Expand monitoring for credential theft and covert protocols

enodia_sentinel/config.py

@@ -26,6 +26,7 @@ _DEFAULT_WATCH = (
 
 _ALL_DETECTORS = (
     "reverse_shell", "ld_preload", "deleted_exe",
+    "input_snooper", "credential_access", "stealth_network",
     "new_listener", "new_suid", "persistence", "egress",
 )
 
@@ -60,6 +61,31 @@ class Config:
         "/tmp", "/dev/shm", "/var/tmp", "/run/user",
     )
     watch_persistence: tuple[str, ...] = _DEFAULT_WATCH
+    # Processes expected to hold keyboard/HID event devices open.
+    input_snooper_allow_comms: frozenset[str] = frozenset((
+        "Xorg", "Xwayland", "gnome-shell", "kwin_wayland", "sway",
+        "Hyprland", "systemd-logind", "input-remapper", "keyd", "kanata",
+    ))
+    # Processes expected to read credential stores as part of normal auth or
+    # user interaction. Malware harvesting those same files under another comm
+    # still alerts.
+    credential_access_allow_comms: frozenset[str] = frozenset((
+        "sshd", "sudo", "su", "login", "gdm-session-worker", "polkitd",
+        "gnome-keyring-daemon", "kwalletd5", "kwalletd6", "firefox",
+        "chromium", "chrome", "google-chrome", "brave", "brave-browser",
+    ))
+    # Extra exact paths or directory prefixes treated as credential material.
+    credential_access_extra_paths: tuple[str, ...] = ()
+    # Expected owners of packet/raw/special protocol sockets. Keep tight: these
+    # families are common in sniffers, tunnels, and covert channels.
+    stealth_network_allow_comms: frozenset[str] = frozenset((
+        "NetworkManager", "systemd-networkd", "wpa_supplicant", "dhcpcd",
+        "tcpdump", "dumpcap", "wireshark", "suricata", "zeek",
+    ))
+    # Socket family names to ignore entirely, e.g. ["mptcp"] if your host uses
+    # it legitimately. Valid observed kinds include raw, sctp, dccp, packet,
+    # mptcp, tipc, xdp, and vsock.
+    stealth_network_allow_kinds: frozenset[str] = frozenset()
 
     # file integrity monitoring (FIM)
     fim_enabled: bool = True