luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host correlation and assurance coverage

Browse source
This commit is contained in:
Luna 2026-07-10 03:07:00 -07:00
parent 8194d13734
commit b40ac4252c
No known key found for this signature in database
36 changed files with 944 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

75
docs/RULES.md
View file

@ -242,3 +242,78 @@ Expected false positives:
- Administrative troubleshooting that temporarily listens on a high port.
Drill or fixture: Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.
## SID 100069: Interpreter wrote to a persistence path
- Event: `file_write`
- Signature: `host_rule.persistence-write`
- Classtype: `persistence-write`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `file_write`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`
Expected false positives:
- Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.
- Administrative SSH-key or service-unit maintenance performed by a reviewed script.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100069-interpreter-persistence-write.json`.
## SID 100070: Permissions or ownership changed on a persistence path
- Event: `chmod,chown`
- Signature: `host_rule.persistence-permission-change`
- Classtype: `persistence-permission-change`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `chmod`, `chown`
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`
Expected false positives:
- Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.
- Manual recovery work that repairs permissions after a known-good change.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100070-persistence-permission-change.json`.
## SID 100071: Interpreter requested a root UID transition
- Event: `setuid`
- Signature: `host_rule.privilege-transition`
- Classtype: `privilege-transition`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `setuid`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `target_uids`: `0`
Expected false positives:
- Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.
- Privileged installer or service-management scripts during maintenance windows.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100071-interpreter-setuid-root.json`.
## SID 100072: Interpreter requested a root GID transition
- Event: `setgid`
- Signature: `host_rule.privilege-transition`
- Classtype: `privilege-transition`
- Severity: `HIGH`
- Origin: `builtin`
Match fields:
- `events`: `setgid`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `target_gids`: `0`
Expected false positives:
- Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.
- Privileged installer or service-management scripts during maintenance windows.
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.