# Enodia Sentinel Event Rule Reference

Generated from the active exec/syscall/host-event rule defaults plus any configured `exec_rules_file` entries.

Use `enodia-sentinel rules list/show/test` to inspect rules and validate event fixtures locally.

Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed
with `enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json`.
Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;
`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.

## SID 100001: Program executed from a world-writable directory

- Event: `exec`
- Signature: `exec_rule.fileless-execution`
- Classtype: `fileless-execution`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `path_prefixes`: `/tmp/`, `/dev/shm/`, `/var/tmp/`

Expected false positives:
- Temporary build or installer helpers intentionally executed from `/tmp`, `/var/tmp`, or `/dev/shm`.
- One-shot administrative diagnostics copied into a writable directory.

Drill or fixture: `sentinel-redteam ebpf_exec` fires a short-lived writable-path execution event when the eBPF exec monitor is enabled.

## SID 100002: Reverse-shell command pattern in execve arguments

- Event: `exec`
- Signature: `exec_rule.c2-reverse-shell`
- Classtype: `c2-reverse-shell`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `argv_regex`: `/dev/(tcp|udp)/|\b(ba|da|z)?sh\b[^|]*\s-i\b|\bn(c|cat|etcat)\b.*\s-e\b|\bsocat\b.*\bexec|python[0-9.]*\b.*(pty\.spawn|socket\.socket)|perl\b.*\bSocket\b`

Expected false positives:
- Security training labs or safe self-tests that intentionally include reverse-shell command text.
- Benign scripts containing literal `/dev/tcp` or `pty.spawn` examples in their argv.

Drill or fixture: `sentinel-redteam ebpf_exec` emits a `/dev/tcp` argv fixture; `rules test` can validate a captured exec JSON event offline.

## SID 100003: Web/DB service spawned a shell or interpreter (possible RCE/webshell)

- Event: `exec`
- Signature: `exec_rule.web-rce`
- Classtype: `web-rce`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `exec_comm`: `ash`, `bash`, `dash`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `zsh`
- `parent_comm`: `apache`, `apache2`, `caddy`, `catalina`, `httpd`, `lighttpd`, `mariadbd`, `mysqld`, `nginx`, `node`, `nodejs`, `php`, `php-fpm`, `php7`, `php8`, `postgres`, `redis-server`, `tomcat`

Expected false positives:
- Legitimate web applications invoking maintenance scripts through shell wrappers.
- Database or web service containers whose entrypoint intentionally spawns an interpreter.

Drill or fixture: Use `rules test` with an exec event whose `parent_comm` is a web/database service and whose `filename` is an interpreter.

## SID 100004: Download piped directly to a shell (ingress tool transfer)

- Event: `exec`
- Signature: `exec_rule.ingress-tool-transfer`
- Classtype: `ingress-tool-transfer`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `argv_regex`: `\b(curl|wget|fetch)\b.*\|\s*(ba|da|z)?sh\b`

Expected false positives:
- Bootstrap scripts that intentionally pipe downloaded install content into a shell.
- Developer setup tooling run interactively during provisioning.

Drill or fixture: Use `rules test` with argv like `curl http://example.invalid/x | sh`.

## SID 100060: mprotect made memory writable and executable

- Event: `syscall`
- Signature: `syscall_rule.memory-obfuscation`
- Classtype: `memory-obfuscation`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `syscalls`: `mprotect`
- `predicate`: `built-in predicate`

Expected false positives:
- JIT runtimes or emulators that make pages writable and executable.
- Security tooling that deliberately tests W^X policy.

Drill or fixture: Use `rules test` with syscall `mprotect` and `args[2]` containing write+exec permissions, for example `0x6`.

## SID 100061: mmap requested writable and executable memory

- Event: `syscall`
- Signature: `syscall_rule.memory-obfuscation`
- Classtype: `memory-obfuscation`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `syscalls`: `mmap`
- `predicate`: `built-in predicate`

Expected false positives:
- JIT runtimes, emulators, or language VMs that allocate RWX memory.
- Compatibility layers that request executable writable mappings.

