Expand monitoring for credential theft and covert protocols

docs/RUNBOOKS.md

@@ -41,10 +41,12 @@ Then pick the runbook below that matches the signature.
 
 ## Runbook 1 — Reverse shell / suspicious egress
 
-**Triggers:** `reverse_shell` (sid 100010), `egress` (sid 100016).
+**Triggers:** `reverse_shell` (sid 100010), `egress` (sid 100016),
+`stealth_network` (sid 100036).
 
-An interpreter wired to a socket, or an interpreter holding a connection to a
-public IP — the classic interactive-C2 and beaconing shapes.
+An interpreter wired to a socket, an interpreter holding a connection to a
+public IP, or activity over raw/SCTP/DCCP/packet/XDP/TIPC/vsock families - the
+classic interactive-C2, beaconing, and covert-channel shapes.
 
 **Confirm**
 
@@ -60,6 +62,11 @@ public IP — the classic interactive-C2 and beaconing shapes.
 
 - Is the peer expected? Compare against `egress_allow_cidrs` in config. A package
   manager or browser to a public IP is normal; `bash`/`python`/`nc` is not.
+- For `stealth_network`, check the socket family and owner. Packet/raw sockets
+  are normal for approved sniffers and some network managers; SCTP/DCCP/TIPC/XDP
+  on a desktop or ordinary server should have a clear service owner. Tune with
+  `stealth_network_allow_comms` or, for intentionally used families,
+  `stealth_network_allow_kinds`.
 
 **Contain**
 
@@ -167,8 +174,10 @@ the transaction completes; a persistent mismatch is the real finding.
 **Triggers:** `rootkit_hidden_process` (100022), `rootkit_hidden_module` (100023),
 `rootkit_hidden_port` (100024), `promiscuous_interface` (100025),
 `rootkit_known_module` (100028), `rootkit_tainted_module` (100029),
-`kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031), and
-`new_listener` (100013) for an unexplained open port.
+`kernel_tainted` (100030), `rootkit_hidden_udp_port` (100031),
+`rootkit_hidden_raw_socket` (100034), `raw_icmp_socket` (100035),
+`rootkit_hidden_protocol_socket` (100037), and `new_listener` (100013) for an
+unexplained open port.
 
 These come from cross-view checks: the same question asked two ways, answered
 differently, because something is hiding.
@@ -187,6 +196,15 @@ differently, because something is hiding.
 - `rootkit_hidden_udp_port`: check whether a legitimate UDP service owns the
   port; a port present in `/proc/net/udp*` but absent from `ss -u` suggests tool
   output may be hooked.
+- `rootkit_hidden_raw_socket` or `raw_icmp_socket`: look for authorized ping,
+  monitoring, traceroute, or packet tooling first. A persistent raw ICMP socket
+  with no operator explanation is consistent with ICMP knockers/backdoors and
+  should be investigated with process fd tables, package provenance, and memory
+  capture before killing the process.
+- `rootkit_hidden_protocol_socket`: inspect SCTP, DCCP, packet, TIPC, or XDP
+  use. If `/proc/net` sees the family but `ss` does not, treat normal socket
+  tooling as suspect and pivot to offline evidence or the dashboard from another
+  host.
 - A `rootkit_hidden_module` names a live kernel module absent from
   `/proc/modules` — strong evidence of an LKM rootkit.
 - A `rootkit_known_module` finding names a module associated with public LKM
@@ -214,7 +232,37 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Sensor tampering
+## Runbook 5 — Credential or input capture
+
+**Triggers:** `credential_access` (100033), `input_snooper` (100032)
+
+These alerts mean a non-allowlisted process has credential material or keyboard
+input devices open. They map to Gonzalo-style keylogging and local credential
+harvesting, but are intentionally behavior-based.
+
+**Confirm**
+
+- Open the snapshot for the alert and inspect the captured `cmdline`, `exe`,
+  `cwd`, parent process, and fd target.
+- For `input_snooper`, confirm whether the process is an expected compositor,
+  display server, input remapper, or accessibility tool. Add stable legitimate
+  process names to `input_snooper_allow_comms`.
+- For `credential_access`, identify which secret was opened: shadow DB, private
+  SSH key, browser credential store, or NetworkManager secret profile. Add
+  only well-understood auth/keyring/browser readers to
+  `credential_access_allow_comms`.
+
+**Contain**
+
+- Preserve evidence first for unknown processes: copy the executable path if it
+  still exists, capture `/proc/<pid>/maps`, and export the incident.
+- Rotate exposed credentials and SSH keys after containment; assume browser
+  session cookies and saved passwords may be compromised if browser stores were
+  opened by an unknown process.
+
+---
+
+## Runbook 6 — Sensor tampering
 
 **Triggers:** `fim_modified` on a Sentinel-owned path (self-integrity), a stale or
 missing heartbeat surfaced by the off-box `watchdog`, or the dashboard going