Add memory obfuscation and ps-hidden process detection

enodia_sentinel/config.py

@@ -27,6 +27,7 @@ _DEFAULT_WATCH = (
 _ALL_DETECTORS = (
     "reverse_shell", "ld_preload", "deleted_exe",
     "input_snooper", "credential_access", "stealth_network",
+    "memory_obfuscation",
     "new_listener", "new_suid", "persistence", "egress",
 )
 
@@ -86,6 +87,16 @@ class Config:
     # it legitimately. Valid observed kinds include raw, sctp, dccp, packet,
     # mptcp, tipc, xdp, and vsock.
     stealth_network_allow_kinds: frozenset[str] = frozenset()
+    # Expected owners of JIT/executable anonymous mappings. Keep this to broad
+    # runtimes and browsers; process-hiding library names still alert elsewhere.
+    memory_obfuscation_allow_comms: frozenset[str] = frozenset((
+        "java", "node", "firefox", "chromium", "chrome", "google-chrome",
+        "brave", "brave-browser", "WebKitWebProcess", "dotnet", "qemu-system-x86",
+        "qemu-system-x86_64", "wine", "wasmtime",
+    ))
+    # Prefixes for mapped paths that are allowed to trip otherwise suspicious
+    # memory-map shapes (for local JIT runtimes or known instrumentation).
+    memory_obfuscation_allow_paths: tuple[str, ...] = ()
 
     # file integrity monitoring (FIM)
     fim_enabled: bool = True