luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand TUI guidance and host detection coverage

Browse source
This commit is contained in:
Luna 2026-07-09 19:16:27 -07:00
parent 3b037646d2
commit 8194d13734
20 changed files with 414 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

3
enodia_sentinel/triage.py
View file

@ -84,6 +84,9 @@ def triage_alert(alert: dict, processes: list[dict], cfg: Config,
return Verdict(LIKELY_FP, f"preload library is package-owned: {lib}")
return Verdict(REVIEW, "library injection — verify the .so by hand")
if sig == "process_injection_library":
return Verdict(REVIEW, "executable library mapped from writable path")
if sig == "deleted_exe":
if "memfd:" in detail:
return Verdict(REVIEW, "memfd-backed (fileless) execution")