Add host event rules for bind and capability activity

docs/ROADMAP.md

@@ -136,10 +136,9 @@ Purpose: reduce blind spots and connect related signals.
   flags interpreters opening listeners on unusual local ports, with local-port
   match conditions and a replayable fixture.
 - ✅ Continue generalizing the rule engine across more typed host events:
-  `file_write`, `chmod/chown`, and `setuid/setgid` now have built-in rules,
-  typed event parsing, fixtures, and rule-operation tests.
-- Continue extending typed host-event coverage to:
-  `bind`, `accept`, `capset`, and module-load events.
+  `file_write`, `chmod/chown`, `setuid/setgid`, `bind`, `accept`, `capset`,
+  and module-load now have built-in rules, typed event parsing, fixtures, and
+  rule-operation tests.
 - Keep rules declarative and Snort-like:
   `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as
   process name, parent process, argv regex, path prefix, peer IP/port, UID/GID,

docs/RULES.md

@@ -317,3 +317,79 @@ Expected false positives:
 - Privileged installer or service-management scripts during maintenance windows.
 
 Drill or fixture: Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.
+
+## SID 100073: Interpreter bound an unusual local port
+
+- Event: `bind`
+- Signature: `host_rule.suspicious-bind`
+- Classtype: `suspicious-bind`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `bind`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
+
+Expected false positives:
+- Developer or diagnostic scripts binding high local ports intentionally.
+- Short-lived local service wrappers that bind before handing sockets to a supervised process.
+
+Drill or fixture: Use `rules test` with `tests/fixtures/sids/100073-interpreter-unusual-bind.json`.
+
+## SID 100076: Interpreter accepted inbound traffic on an unusual local port
+
+- Event: `accept`
+- Signature: `host_rule.suspicious-accept`
+- Classtype: `suspicious-accept`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `accept`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `peer_public`: `True`
+- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
+
+Expected false positives:
+- Developer servers or test harnesses accepting inbound public traffic from an interpreter.
+- Administrative troubleshooting with temporary netcat/socat listeners.
+
+Drill or fixture: Use `rules test` with `tests/fixtures/sids/100076-interpreter-unusual-accept.json`.
+
+## SID 100077: Interpreter requested sensitive Linux capabilities
+
+- Event: `capset`
+- Signature: `host_rule.capability-escalation`
+- Classtype: `capability-escalation`
+- Severity: `HIGH`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `capset`
+- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
+- `capabilities_any`: `CAP_DAC_READ_SEARCH`, `CAP_NET_ADMIN`, `CAP_NET_RAW`, `CAP_SYS_ADMIN`, `CAP_SYS_MODULE`, `CAP_SYS_PTRACE`
+
+Expected false positives:
+- Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.
+- Container or network lab setup scripts using interpreters to configure namespaces or packet capture.
+
+Drill or fixture: Use `rules test` with `tests/fixtures/sids/100077-interpreter-capset-sensitive.json`.
+
+## SID 100078: Kernel module load requested from a writable runtime path
+
+- Event: `module_load`
+- Signature: `host_rule.suspicious-module-load`
+- Classtype: `suspicious-module-load`
+- Severity: `CRITICAL`
+- Origin: `builtin`
+
+Match fields:
+- `events`: `module_load`
+- `path_prefixes`: `/tmp/`, `/var/tmp/`, `/dev/shm/`, `/run/user/`
+
+Expected false positives:
+- Kernel development labs loading locally built modules from temporary build directories.
+- Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.
+
+Drill or fixture: Use `rules test` with `tests/fixtures/sids/100078-module-load-writable-path.json`.