Drill or fixture: Use `rules test` with syscall `mmap` and `args[2]` containing write+exec permissions.

## SID 100062: memfd_create used for anonymous in-memory file staging

- Event: `syscall`
- Signature: `syscall_rule.fileless-execution`
- Classtype: `fileless-execution`
- Severity: `MEDIUM`
- Origin: `builtin`

Match fields:
- `syscalls`: `memfd_create`
- `predicate`: `built-in predicate`

Expected false positives:
- Browsers, sandbox helpers, and runtimes that legitimately use anonymous memfd files.
- Container or IPC frameworks using memfd as a transport primitive.

Drill or fixture: Use `rules test` with syscall `memfd_create`; include `text` to document the captured name.

## SID 100063: ptrace anti-debug or attach operation observed

- Event: `syscall`
- Signature: `syscall_rule.anti-analysis`
- Classtype: `anti-analysis`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `syscalls`: `ptrace`
- `predicate`: `built-in predicate`

Expected false positives:
- Debuggers, profilers, crash handlers, and endpoint tooling that attach to processes.
- Developer sessions running `strace`, `gdb`, or similar tracing tools.

Drill or fixture: Use `rules test` with syscall `ptrace` and request `16` (`PTRACE_ATTACH`) or `0x4206` (`PTRACE_SEIZE`).

## SID 100064: seccomp sandboxing call observed (possible anti-analysis hardening)

- Event: `syscall`
- Signature: `syscall_rule.anti-analysis`
- Classtype: `anti-analysis`
- Severity: `MEDIUM`
- Origin: `builtin`

Match fields:
- `syscalls`: `prctl`, `seccomp`
- `predicate`: `built-in predicate`

Expected false positives:
- Browsers, container runtimes, and sandboxed services enabling seccomp as normal hardening.
- Security test harnesses validating seccomp policy.

Drill or fixture: Use `rules test` with syscall `seccomp`, or syscall `prctl` with `arg0` set to `22` (`PR_SET_SECCOMP`).

## SID 100065: cross-process memory read/write syscall observed

- Event: `syscall`
- Signature: `syscall_rule.credential-access`
- Classtype: `credential-access`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `syscalls`: `process_vm_readv`, `process_vm_writev`
- `predicate`: `built-in predicate`

Expected false positives:
- Debuggers, profilers, memory scanners, and EDR tools inspecting another process.
- Backup or checkpoint tooling that reads process memory intentionally.

Drill or fixture: Use `rules test` with syscall `process_vm_readv` or `process_vm_writev`.

## SID 100066: memory locking syscall observed (possible protected in-memory payload)

- Event: `syscall`
- Signature: `syscall_rule.memory-obfuscation`
- Classtype: `memory-obfuscation`
- Severity: `MEDIUM`
- Origin: `builtin`

Match fields:
- `syscalls`: `mlock`, `mlock2`, `mlockall`
- `predicate`: `built-in predicate`

Expected false positives:
- Databases, crypto agents, and credential stores locking sensitive memory.
- Realtime or performance-sensitive services using `mlock` intentionally.

Drill or fixture: Use `rules test` with syscall `mlock`, `mlock2`, or `mlockall`.

## SID 100067: Interpreter connected to an unusual public port

- Event: `tcp_connect`
- Signature: `host_rule.suspicious-egress`
- Classtype: `suspicious-egress`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `tcp_connect`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `peer_public`: `True`
- `peer_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`

Expected false positives:
- Interactive admin scripts that intentionally connect to a non-standard public service.
- Developer tooling using interpreters for custom APIs on high ports.

Drill or fixture: Use `rules test` with a `tcp_connect` event whose `comm` is an interpreter and whose public `peer_port` is not a common service port.

