luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand TUI guidance and host detection coverage

Browse source
This commit is contained in:
Luna 2026-07-09 19:16:27 -07:00
parent 3b037646d2
commit 8194d13734
20 changed files with 414 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tests/test_detectors.py
View file

@ -197,6 +197,30 @@ class TestMemoryObfuscation(unittest.TestCase):
self.assertEqual(alerts[0].signature, "process_hiding_library")
self.assertEqual(alerts[0].severity, Severity.CRITICAL)
def test_process_injection_library_alerts(self):
proc = FakeProc(
pid=355, comm="sshd",
memory_maps=[MemoryMap(0xb000, 0xc000, "r-xp", "/tmp/libinject.so")],
)
alerts = list(memory_obfuscation.detect(SystemState(processes=[proc]), cfg()))
self.assertEqual(len(alerts), 1)
self.assertEqual(alerts[0].signature, "process_injection_library")
self.assertEqual(alerts[0].sid,
memory_obfuscation.SID_PROCESS_INJECTION_LIBRARY)
self.assertEqual(alerts[0].classtype, "process-injection")
self.assertEqual(alerts[0].severity, Severity.HIGH)
def test_process_injection_library_allow_path(self):
c = cfg()
c.memory_obfuscation_allow_paths = ("/tmp/known-profiler/",)
proc = FakeProc(
pid=356, comm="python3",
memory_maps=[
MemoryMap(0xd000, 0xe000, "r-xp", "/tmp/known-profiler/libhook.so"),
],
)
self.assertEqual(list(memory_obfuscation.detect(SystemState(processes=[proc]), c)), [])
def test_jit_allowlisted_comm_ignored(self):
proc = FakeProc(
pid=353, comm="node",