luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand monitoring for credential theft and covert protocols

Browse source
This commit is contained in:
Luna 2026-06-13 03:30:36 -07:00
parent 3e5f8fc3f7
commit cb334c0c94
17 changed files with 675 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

6
enodia_sentinel/detectors/__init__.py
View file

@ -15,13 +15,16 @@ from ..alert import Alert
from ..config import Config
from ..system import SystemState
from . import (
credential_access,
deleted_exe,
egress,
input_snooper,
ld_preload,
new_listener,
new_suid,
persistence,
reverse_shell,
stealth_network,
)
DetectFn = Callable[[SystemState, Config], Iterable[Alert]]
@ -40,6 +43,9 @@ REGISTRY: tuple[Detector, ...] = (
Detector("reverse_shell", reverse_shell.detect),
Detector("ld_preload", ld_preload.detect),
Detector("deleted_exe", deleted_exe.detect),
Detector("input_snooper", input_snooper.detect),
Detector("credential_access", credential_access.detect),
Detector("stealth_network", stealth_network.detect),
Detector("egress", egress.detect),
Detector("new_listener", new_listener.detect, needs_baseline=True),
Detector("persistence", persistence.detect, needs_baseline=True),