## SID 100068: Interpreter opened a listener on an unusual local port

- Event: `listen`
- Signature: `host_rule.suspicious-listener`
- Classtype: `suspicious-listener`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `listen`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`

Expected false positives:
- Developer HTTP servers, netcat listeners, or local test harnesses intentionally opened from an interpreter.
- Administrative troubleshooting that temporarily listens on a high port.

Drill or fixture: Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.

## SID 100069: Interpreter wrote to a persistence path

- Event: `file_write`
- Signature: `host_rule.persistence-write`
- Classtype: `persistence-write`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `file_write`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`

Expected false positives:
- Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.
- Administrative SSH-key or service-unit maintenance performed by a reviewed script.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100069-interpreter-persistence-write.json`.

## SID 100070: Permissions or ownership changed on a persistence path

- Event: `chmod,chown`
- Signature: `host_rule.persistence-permission-change`
- Classtype: `persistence-permission-change`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `chmod`, `chown`
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`

Expected false positives:
- Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.
- Manual recovery work that repairs permissions after a known-good change.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100070-persistence-permission-change.json`.

## SID 100071: Interpreter requested a root UID transition

- Event: `setuid`
- Signature: `host_rule.privilege-transition`
- Classtype: `privilege-transition`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `setuid`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `target_uids`: `0`

Expected false positives:
- Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.
- Privileged installer or service-management scripts during maintenance windows.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100071-interpreter-setuid-root.json`.

## SID 100072: Interpreter requested a root GID transition

- Event: `setgid`
- Signature: `host_rule.privilege-transition`
- Classtype: `privilege-transition`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `setgid`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `target_gids`: `0`

Expected false positives:
- Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.
- Privileged installer or service-management scripts during maintenance windows.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.

## SID 100073: Interpreter bound an unusual local port

- Event: `bind`
- Signature: `host_rule.suspicious-bind`
- Classtype: `suspicious-bind`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `bind`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`

Expected false positives:
- Developer or diagnostic scripts binding high local ports intentionally.
- Short-lived local service wrappers that bind before handing sockets to a supervised process.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100073-interpreter-unusual-bind.json`.

## SID 100076: Interpreter accepted inbound traffic on an unusual local port

- Event: `accept`
- Signature: `host_rule.suspicious-accept`
- Classtype: `suspicious-accept`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `accept`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `peer_public`: `True`
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`

Expected false positives:
- Developer servers or test harnesses accepting inbound public traffic from an interpreter.
- Administrative troubleshooting with temporary netcat/socat listeners.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100076-interpreter-unusual-accept.json`.

## SID 100077: Interpreter requested sensitive Linux capabilities

- Event: `capset`
- Signature: `host_rule.capability-escalation`
- Classtype: `capability-escalation`
- Severity: `HIGH`
- Origin: `builtin`

Match fields:
- `events`: `capset`
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
- `capabilities_any`: `CAP_DAC_READ_SEARCH`, `CAP_NET_ADMIN`, `CAP_NET_RAW`, `CAP_SYS_ADMIN`, `CAP_SYS_MODULE`, `CAP_SYS_PTRACE`

Expected false positives:
- Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.
- Container or network lab setup scripts using interpreters to configure namespaces or packet capture.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100077-interpreter-capset-sensitive.json`.

## SID 100078: Kernel module load requested from a writable runtime path

- Event: `module_load`
- Signature: `host_rule.suspicious-module-load`
- Classtype: `suspicious-module-load`
- Severity: `CRITICAL`
- Origin: `builtin`

Match fields:
- `events`: `module_load`
- `path_prefixes`: `/tmp/`, `/var/tmp/`, `/dev/shm/`, `/run/user/`

Expected false positives:
- Kernel development labs loading locally built modules from temporary build directories.
- Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.

Drill or fixture: Use `rules test` with `tests/fixtures/sids/100078-module-load-writable-path.json`.