Expand monitoring for credential theft and covert protocols

CLAUDE.md

@@ -54,10 +54,24 @@ Start with:
 - `respond.py` builds read-only response plans from incident evidence.
 - `web.py` serves the HTTPS-only management console and JSON APIs.
 - `rootcheck.py` performs anti-rootkit cross-view checks:
-  hidden processes, hidden modules, hidden TCP/UDP ports, promiscuous
-  interfaces, known LKM rootkit module names, and kernel/module taint.
+  hidden processes, hidden modules, hidden TCP/UDP/raw/special-protocol sockets,
+  raw ICMP/SCTP-style channels, promiscuous interfaces, known LKM rootkit module
+  names, and kernel/module taint.
 - `posture.py` performs advisory host hygiene checks.
 
+## Current Threat Mapping
+
+Recent local sample families used for defensive coverage:
+
+- Gonzalo-style implant/rootkit behavior: direct input-event keylogging,
+  credential harvesting, LD_PRELOAD/tool tampering, persistence writes, raw ICMP
+  and SCTP-style knock/listener paths, deleted/fileless execution, and hidden
+  sockets/modules.
+- Peopleswar-style C2 behavior: TLS C2 listener/check-in traffic, command queue
+  responses, and API/listener ports. Sentinel should prefer behavior coverage
+  (`new_listener`, `egress`, `stealth_network`, rootcheck, credential/input
+  detectors) over brittle sample-name matching unless adding explicit IOCs.
+
 ## Development Commands
 
 ```bash
@@ -100,4 +114,3 @@ When changing behavior, update the relevant set:
 - `docs/THREAT_MODEL.md` for trust-boundary/security-model changes.
 - `docs/ROADMAP.md` for planned or completed roadmap movement.
 - `config/enodia-sentinel.toml` for config knobs.
-