Poll-based host intrusion-detection daemon modeled on freeze-watcher's
sample→trigger→snapshot→classify loop, with security signatures instead
of performance ones:
- reverse_shell (interpreter with a network socket on stdio)
- ld_preload (/etc/ld.so.preload or LD_PRELOAD in writable dirs)
- deleted_exe (process running from a deleted/memfd binary)
- new_listener (listening port absent from startup baseline)
- new_suid (new SUID/SGID binary; critical in writable dirs)
- persistence (cron/systemd/authorized_keys/rc-file changes)
- suspicious_egress (interpreter holding an outbound public connection)
Each capture writes a forensic snapshot with per-signature incident-
response guidance. Includes a safe, self-cleaning red-team harness
(sentinel-redteam), hardened systemd unit, config, Makefile, and Arch
packaging.
Tested on Arch: detectors fire on drills, no false positives on a clean
sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a
gated filesystem-wide SUID scan.
This bash implementation is retained as the regression oracle for the
forthcoming Python rewrite.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
