Add memory obfuscation and ps-hidden process detection

docs/COMMAND_REFERENCE.md

@@ -74,9 +74,11 @@ enodia-sentinel rootcheck
 Runs anti-rootkit cross-view checks once:
 
 - PIDs alive via `kill(pid, 0)` but missing from `/proc`.
+- PIDs visible in `/proc` but missing from `ps`.
 - Live modules in `/sys/module` but missing from `/proc/modules`.
 - Listening TCP ports in `/proc/net/tcp*` but missing from `ss`.
 - UDP ports in `/proc/net/udp*` but missing from `ss -u`.
+- Raw and special-protocol sockets in `/proc/net` but missing from `ss`.
 - Network interfaces in promiscuous mode.
 - Known rootkit module names.
 - Tainted loaded modules (`/sys/module/*/taint`) and global kernel taint

docs/OPERATIONS.md

@@ -66,9 +66,9 @@ Expected healthy output:
   acknowledged.
 - `pkgdb-check`: package DB consistent with anchor.
 - `pkgdb-verify`: sampled files match signed cache packages.
-- `rootcheck`: no hidden processes/modules/ports/raw/special-protocol sockets,
-  sniffers, known rootkit modules, raw ICMP/SCTP-style channels, or unexplained
-  kernel/module taint.
+- `rootcheck`: no hidden processes, processes hidden from `ps`, hidden
+  modules/ports/raw/special-protocol sockets, sniffers, known rootkit modules,
+  raw ICMP/SCTP-style channels, or unexplained kernel/module taint.
 - `posture check`: no SSH/sudo/PATH/permission/signature hygiene findings, or
   only ones you have consciously accepted (e.g. password auth on a host that
   needs it).

docs/ROADMAP.md

@@ -40,6 +40,9 @@ work that is bigger than single alerts.
 - ✅ Add Gonzalo/Peopleswar-style behavior coverage: input-device keylogging,
   credential-store/private-key access, SCTP/DCCP/raw/packet-family traffic, and
   raw ICMP/special-protocol rootcheck detection.
+- ✅ Add process-hiding and memory-obfuscation coverage: `/proc` vs `ps`
+  cross-view checks plus memory-map scans for hide libraries, RWX memory, and
+  executable anonymous/memfd/deleted mappings.
 
 Exit criteria:
 

docs/RUNBOOKS.md

@@ -176,8 +176,8 @@ the transaction completes; a persistent mismatch is the real finding.
 `rootkit_known_module` (100028), `rootkit_tainted_module` (100029),
 `kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031),
 `rootkit_hidden_raw_socket` (100034), `raw_icmp_socket` (100035),
-`rootkit_hidden_protocol_socket` (100037), and `new_listener` (100013) for an
-unexplained open port.
+`rootkit_hidden_protocol_socket` (100037), `rootkit_ps_hidden_process` (100038),
+and `new_listener` (100013) for an unexplained open port.
 
 These come from cross-view checks: the same question asked two ways, answered
 differently, because something is hiding.
@@ -193,6 +193,9 @@ differently, because something is hiding.
 - `new_listener`: identify the owning process and whether its binary is
   package-owned. A hidden port that `rootcheck` sees but `ss` does not is far more
   serious than a forgotten service.
+- `rootkit_ps_hidden_process`: compare `/proc/<pid>/cmdline`, `/proc/<pid>/exe`,
+  and `/proc/<pid>/maps` against `ps`/`pgrep` output. A process visible in
+  `/proc` but missing from `ps` strongly suggests userland process-tool hiding.
 - `rootkit_hidden_udp_port`: check whether a legitimate UDP service owns the
   port; a port present in `/proc/net/udp*` but absent from `ss -u` suggests tool
   output may be hooked.
@@ -232,7 +235,38 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Credential or input capture
+## Runbook 5 — Memory obfuscation or process-hiding library
+
+**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048)
+
+These alerts come from `/proc/<pid>/maps`. They do not read process memory; they
+flag map shapes associated with encrypted/packed payloads or userland hiding:
+RWX pages, executable anonymous memory, executable `memfd`/deleted mappings, or
+libraries with process-hiding names such as `libhide`.
+
+**Confirm**
+
+- Open the snapshot and inspect `cmdline`, `exe`, parent process, and captured
+  memory maps for the PID.
+- For `process_hiding_library`, check whether the mapped library is package-owned
+  and whether it is loaded into tools like `ps`, `pgrep`, `ss`, shells, or admin
+  utilities.
+- For `memory_obfuscation`, distinguish expected JIT runtimes from unknown
+  implants. Tune known runtimes with `memory_obfuscation_allow_comms`; use
+  `memory_obfuscation_allow_paths` only for well-understood local runtimes or
+  instrumentation.
+
+**Contain**
+
+- Preserve the executable and `/proc/<pid>/maps` before killing. If the alert is
+  for executable `memfd` or deleted mappings, capture memory first if you have
+  trusted tooling; the on-disk payload may be gone.
+- Re-run `rootcheck` after containment to confirm no process-tool hiding or
+  hidden sockets remain.
+
+---
+
+## Runbook 6 — Credential or input capture
 
