Expand TUI guidance and host detection coverage

docs/RULES.md

@@ -223,3 +223,22 @@ Expected false positives:
 - Developer tooling using interpreters for custom APIs on high ports.
 
 Drill or fixture: Use `rules test` with a `tcp_connect` event whose `comm` is an interpreter and whose public `peer_port` is not a common service port.
+
+## SID 100068: Interpreter opened a listener on an unusual local port
+
+- Event: `listen`
+- Signature: `host_rule.suspicious-listener`
+- Classtype: `suspicious-listener`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `listen`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
+
+Expected false positives:
+- Developer HTTP servers, netcat listeners, or local test harnesses intentionally opened from an interpreter.
+- Administrative troubleshooting that temporarily listens on a high port.
+
+Drill or fixture: Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.