luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand monitoring for credential theft and covert protocols

Browse source
This commit is contained in:
Luna 2026-06-13 03:30:36 -07:00
parent 3e5f8fc3f7
commit cb334c0c94
17 changed files with 675 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

30
config/enodia-sentinel.toml
View file

@ -14,6 +14,7 @@ suid_scan_interval = 60 # seconds between (backgrounded) SUID filesystem sca
# --- detectors (omit one to disable it) ----------------------------------
detectors = [
"reverse_shell", "ld_preload", "deleted_exe",
"input_snooper", "credential_access", "stealth_network",
"new_listener", "new_suid", "persistence", "egress",
]
@ -55,6 +56,30 @@ watch_persistence = [
"/root/.ssh/authorized_keys", "/root/.bashrc", "/root/.profile",
]
# Processes expected to keep keyboard/HID event devices open.
input_snooper_allow_comms = [
"Xorg", "Xwayland", "gnome-shell", "kwin_wayland", "sway", "Hyprland",
"systemd-logind", "input-remapper", "keyd", "kanata",
]
# Processes expected to read credential stores during normal auth/user activity.
credential_access_allow_comms = [
"sshd", "sudo", "su", "login", "gdm-session-worker", "polkitd",
"gnome-keyring-daemon", "kwalletd5", "kwalletd6", "firefox", "chromium",
"chrome", "google-chrome", "brave", "brave-browser",
]
# Extra exact paths or directory prefixes treated as credential material.
credential_access_extra_paths = []
# Expected owners of packet/raw/special protocol sockets.
stealth_network_allow_comms = [
"NetworkManager", "systemd-networkd", "wpa_supplicant", "dhcpcd",
"tcpdump", "dumpcap", "wireshark", "suricata", "zeek",
]
# Socket family names to ignore entirely if they are normal in your environment:
# raw, sctp, dccp, packet, mptcp, tipc, xdp, vsock.
stealth_network_allow_kinds = []
# --- file integrity monitoring (FIM) ------------------------------------
# SHA-256 baseline of security-critical files the package manager doesn't track
# (configs, /usr/local, systemd units, keys). A pacman PostTransaction hook runs
@ -87,8 +112,9 @@ pkgdb_pkgverify_sample = 40 # packages verified per pass (rotates)
# --- anti-rootkit cross-view --------------------------------------------
# Ask the same question two ways and diff the answers: kill(0) vs /proc for
# hidden processes, /sys/module vs /proc/modules for hidden LKMs, /proc/net/tcp
# vs ss for hidden TCP/UDP listeners, interface flags for promiscuous sniffing,
# known rootkit module names, per-module taint, and global kernel taint.
# vs ss for hidden TCP/UDP/raw/special-protocol sockets, interface flags for
# promiscuous sniffing, known rootkit module names, raw ICMP/SCTP-style
# channels, per-module taint, and global kernel taint.
rootcheck_enabled = true
rootcheck_interval = 300 # seconds between cross-view sweeps
rootcheck_pid_cap = 65536 # upper PID to brute-force via kill(0)