Expand monitoring for credential theft and covert protocols

tests/test_detectors.py

@@ -6,7 +6,9 @@ from dataclasses import dataclass, field
 from enodia_sentinel.alert import Severity
 from enodia_sentinel.config import Config
 from enodia_sentinel.detectors import (
-    deleted_exe, egress, ld_preload, new_listener, new_suid, reverse_shell,
+    credential_access, deleted_exe, egress, input_snooper, ld_preload,
+    new_listener, new_suid, reverse_shell,
+    stealth_network,
 )
 from enodia_sentinel.system import Socket, SystemState
 
@@ -23,6 +25,7 @@ class FakeProc:
     ppid: int = 1
     uid: int = 0
     cwd: str = "/"
+    fd_targets: dict = field(default_factory=dict)
 
     def stdio_socket_inode(self):
         return self._stdio_inode
@@ -90,6 +93,71 @@ class TestDeletedExe(unittest.TestCase):
         self.assertEqual(list(deleted_exe.detect(state, cfg())), [])
 
 
+class TestInputSnooper(unittest.TestCase):
+    def test_input_device_alerts(self):
+        proc = FakeProc(pid=320, comm="hoxha",
+                        fd_targets={"7": "/dev/input/event3"})
+        alerts = list(input_snooper.detect(SystemState(processes=[proc]), cfg()))
+        self.assertEqual(len(alerts), 1)
+        self.assertEqual(alerts[0].signature, "input_snooper")
+        self.assertEqual(alerts[0].severity, Severity.HIGH)
+
+    def test_allowlisted_input_process_ignored(self):
+        proc = FakeProc(pid=321, comm="Xorg",
+                        fd_targets={"7": "/dev/input/event3"})
+        self.assertEqual(list(input_snooper.detect(SystemState(processes=[proc]), cfg())), [])
+
+
+class TestCredentialAccess(unittest.TestCase):
+    def test_shadow_access_alerts(self):
+        proc = FakeProc(pid=330, comm="hoxha",
+                        fd_targets={"4": "/etc/shadow"})
+        alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg()))
+        self.assertEqual(len(alerts), 1)
+        self.assertEqual(alerts[0].signature, "credential_access")
+        self.assertEqual(alerts[0].severity, Severity.CRITICAL)
+
+    def test_private_key_access_alerts(self):
+        proc = FakeProc(pid=331, comm="collector",
+                        fd_targets={"5": "/home/luna/.ssh/id_ed25519"})
+        alerts = list(credential_access.detect(SystemState(processes=[proc]), cfg()))
+        self.assertEqual(len(alerts), 1)
+        self.assertIn("private SSH key", alerts[0].detail)
+
+    def test_browser_access_by_browser_ignored(self):
+        proc = FakeProc(
+            pid=332, comm="firefox",
+            fd_targets={"8": "/home/luna/.mozilla/firefox/a/key4.db"},
+        )
+        self.assertEqual(list(credential_access.detect(SystemState(processes=[proc]), cfg())), [])
+
+
+class TestStealthNetwork(unittest.TestCase):
+    def test_sctp_public_peer_alerts(self):
+        sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:4443",
+                      1, "hoxha", 340, "sctp")
+        alerts = list(stealth_network.detect(SystemState(sockets=[sock]), cfg()))
+        self.assertEqual(len(alerts), 1)
+        self.assertEqual(alerts[0].signature, "stealth_network")
+        self.assertEqual(alerts[0].severity, Severity.HIGH)
+
+    def test_packet_socket_allowlisted_comm_ignored(self):
+        sock = Socket("UNCONN", "*:eth0", "*", 1, "tcpdump", 341, "packet")
+        self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), [])
+
+    def test_allowlisted_kind_ignored(self):
+        c = Config()
+        c.stealth_network_allow_kinds = frozenset({"mptcp"})
+        sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443",
+                      1, "curl", 342, "mptcp")
+        self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), c)), [])
+
+    def test_tcp_ignored(self):
+        sock = Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443",
+                      1, "python3", 343, "tcp")
+        self.assertEqual(list(stealth_network.detect(SystemState(sockets=[sock]), cfg())), [])
+
+
 class TestNewSuid(unittest.TestCase):
     def test_new_in_writable_is_critical(self):
         state = SystemState(