luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host event rules for bind and capability activity

Browse source
This commit is contained in:
Luna 2026-07-10 04:11:33 -07:00
parent b40ac4252c
commit 9784033f86
No known key found for this signature in database
12 changed files with 316 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/fixtures/sids/100073-interpreter-unusual-bind.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "bind",
"pid": 4242,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"local_ip": "0.0.0.0",
"local_port": 4444
}

11
tests/fixtures/sids/100076-interpreter-unusual-accept.json vendored Normal file
View file

@ -0,0 +1,11 @@
{
"event": "accept",
"pid": 4242,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"peer_ip": "8.8.8.8",
"peer_port": 51515,
"local_ip": "0.0.0.0",
"local_port": 4444
}

8
tests/fixtures/sids/100077-interpreter-capset-sensitive.json vendored Normal file
View file

@ -0,0 +1,8 @@
{
"event": "capset",
"pid": 4242,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"capabilities": ["CAP_SYS_ADMIN"]
}

9
tests/fixtures/sids/100078-module-load-writable-path.json vendored Normal file
View file

@ -0,0 +1,9 @@
{
"event": "module_load",
"pid": 4242,
"ppid": 1,
"uid": 0,
"comm": "insmod",
"path": "/tmp/evil.ko",
"module_name": "evil"
}