 **Triggers:** `credential_access` (100033), `input_snooper` (100032)
 
@@ -262,7 +296,7 @@ harvesting, but are intentionally behavior-based.
 
 ---
 
-## Runbook 6 — Sensor tampering
+## Runbook 7 — Sensor tampering
 
 **Triggers:** `fim_modified` on a Sentinel-owned path (self-integrity), a stale or
 missing heartbeat surfaced by the off-box `watchdog`, or the dashboard going

docs/SPECIFICATION.md

@@ -56,6 +56,7 @@ against cached process and socket data:
 | `input_snooper` | Non-allowlisted process holding keyboard/input/HID devices open. |
 | `credential_access` | Non-allowlisted process reading credential databases, private keys, browser stores, or secret profiles. |
 | `stealth_network` | Non-allowlisted raw, SCTP, DCCP, packet, MPTCP, TIPC, XDP, or vsock activity. |
+| `memory_obfuscation` | Non-allowlisted executable anonymous/memfd/deleted mappings, RWX memory, or mapped process-hiding libraries. |
 | `new_listener` | Listening socket absent from the startup baseline. |
 | `new_suid` | New SUID/SGID binary, critical in writable locations. |
 | `persistence` | Changes to cron, systemd units, SSH keys, shell rc files, and similar persistence locations. |
@@ -79,7 +80,7 @@ Sentinel includes several integrity layers:
 | Package DB anchor | Detects out-of-band edits to `/var/lib/pacman/local`. |
 | Signed-package anchor | Compares on-disk files to `.MTREE` hashes from cached signed packages. |
 | Heartbeat | Writes daemon liveness for local dashboard and external watchdog use. |
-| Rootcheck | Cross-view checks for hidden processes, hidden modules, hidden TCP/UDP/raw/special-protocol sockets, promiscuous interfaces, known rootkit modules, raw ICMP/SCTP-style channels, and kernel/module taint. |
+| Rootcheck | Cross-view checks for hidden processes, processes hidden from `ps`, hidden modules, hidden TCP/UDP/raw/special-protocol sockets, promiscuous interfaces, known rootkit modules, raw ICMP/SCTP-style channels, and kernel/module taint. |
 
 ### Evidence Capture
 

docs/THREAT_MODEL.md

@@ -28,7 +28,8 @@ Sentinel is designed to help against:
 | Local privilege escalation | New SUID helper, dropped setuid shell, writable path abuse | Detect new SUID/SGID and critical writable-directory placement. |
 | Fileless or short-lived execution | Deleted executable, memfd payload, fast `curl|sh` | Detect deleted executables and eBPF exec rules where available. |
 | Package/file tampering | Trojaned binary, rewritten package DB checksums | Detect FIM drift, package DB tamper, and signed-package mismatches. |
-| Common rootkit hiding | LD_PRELOAD tricks, `/proc` hiding, module-list hiding, hidden TCP/UDP/raw/SCTP/packet sockets, tainted modules | Detect LD_PRELOAD, cross-view inconsistencies, known LKM names, raw ICMP/SCTP-style sockets, unusual protocol families, and kernel/module taint. |
+| Common rootkit hiding | LD_PRELOAD tricks, process-tool hiding, `/proc` hiding, module-list hiding, hidden TCP/UDP/raw/SCTP/packet sockets, tainted modules | Detect LD_PRELOAD, `/proc` vs `ps` disagreement, mapped hide libraries, cross-view inconsistencies, known LKM names, raw ICMP/SCTP-style sockets, unusual protocol families, and kernel/module taint. |
+| Memory-resident payloads | Encrypted heap/code, packed memfd stages, RWX shellcode, deleted mapped payloads | Detect executable anonymous/memfd/deleted mappings and writable+executable pages. |
 | Sensor tampering | Stop daemon, edit config, remove hook, modify baseline | Detect self-integrity changes and stale heartbeat via external watchdog. |
 
 ## Trust Boundaries