luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

18
README.md
View file

@ -84,10 +84,14 @@ classtype = "c2-reverse-shell"
argv_regex = "/dev/(tcp|udp)/| -i\\b| -e\\b| pty\\.spawn"
```
Shipped rules cover fileless execution from world-writable dirs (`sid 100001`),
reverse-shell argv patterns (`100002`), web/DB services spawning a shell —
webshell/RCE (`100003`), and `curl|sh`-style ingress tool transfer (`100004`).
Operators add their own via `exec_rules_file` without touching code.
Shipped exec rules cover fileless execution from world-writable dirs
(`sid 100001`), reverse-shell argv patterns (`100002`), web/DB services
spawning a shell — webshell/RCE (`100003`), and `curl|sh`-style ingress tool
transfer (`100004`). The syscall stream adds short-lived memory/anti-analysis
coverage for RWX `mprotect`/`mmap` (`100060`/`100061`), `memfd_create`
(`100062`), sensitive `ptrace` (`100063`), seccomp hardening (`100064`),
cross-process memory access (`100065`), and memory locking (`100066`).
Operators add custom exec rules via `exec_rules_file` without touching code.
The layer is **fail-safe**: if `bcc`/root/BTF aren't available it logs the
reason and the daemon runs poll-only — a broken probe can never take detection
@ -237,6 +241,8 @@ enodia-sentinel.service`. Every key is optional. Highlights:
| `suid_hot_dirs` | /tmp … | dirs where a SUID binary is CRITICAL |
| `suid_scan_extra_dirs` | /tmp … | writable mounts always scanned (tmpfs-safe) |
| `capture_execve_bpftrace` | false | add a bpftrace execve trace to snapshots |
| `ebpf_exec_monitor` | true | optional execve event monitor |
| `ebpf_syscall_monitor` | true | optional memory/anti-analysis syscall monitor |
| `notify_users` | [] | desktop notify-send targets |
| `pkgdb_pkgverify` | false | verify on-disk files against signed cache packages |
| `pkgdb_pkgverify_sample` | 40 | packages verified per pass (rotates over time) |
@ -489,7 +495,9 @@ sudo pacman -S python-bpfcc
sudo install -Dm644 systemd/enodia-sentinel-ebpf.conf \
/etc/systemd/system/enodia-sentinel.service.d/ebpf.conf
sudo systemctl daemon-reload && sudo systemctl restart enodia-sentinel
# confirm: grep 'eBPF exec monitor' /var/log/enodia-sentinel/events.log
# confirm:
grep 'eBPF exec monitor' /var/log/enodia-sentinel/events.log
grep 'eBPF syscall monitor' /var/log/enodia-sentinel/events.log
```
The drop-in relaxes `MemoryDenyWriteExecute` and widens the capability set — a