luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host event rules for bind and capability activity

Browse source
This commit is contained in:
Luna 2026-07-10 04:11:33 -07:00
parent b40ac4252c
commit 9784033f86
No known key found for this signature in database
12 changed files with 316 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

76
docs/RULES.md
View file

@ -317,3 +317,79 @@ Expected false positives:
- Privileged installer or service-management scripts during maintenance windows.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.
## SID 100073: Interpreter bound an unusual local port
- Event: `bind`
- Signature: `host_rule.suspicious-bind`
- Classtype: `suspicious-bind`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `bind`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
Expected false positives:
- Developer or diagnostic scripts binding high local ports intentionally.
- Short-lived local service wrappers that bind before handing sockets to a supervised process.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100073-interpreter-unusual-bind.json`.
## SID 100076: Interpreter accepted inbound traffic on an unusual local port
- Event: `accept`
- Signature: `host_rule.suspicious-accept`
- Classtype: `suspicious-accept`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `accept`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `peer_public`: `True`
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
Expected false positives:
- Developer servers or test harnesses accepting inbound public traffic from an interpreter.
- Administrative troubleshooting with temporary netcat/socat listeners.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100076-interpreter-unusual-accept.json`.
## SID 100077: Interpreter requested sensitive Linux capabilities
- Event: `capset`
- Signature: `host_rule.capability-escalation`
- Classtype: `capability-escalation`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `capset`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `capabilities_any`: `CAP_DAC_READ_SEARCH`, `CAP_NET_ADMIN`, `CAP_NET_RAW`, `CAP_SYS_ADMIN`, `CAP_SYS_MODULE`, `CAP_SYS_PTRACE`
Expected false positives:
- Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.
- Container or network lab setup scripts using interpreters to configure namespaces or packet capture.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100077-interpreter-capset-sensitive.json`.
## SID 100078: Kernel module load requested from a writable runtime path
- Event: `module_load`
- Signature: `host_rule.suspicious-module-load`
- Classtype: `suspicious-module-load`
- Severity: `CRITICAL`
- Origin: `builtin`
Match fields:
- `events`: `module_load`
- `path_prefixes`: `/tmp/`, `/var/tmp/`, `/dev/shm/`, `/run/user/`
Expected false positives:
- Kernel development labs loading locally built modules from temporary build directories.
- Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100078-module-load-writable-path.json`.