Add event-driven memory syscall telemetry

docs/COMMAND_REFERENCE.md

@@ -22,8 +22,8 @@ enodia-sentinel run
 ```
 
 Starts the daemon loop. This is the command used by the systemd service. It
-builds or loads baselines, starts optional event monitoring, writes heartbeats,
-runs detector sweeps, captures snapshots, and sends notifications.
+builds or loads baselines, starts optional exec/syscall event monitoring, writes
+heartbeats, runs detector sweeps, captures snapshots, and sends notifications.
 
 Expected use: systemd, not an interactive shell.
 

docs/ROADMAP.md

@@ -43,6 +43,9 @@ work that is bigger than single alerts.
 - ✅ Add process-hiding and memory-obfuscation coverage: `/proc` vs `ps`
   cross-view checks plus memory-map scans for hide libraries, RWX memory, and
   executable anonymous/memfd/deleted mappings.
+- ✅ Add event-driven memory telemetry for short-lived `mprotect`/`mmap` RWX,
+  `memfd_create`, `ptrace`, seccomp, cross-process memory access, and memory
+  locking syscalls.
 
 Exit criteria:
 

docs/SPECIFICATION.md

@@ -64,10 +64,12 @@ against cached process and socket data:
 
 ### Event Detection
 
-An optional bcc eBPF `execve` monitor feeds a declarative rule engine. This
-closes the polling gap for short-lived commands and supports custom TOML rules
-without code changes. Failure is fail-safe: if the probe cannot load, polling
-continues.
+Optional bcc eBPF monitors feed event rule engines. The `execve` stream closes
+the polling gap for short-lived commands and supports custom TOML rules without
+code changes. The syscall stream watches short-lived memory and anti-analysis
+behavior: RWX `mprotect`/`mmap`, `memfd_create`, sensitive `ptrace`, seccomp,
+cross-process memory access, and memory locking. Failure is fail-safe: if a
+probe cannot load, polling continues.
 
 ### Integrity and Tamper-Evidence
 

docs/THREAT_MODEL.md

@@ -29,7 +29,7 @@ Sentinel is designed to help against:
 | Fileless or short-lived execution | Deleted executable, memfd payload, fast `curl|sh` | Detect deleted executables and eBPF exec rules where available. |
 | Package/file tampering | Trojaned binary, rewritten package DB checksums | Detect FIM drift, package DB tamper, and signed-package mismatches. |
 | Common rootkit hiding | LD_PRELOAD tricks, process-tool hiding, `/proc` hiding, module-list hiding, hidden TCP/UDP/raw/SCTP/packet sockets, tainted modules | Detect LD_PRELOAD, `/proc` vs `ps` disagreement, mapped hide libraries, cross-view inconsistencies, known LKM names, raw ICMP/SCTP-style sockets, unusual protocol families, and kernel/module taint. |
-| Memory-resident payloads | Encrypted heap/code, packed memfd stages, RWX shellcode, deleted mapped payloads | Detect executable anonymous/memfd/deleted mappings and writable+executable pages. |
+| Memory-resident payloads | Encrypted heap/code, packed memfd stages, RWX shellcode, deleted mapped payloads | Detect executable anonymous/memfd/deleted mappings and writable+executable pages; optional eBPF syscall telemetry catches short-lived RWX transitions and memfd staging. |
 | Sensor tampering | Stop daemon, edit config, remove hook, modify baseline | Detect self-integrity changes and stale heartbeat via external watchdog. |
 
 ## Trust Boundaries