Expand monitoring for credential theft and covert protocols

docs/OPERATIONS.md

@@ -66,8 +66,9 @@ Expected healthy output:
   acknowledged.
 - `pkgdb-check`: package DB consistent with anchor.
 - `pkgdb-verify`: sampled files match signed cache packages.
-- `rootcheck`: no hidden processes/modules/ports, sniffers, known rootkit
-  modules, or unexplained kernel/module taint.
+- `rootcheck`: no hidden processes/modules/ports/raw/special-protocol sockets,
+  sniffers, known rootkit modules, raw ICMP/SCTP-style channels, or unexplained
+  kernel/module taint.
 - `posture check`: no SSH/sudo/PATH/permission/signature hygiene findings, or
   only ones you have consciously accepted (e.g. password auth on a host that
   needs it).

docs/ROADMAP.md

@@ -37,6 +37,9 @@ work that is bigger than single alerts.
   expected `sid` (`sentinel-redteam --list`), with a PASS/MISS verification pass.
 - ✅ Document incident response runbooks for reverse shells, persistence, trojaned
   binaries, hidden listeners, and sensor tampering ([RUNBOOKS.md](RUNBOOKS.md)).
+- ✅ Add Gonzalo/Peopleswar-style behavior coverage: input-device keylogging,
+  credential-store/private-key access, SCTP/DCCP/raw/packet-family traffic, and
+  raw ICMP/special-protocol rootcheck detection.
 
 Exit criteria:
 

docs/RUNBOOKS.md

@@ -41,10 +41,12 @@ Then pick the runbook below that matches the signature.
 
 ## Runbook 1 — Reverse shell / suspicious egress
 
-**Triggers:** `reverse_shell` (sid 100010), `egress` (sid 100016).
+**Triggers:** `reverse_shell` (sid 100010), `egress` (sid 100016),
+`stealth_network` (sid 100036).
 
-An interpreter wired to a socket, or an interpreter holding a connection to a
-public IP — the classic interactive-C2 and beaconing shapes.
+An interpreter wired to a socket, an interpreter holding a connection to a
+public IP, or activity over raw/SCTP/DCCP/packet/XDP/TIPC/vsock families - the
+classic interactive-C2, beaconing, and covert-channel shapes.
 
 **Confirm**
 
@@ -60,6 +62,11 @@ public IP — the classic interactive-C2 and beaconing shapes.
 
 - Is the peer expected? Compare against `egress_allow_cidrs` in config. A package
   manager or browser to a public IP is normal; `bash`/`python`/`nc` is not.
+- For `stealth_network`, check the socket family and owner. Packet/raw sockets
+  are normal for approved sniffers and some network managers; SCTP/DCCP/TIPC/XDP
+  on a desktop or ordinary server should have a clear service owner. Tune with
+  `stealth_network_allow_comms` or, for intentionally used families,
+  `stealth_network_allow_kinds`.
 
 **Contain**
 
@@ -167,8 +174,10 @@ the transaction completes; a persistent mismatch is the real finding.
 **Triggers:** `rootkit_hidden_process` (100022), `rootkit_hidden_module` (100023),
 `rootkit_hidden_port` (100024), `promiscuous_interface` (100025),
 `rootkit_known_module` (100028), `rootkit_tainted_module` (100029),
-`kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031), and
-`new_listener` (100013) for an unexplained open port.
+`kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031),
+`rootkit_hidden_raw_socket` (100034), `raw_icmp_socket` (100035),
+`rootkit_hidden_protocol_socket` (100037), and `new_listener` (100013) for an
+unexplained open port.
 
 These come from cross-view checks: the same question asked two ways, answered
 differently, because something is hiding.
@@ -187,6 +196,15 @@ differently, because something is hiding.
 - `rootkit_hidden_udp_port`: check whether a legitimate UDP service owns the
   port; a port present in `/proc/net/udp*` but absent from `ss -u` suggests tool
   output may be hooked.
+- `rootkit_hidden_raw_socket` or `raw_icmp_socket`: look for authorized ping,
+  monitoring, traceroute, or packet tooling first. A persistent raw ICMP socket
+  with no operator explanation is consistent with ICMP knockers/backdoors and
+  should be investigated with process fd tables, package provenance, and memory
+  capture before killing the process.
+- `rootkit_hidden_protocol_socket`: inspect SCTP, DCCP, packet, TIPC, or XDP
+  use. If `/proc/net` sees the family but `ss` does not, treat normal socket
+  tooling as suspect and pivot to offline evidence or the dashboard from another
+  host.
 - A `rootkit_hidden_module` names a live kernel module absent from
   `/proc/modules` — strong evidence of an LKM rootkit.
 - A `rootkit_known_module` finding names a module associated with public LKM
@@ -214,7 +232,37 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Sensor tampering
+## Runbook 5 — Credential or input capture
+
+**Triggers:** `credential_access` (100033), `input_snooper` (100032)
+
+These alerts mean a non-allowlisted process has credential material or keyboard
+input devices open. They map to Gonzalo-style keylogging and local credential
+harvesting, but are intentionally behavior-based.
+
+**Confirm**
+
+- Open the snapshot for the alert and inspect the captured `cmdline`, `exe`,
+  `cwd`, parent process, and fd target.
+- For `input_snooper`, confirm whether the process is an expected compositor,
+  display server, input remapper, or accessibility tool. Add stable legitimate
+  process names to `input_snooper_allow_comms`.
+- For `credential_access`, identify which secret was opened: shadow DB, private
+  SSH key, browser credential store, or NetworkManager secret profile. Add
+  only well-understood auth/keyring/browser readers to
+  `credential_access_allow_comms`.
+
+**Contain**
+
+- Preserve evidence first for unknown processes: copy the executable path if it
+  still exists, capture `/proc/<pid>/maps`, and export the incident.
+- Rotate exposed credentials and SSH keys after containment; assume browser
+  session cookies and saved passwords may be compromised if browser stores were
+  opened by an unknown process.
+
+---
+
+## Runbook 6 — Sensor tampering
 
