luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port memory-map detector tranche

Browse source
This commit is contained in:
Luna 2026-07-11 01:19:56 -07:00
parent c6f7219de8
commit 6a27e6e770
No known key found for this signature in database
13 changed files with 377 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

7
go-agent/README.md
View file

@ -7,13 +7,14 @@ behavioral oracle until every subsystem reaches fixture and red-team parity.
Current scope:
- standard-library-only flat TOML loading for the settings used so far;
- an injectable `/proc` process/file-descriptor snapshot plus fail-open `ss`
socket collection;
- an injectable `/proc` process/file-descriptor/memory-map snapshot plus
fail-open `ss` socket collection;
- a cancellable sweep loop that emits JSONL `enodia.event.v1` records;
- exact `enodia.alert.v1` parity for `ld_preload` (SID `100011`),
`deleted_exe` (`100012`), `input_snooper` (`100032`), and
`credential_access` (`100033`), plus `reverse_shell` (`100010`), `egress`
(`100016`), and `stealth_network` (`100036`);
(`100016`), `stealth_network` (`100036`), and the `/proc/<pid>/maps`
`memory_obfuscation` cohort (`100039`, `100048`, `100049`);
- `enodia.status.v1` heartbeat records with no persistence or retained-alert
claims;
- a shared fixture checked against the Python detector by