
+Continuous scanning (daily/weekly):
+  SCA (dependencies) → SAST (code) → DAST (running app) → Infrastructure
+
+Point-in-time (pre-deploy, quarterly):
+  Penetration test → Configuration audit → Red team exercise
+```
+
+### Dependency Scanning (SCA)
+
+```bash
+# npm audit (built-in)
+npm audit
+npm audit --audit-level=high  # Exit non-zero only for high+
+npm audit fix  # Auto-fix non-breaking changes
+
+# Snyk (richer data, fixability scoring)
+npx snyk test
+npx snyk monitor  # Track over time
+
+# OWASP Dependency-Check (Java/.NET, also supports npm)
+dependency-check --project "MyProject" --scan ./
+
+# Trivy (containers + filesystems)
+trivy fs --severity HIGH,CRITICAL .
+trivy image --severity HIGH,CRITICAL myapp:latest
+```
+
+### Static Analysis (SAST)
+
+```bash
+# Semgrep -- fast, rules-based
+semgrep --config=auto .
+semgrep --config=p/security-audit .
+semgrep --config=p/owasp-top-ten .
+
+# Custom rules example
+# .semgrep/rules/no-hardcoded-secrets.yaml
+rules:
+  - id: no-hardcoded-api-key
+    patterns:
+      - pattern: $KEY = "sk_live_..."
+      - pattern: $KEY = "AKIA..."
+    message: Potential hardcoded API key detected
+    severity: ERROR
+    languages: [javascript, typescript]
+
+# CodeQL (GitHub Advanced Security)
+# Enable in GitHub repository settings -- free for public repos
+# Runs automatically on PRs
+
+# SonarQube/SonarCloud
+sonar-scanner \
+  -Dsonar.projectKey=my-project \
+  -Dsonar.sources=./src \
+  -Dsonar.host.url=https://sonarcloud.io \
+  -Dsonar.login=$SONAR_TOKEN
+```
+
+### Dynamic Scanning (DAST)
+
+```bash
+# OWASP ZAP -- automated scan
+# Full scan (comprehensive, use in QA/staging)
+docker run -t owasp/zap2docker-stable zap-full-scan.py \
+  -t https://staging.myapp.com \
+  -r zap-report.html
+
+# Baseline scan (passive, safe for production checks)
+docker run -t owasp/zap2docker-stable zap-baseline.py \
+  -t https://myapp.com
+
+# Nuclei -- template-based
+nuclei -u https://staging.myapp.com \
+  -t /opt/nuclei-templates/ \
+  -severity critical,high,medium \
+  -o nuclei-results.json
+```
+
+### Infrastructure Scanning
+
+```bash
+# Nmap -- port and service discovery
+nmap -sV -sC --open -T4 -p 1-65535 target.example.com
+
+# SSL/TLS configuration
+sslyze --regular target.example.com:443
+testssl.sh target.example.com
+
+# Shodan (check what's exposed on the internet)
+shodan host <your-ip>  # Requires Shodan API key
+
+# Check for exposed services using Shodan
+shodan search "org:MyCompany" --fields "ip_str,port,product"
+```
+
+---
+
+## Prioritization Framework
+
+### Risk-Based Prioritization
+
+Not all vulnerabilities are equal. Prioritize based on:
+
+```
+Priority Score = Severity × Exploitability × Business Impact × Exposure
+
+High Priority:
+- CVSS 9.0+ AND EPSS > 20%
+- Any CVE with known public exploit
+- Vulnerability in public-facing system
+- Vulnerability enabling RCE or data exfiltration
+
+Medium Priority:
+- CVSS 7.0–8.9, no public exploit
+- CVSS 9.0+ in internal system only
+- Information disclosure vulnerabilities
+
+Lower Priority:
+- CVSS < 7.0
+- Requires physical access
+- Requires authenticated access in already-trusted context
+```
+
+### Remediation SLA Matrix
+
+| Severity | EPSS > 50% | EPSS < 50% | In Active Exploitation |
+|----------|-----------|-----------|----------------------|
+| Critical | 24 hours | 48 hours | IMMEDIATE — escalate now |
+| High | 48 hours | 7 days | 24 hours |
+| Medium | 7 days | 30 days | 7 days |
+| Low | 30 days | 90 days | 30 days |
+
+### CISA Known Exploited Vulnerabilities (KEV) Catalog
+
+CISA maintains a catalog of vulnerabilities known to be actively exploited. If a CVE appears on this list, treat it as critical regardless of CVSS score.