 **Triggers:** `fim_modified` on a Sentinel-owned path (self-integrity), a stale or
 missing heartbeat surfaced by the off-box `watchdog`, or the dashboard going

docs/SPECIFICATION.md

@@ -41,7 +41,7 @@ The long-term product should combine five functions:
 6. **Bash prototype remains the oracle.** The original shell implementation and
    red-team harness preserve behavioral compatibility for core signatures.
 
-## Current Scope: v0.7
+## Current Scope: v0.8-dev
 
 ### Poll Detectors
 
@@ -53,6 +53,9 @@ against cached process and socket data:
 | `reverse_shell` | Interpreter with a network socket on fd 0/1/2. |
 | `ld_preload` | Non-empty `/etc/ld.so.preload` or writable-path `LD_PRELOAD`. |
 | `deleted_exe` | Process executing from a deleted file or `memfd:` image. |
+| `input_snooper` | Non-allowlisted process holding keyboard/input/HID devices open. |
+| `credential_access` | Non-allowlisted process reading credential databases, private keys, browser stores, or secret profiles. |
+| `stealth_network` | Non-allowlisted raw, SCTP, DCCP, packet, MPTCP, TIPC, XDP, or vsock activity. |
 | `new_listener` | Listening socket absent from the startup baseline. |
 | `new_suid` | New SUID/SGID binary, critical in writable locations. |
 | `persistence` | Changes to cron, systemd units, SSH keys, shell rc files, and similar persistence locations. |
@@ -76,7 +79,7 @@ Sentinel includes several integrity layers:
 | Package DB anchor | Detects out-of-band edits to `/var/lib/pacman/local`. |
 | Signed-package anchor | Compares on-disk files to `.MTREE` hashes from cached signed packages. |
 | Heartbeat | Writes daemon liveness for local dashboard and external watchdog use. |
-| Rootcheck | Cross-view checks for hidden processes, hidden modules, hidden TCP/UDP ports, promiscuous interfaces, known rootkit modules, and kernel/module taint. |
+| Rootcheck | Cross-view checks for hidden processes, hidden modules, hidden TCP/UDP/raw/special-protocol sockets, promiscuous interfaces, known rootkit modules, raw ICMP/SCTP-style channels, and kernel/module taint. |
 
 ### Evidence Capture
 

docs/THREAT_MODEL.md

@@ -24,10 +24,11 @@ Sentinel is designed to help against:
 | Adversary | Examples | Expected Sentinel value |
 |---|---|---|
 | Opportunistic remote shell | Webshell, exposed service RCE, stolen SSH key | Detect reverse shell, suspicious egress, new listeners, persistence writes. |
+| Credential harvesting | Shadow file reads, private SSH key theft, browser credential database access, keylogging | Detect credential file access and non-allowlisted input/HID event readers. |
 | Local privilege escalation | New SUID helper, dropped setuid shell, writable path abuse | Detect new SUID/SGID and critical writable-directory placement. |
 | Fileless or short-lived execution | Deleted executable, memfd payload, fast `curl|sh` | Detect deleted executables and eBPF exec rules where available. |
 | Package/file tampering | Trojaned binary, rewritten package DB checksums | Detect FIM drift, package DB tamper, and signed-package mismatches. |
-| Common rootkit hiding | LD_PRELOAD tricks, `/proc` hiding, module-list hiding, hidden TCP/UDP sockets, tainted modules | Detect LD_PRELOAD, cross-view inconsistencies, known LKM names, and kernel/module taint. |
+| Common rootkit hiding | LD_PRELOAD tricks, `/proc` hiding, module-list hiding, hidden TCP/UDP/raw/SCTP/packet sockets, tainted modules | Detect LD_PRELOAD, cross-view inconsistencies, known LKM names, raw ICMP/SCTP-style sockets, unusual protocol families, and kernel/module taint. |
 | Sensor tampering | Stop daemon, edit config, remove hook, modify baseline | Detect self-integrity changes and stale heartbeat via external watchdog. |
 
 ## Trust Boundaries