Expand monitoring for credential theft and covert protocols

enodia_sentinel/detectors/credential_access.py

@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""credential_access — live process has sensitive credential files open.
+
+This catches credential harvesters that open shadow databases, private SSH
+keys, browser credential stores, or NetworkManager secret material during a
+poll sweep. Legitimate auth agents and browsers are configurable allow-list
+entries so the rule can stay enabled on desktops.
+"""
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+from ..alert import Alert, Severity
+from ..config import Config
+from ..system import SystemState
+
+SID_CREDENTIAL_ACCESS = 100033
+
+_EXACT_FILES = frozenset({
+    "/etc/shadow",
+    "/etc/gshadow",
+    "/etc/security/opasswd",
+})
+
+_BROWSER_SECRET_NAMES = frozenset({
+    "logins.json",
+    "key4.db",
+    "Login Data",
+    "Cookies",
+})
+
+
+def _fd_targets(proc) -> dict[str, str]:
+    targets = getattr(proc, "fd_targets", {})
+    return targets() if callable(targets) else targets
+
+
+def _clean_target(target: str) -> str:
+    return target.removesuffix(" (deleted)")
+
+
+def _matches_extra(path: str, entries: tuple[str, ...]) -> bool:
+    for entry in entries:
+        if not entry:
+            continue
+        if entry.endswith("/") and path.startswith(entry):
+            return True
+        if path == entry or path.startswith(entry.rstrip("/") + "/"):
+            return True
+    return False
+
+
+def _sensitive_kind(path: str, cfg: Config) -> str:
+    if not path.startswith("/"):
+        return ""
+    if path in _EXACT_FILES:
+        return "system credential database"
+    if _matches_extra(path, cfg.credential_access_extra_paths):
+        return "configured credential path"
+    if "/.ssh/" in path:
+        name = path.rsplit("/", 1)[-1]
+        if name.startswith("id_") or name.endswith(".pem") or name.endswith(".key"):
+            return "private SSH key"
+    if path.startswith("/etc/NetworkManager/system-connections/"):
+        return "NetworkManager secret profile"
+    name = path.rsplit("/", 1)[-1]
+    if name in _BROWSER_SECRET_NAMES:
+        lowered = path.lower()
+        if any(marker in lowered for marker in (
+            "/.mozilla/", "/firefox/", "/chromium/", "/google-chrome/",
+            "/chrome/", "/brave", "/vivaldi/", "/edge/",
+        )):
+            return "browser credential store"
+    return ""
+
+
+def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
+    for proc in state.processes:
+        comm = proc.comm or "?"
+        if comm in cfg.credential_access_allow_comms:
+            continue
+        for fd, raw_target in _fd_targets(proc).items():
+            target = _clean_target(raw_target)
+            kind = _sensitive_kind(target, cfg)
+            if not kind:
+                continue
+            yield Alert(
+                severity=Severity.CRITICAL,
+                signature="credential_access",
+                key=f"cred:{proc.pid}:{target}",
+                detail=(
+                    f"pid={proc.pid} comm={comm} fd={fd} has {kind} open: "
+                    f"{target}"
+                ),
+                pids=(proc.pid,),
+                sid=SID_CREDENTIAL_ACCESS,
+                classtype="credential-theft",
+            )
+            break