Expand TUI guidance and host detection coverage

tests/test_triage.py

@@ -112,6 +112,14 @@ class TestOtherSignatures(unittest.TestCase):
         self.assertIn("memory_obfuscation_allow_comms", v.suggest)
         self.assertIn('"jit-runtime"', v.suggest)
 
+    def test_process_injection_library_is_review(self):
+        a = alert("process_injection_library",
+                  "pid=45 comm=sshd executable library mapped from writable/runtime path: /tmp/libinject.so",
+                  sid=100049)
+        v = triage_alert(a, [], Config(), is_owned=NONE)
+        self.assertEqual(v.label, REVIEW)
+        self.assertIn("writable path", v.reason)
+
 
 if __name__ == "__main__":
     unittest.main()