Expand TUI guidance and host detection coverage

2026-07-09 19:16:27 -07:00 · 2026-07-09 19:16:27 -07:00 · 8194d13734
commit 8194d13734
parent 3b037646d2
20 changed files with 414 additions and 42 deletions
--- a/tests/sid_drills.py
+++ b/tests/sid_drills.py
@ -303,6 +303,16 @@ DRILLS: dict[int, Callable[[], list[Alert]]] = {
        ]),
        _cfg(),
    )),
+    100049: lambda: list(memory_obfuscation.detect(
+        SystemState(processes=[
+            FakeProc(pid=355, comm="sshd",
+                     memory_maps=[
+                         MemoryMap(0xb000, 0xc000, "r-xp",
+                                   "/tmp/libinject.so"),
+                     ]),
+        ]),
+        _cfg(),
+    )),
    100050: lambda: list(posture.systemd_findings([
        posture.UnitFact("foo.service", "/etc/systemd/system/foo.service",
                         0o100664, True, ("/usr/bin/foo",)),