luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add memory obfuscation and ps-hidden process detection

Browse source
This commit is contained in:
Luna 2026-06-13 03:55:09 -07:00
parent cb334c0c94
commit 893409b549
17 changed files with 353 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

17
config/enodia-sentinel.toml
View file

@ -15,6 +15,7 @@ suid_scan_interval = 60 # seconds between (backgrounded) SUID filesystem sca
detectors = [
"reverse_shell", "ld_preload", "deleted_exe",
"input_snooper", "credential_access", "stealth_network",
"memory_obfuscation",
"new_listener", "new_suid", "persistence", "egress",
]
@ -80,6 +81,15 @@ stealth_network_allow_comms = [
# raw, sctp, dccp, packet, mptcp, tipc, xdp, vsock.
stealth_network_allow_kinds = []
# Expected owners of JIT/executable anonymous mappings.
memory_obfuscation_allow_comms = [
"java", "node", "firefox", "chromium", "chrome", "google-chrome",
"brave", "brave-browser", "WebKitWebProcess", "dotnet", "qemu-system-x86",
"qemu-system-x86_64", "wine", "wasmtime",
]
# Prefixes for mapped paths allowed to trip otherwise suspicious map shapes.
memory_obfuscation_allow_paths = []
# --- file integrity monitoring (FIM) ------------------------------------
# SHA-256 baseline of security-critical files the package manager doesn't track
# (configs, /usr/local, systemd units, keys). A pacman PostTransaction hook runs
@ -112,9 +122,10 @@ pkgdb_pkgverify_sample = 40 # packages verified per pass (rotates)
# --- anti-rootkit cross-view --------------------------------------------
# Ask the same question two ways and diff the answers: kill(0) vs /proc for
# hidden processes, /sys/module vs /proc/modules for hidden LKMs, /proc/net/tcp
# vs ss for hidden TCP/UDP/raw/special-protocol sockets, interface flags for
# promiscuous sniffing, known rootkit module names, raw ICMP/SCTP-style
# channels, per-module taint, and global kernel taint.
# vs ps for userland process hiding, /proc/net vs ss for hidden TCP/UDP/raw/
# special-protocol sockets, interface flags for promiscuous sniffing, known
# rootkit module names, raw ICMP/SCTP-style channels, per-module taint, and
# global kernel taint.
rootcheck_enabled = true
rootcheck_interval = 300 # seconds between cross-view sweeps
rootcheck_pid_cap = 65536 # upper PID to brute-force via kill(0)