+
+Check: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+
+```bash
+# Check if your CVEs are in KEV catalog
+curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
+  jq '.vulnerabilities[] | select(.cveID == "CVE-2021-44228")'
+```
+
+---
+
+## Patch Management
+
+### Patching Process
+
+```
+1. Vulnerability Identified
+   ↓
+2. Asset impact analysis (which systems are affected?)
+   ↓
+3. Risk assessment (CVSS + EPSS + exposure)
+   ↓
+4. Patch availability check (vendor advisory, fix available?)
+   ↓
+5. Testing (test patch in non-production environment)
+   ↓
+6. Approval (change management process)
+   ↓
+7. Deployment (rolling update or maintenance window)
+   ↓
+8. Verification (rescan to confirm vulnerability closed)
+   ↓
+9. Documentation (update vulnerability records)
+```
+
+### Zero-Day Management (No Patch Available)
+
+When a patch is not yet available, implement mitigations:
+
+**Temporary mitigations:**
+- WAF rules to block known exploit patterns
+- Network segmentation to limit blast radius
+- Disable vulnerable feature if not required
+- Enhanced monitoring for exploitation indicators
+- Rate limiting on affected endpoints
+
+**Log4Shell example (December 2021):**
+```
+Day 0 (no patch):
+1. Deployed WAF rules blocking JNDI lookup strings in request headers/body
+2. Disabled JNDI lookups via JVM flag: -Dlog4j2.formatMsgNoLookups=true
+3. Enhanced monitoring for outbound LDAP/DNS to unknown hosts
+4. Isolated affected systems from sensitive data stores
+
+Day 3 (patch available):
+5. Updated to Log4j 2.16.0
+6. Verified across all applications via SBOM scan
+7. Removed temporary WAF rules
+```
+
+---
+
+## Continuous Scanning Pipeline
+
+### GitHub Actions Security Pipeline
+
+```yaml
+name: Security Scanning
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+  schedule:
+    - cron: '0 2 * * 1'  # Weekly Monday 2 AM
+
+jobs:
+  dependency-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: npm audit
+        run: npm audit --audit-level=high
+      
+      - name: Snyk SCA
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --severity-threshold=high
+
+  sast-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Semgrep SAST
+        uses: returntocorp/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/owasp-top-ten
+
+  container-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build image
+        run: docker build -t myapp:${{ github.sha }} .
+      
+      - name: Trivy container scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: myapp:${{ github.sha }}
+          format: sarif
+          exit-code: 1
+          severity: HIGH,CRITICAL
+          output: trivy-results.sarif
+      
+      - name: Upload to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+```
+
+---
+
+## Vulnerability Metrics and Reporting
+
+### Key Metrics to Track
+
+| Metric | Definition | Target |
+|--------|-----------|--------|
+| MTTD | Mean Time to Detect (from introduction to discovery) | < 24 hours for critical |
+| MTTR | Mean Time to Remediate (from discovery to fix) | Per SLA above |
+| Vulnerability backlog | Open vulns by severity | Critical: 0, High: < 5 |
+| Patch compliance rate | % of systems patched within SLA | > 95% |
+| Vulnerability density | Vulns per 1000 lines of code | Trend down over time |
+
+### Vulnerability Tracking
+
+Every vulnerability should be tracked in your issue tracking system with:
+
+```
+Title: [CVE-ID] Vulnerability description in component X
+Severity: [Critical/High/Medium/Low]
+CVSS Score: X.X
+EPSS Score: XX%
+Affected systems: [list]
+Discovered: [date]
+Due date: [per SLA]
+Owner: [person responsible]
+Status: [Open/In Progress/Remediated/Accepted Risk]
+Mitigation: [if patch not yet available]
+Verification: [rescan result confirming fix]
+```
+
+---
+
+## Sources
+
+- NVD (NIST): https://nvd.nist.gov/
+- FIRST CVSS Calculator: https://www.first.org/cvss/calculator/3.1
+- EPSS API: https://api.first.org/data/v1/epss
+- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+- OWASP Dependency-Check: https://owasp.org/www-project-dependency-check/
+- Trivy: https://aquasecurity.github.io/trivy/
+- Semgrep: https://semgrep.dev/docs/