Expand TUI guidance and host detection coverage

enodia_sentinel/detectors/memory_obfuscation.py

@@ -1,10 +1,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-"""memory_obfuscation — memory-map indicators of hiding or encrypted payloads.
+"""memory_obfuscation — memory-map indicators of hiding or injected payloads.
 
 Encrypted/packed implants still need executable memory after decrypting code.
 This detector does not read process memory; it only inspects ``/proc/<pid>/maps``
 for high-signal shapes: executable anonymous mappings, executable memfd/deleted
-mappings, RWX pages, and mapped libraries associated with process hiding.
+mappings, RWX pages, and mapped libraries associated with process hiding or
+process injection.
 """
 from __future__ import annotations
 
@@ -16,10 +17,13 @@ from ..system import MemoryMap, SystemState
 
 SID_MEMORY_OBFUSCATION = 100039
 SID_PROCESS_HIDING_LIBRARY = 100048
+SID_PROCESS_INJECTION_LIBRARY = 100049
 
 _HIDE_LIBRARY_HINTS = frozenset({
     "libhide", "libprocesshide", "process_hide", "proc_hide", "rootkit_hide",
 })
+_WRITABLE_MAP_PREFIXES = ("/tmp/", "/dev/shm/", "/var/tmp/", "/run/user/")
+_LIB_EXTENSIONS = (".so", ".so.", ".dylib")
 
 
 def _maps(proc) -> list[MemoryMap]:
@@ -40,6 +44,14 @@ def _hide_library(path: str) -> bool:
     return any(hint in name for hint in _HIDE_LIBRARY_HINTS)
 
 
+def _writable_library(path: str) -> bool:
+    lower = path.lower()
+    if not lower.startswith(_WRITABLE_MAP_PREFIXES):
+        return False
+    name = lower.rsplit("/", 1)[-1]
+    return any(ext in name for ext in _LIB_EXTENSIONS)
+
+
 def _allowed_path(path: str, cfg: Config) -> bool:
     for prefix in cfg.memory_obfuscation_allow_paths:
         if prefix and path.startswith(prefix):
@@ -57,6 +69,10 @@ def _indicator(mm: MemoryMap, cfg: Config) -> tuple[str, Severity, str]:
         )
     executable = "x" in mm.perms
     writable = "w" in mm.perms
+    if executable and path and _writable_library(path):
+        return "process_injection_library", Severity.HIGH, (
+            f"executable library mapped from writable/runtime path: {path}"
+        )
     if executable and ("memfd:" in path or "(deleted)" in path):
         return "memory_obfuscation", Severity.CRITICAL, (
             f"executable transient mapping perms={mm.perms} path={path or '<anonymous>'}"
@@ -83,8 +99,10 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
             if signature == "memory_obfuscation" and comm in cfg.memory_obfuscation_allow_comms:
                 continue
             seen.add(signature)
-            sid = (SID_PROCESS_HIDING_LIBRARY if signature == "process_hiding_library"
-                   else SID_MEMORY_OBFUSCATION)
+            sid = {
+                "process_hiding_library": SID_PROCESS_HIDING_LIBRARY,
+                "process_injection_library": SID_PROCESS_INJECTION_LIBRARY,
+            }.get(signature, SID_MEMORY_OBFUSCATION)
             yield Alert(
                 severity=severity,
                 signature=signature,
@@ -95,6 +113,8 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 ),
                 pids=(proc.pid,),
                 sid=sid,
-                classtype=("process-hiding" if signature == "process_hiding_library"
-                           else "memory-obfuscation"),
+                classtype={
+                    "process_hiding_library": "process-hiding",
+                    "process_injection_library": "process-injection",
+                }.get(signature, "memory-obfuscation"),
             )