Add memory obfuscation and ps-hidden process detection

docs/RUNBOOKS.md

@@ -176,8 +176,8 @@ the transaction completes; a persistent mismatch is the real finding.
 `rootkit_known_module` (100028), `rootkit_tainted_module` (100029),
 `kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031),
 `rootkit_hidden_raw_socket` (100034), `raw_icmp_socket` (100035),
-`rootkit_hidden_protocol_socket` (100037), and `new_listener` (100013) for an
-unexplained open port.
+`rootkit_hidden_protocol_socket` (100037), `rootkit_ps_hidden_process` (100038),
+and `new_listener` (100013) for an unexplained open port.
 
 These come from cross-view checks: the same question asked two ways, answered
 differently, because something is hiding.
@@ -193,6 +193,9 @@ differently, because something is hiding.
 - `new_listener`: identify the owning process and whether its binary is
   package-owned. A hidden port that `rootcheck` sees but `ss` does not is far more
   serious than a forgotten service.
+- `rootkit_ps_hidden_process`: compare `/proc/<pid>/cmdline`, `/proc/<pid>/exe`,
+  and `/proc/<pid>/maps` against `ps`/`pgrep` output. A process visible in
+  `/proc` but missing from `ps` strongly suggests userland process-tool hiding.
 - `rootkit_hidden_udp_port`: check whether a legitimate UDP service owns the
   port; a port present in `/proc/net/udp*` but absent from `ss -u` suggests tool
   output may be hooked.
@@ -232,7 +235,38 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Credential or input capture
+## Runbook 5 — Memory obfuscation or process-hiding library
+
+**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048)
+
+These alerts come from `/proc/<pid>/maps`. They do not read process memory; they
+flag map shapes associated with encrypted/packed payloads or userland hiding:
+RWX pages, executable anonymous memory, executable `memfd`/deleted mappings, or
+libraries with process-hiding names such as `libhide`.
+
+**Confirm**
+
+- Open the snapshot and inspect `cmdline`, `exe`, parent process, and captured
+  memory maps for the PID.
+- For `process_hiding_library`, check whether the mapped library is package-owned
+  and whether it is loaded into tools like `ps`, `pgrep`, `ss`, shells, or admin
+  utilities.
+- For `memory_obfuscation`, distinguish expected JIT runtimes from unknown
+  implants. Tune known runtimes with `memory_obfuscation_allow_comms`; use
+  `memory_obfuscation_allow_paths` only for well-understood local runtimes or
+  instrumentation.
+
+**Contain**
+
+- Preserve the executable and `/proc/<pid>/maps` before killing. If the alert is
+  for executable `memfd` or deleted mappings, capture memory first if you have
+  trusted tooling; the on-disk payload may be gone.
+- Re-run `rootcheck` after containment to confirm no process-tool hiding or
+  hidden sockets remain.
+
+---
+
+## Runbook 6 — Credential or input capture
 
 **Triggers:** `credential_access` (100033), `input_snooper` (100032)
 
@@ -262,7 +296,7 @@ harvesting, but are intentionally behavior-based.
 
 ---
 
-## Runbook 6 — Sensor tampering
+## Runbook 7 — Sensor tampering
 
 **Triggers:** `fim_modified` on a Sentinel-owned path (self-integrity), a stale or
 missing heartbeat surfaced by the off-box `watchdog`, or the dashboard going