enodia-sentinal/docs/RULES.md

Enodia Sentinel Event Rule Reference

Generated from the active exec/syscall/host-event rule defaults plus any configured exec_rules_file entries.

Use enodia-sentinel rules list/show/test to inspect rules and validate event fixtures locally.

Built-in event-rule fixtures live in tests/fixtures/sids/ and can be replayed with enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json. Non-event built-in SIDs are covered by safe offline drills in tests/sid_drills.py; python3 -m unittest tests.test_sid_coverage -v verifies the full registry.

SID 100001: Program executed from a world-writable directory

• Event: exec
• Signature: exec_rule.fileless-execution
• Classtype: fileless-execution
• Severity: CRITICAL
• Origin: builtin

Match fields:

• path_prefixes: /tmp/, /dev/shm/, /var/tmp/

Expected false positives:

• Temporary build or installer helpers intentionally executed from /tmp, /var/tmp, or /dev/shm.
• One-shot administrative diagnostics copied into a writable directory.

Drill or fixture: sentinel-redteam ebpf_exec fires a short-lived writable-path execution event when the eBPF exec monitor is enabled.

SID 100002: Reverse-shell command pattern in execve arguments

• Event: exec
• Signature: exec_rule.c2-reverse-shell
• Classtype: c2-reverse-shell
• Severity: CRITICAL
• Origin: builtin

Match fields:

• argv_regex: /dev/(tcp|udp)/|\b(ba|da|z)?sh\b[^|]*\s-i\b|\bn(c|cat|etcat)\b.*\s-e\b|\bsocat\b.*\bexec|python[0-9.]*\b.*(pty\.spawn|socket\.socket)|perl\b.*\bSocket\b

Expected false positives:

• Security training labs or safe self-tests that intentionally include reverse-shell command text.
• Benign scripts containing literal /dev/tcp or pty.spawn examples in their argv.

Drill or fixture: sentinel-redteam ebpf_exec emits a /dev/tcp argv fixture; rules test can validate a captured exec JSON event offline.

SID 100003: Web/DB service spawned a shell or interpreter (possible RCE/webshell)

• Event: exec
• Signature: exec_rule.web-rce
• Classtype: web-rce
• Severity: CRITICAL
• Origin: builtin

Match fields:

• exec_comm: ash, bash, dash, ksh, lua, nc, ncat, netcat, perl, php, python, python2, python3, ruby, sh, socat, zsh
• parent_comm: apache, apache2, caddy, catalina, httpd, lighttpd, mariadbd, mysqld, nginx, node, nodejs, php, php-fpm, php7, php8, postgres, redis-server, tomcat

Expected false positives:

• Legitimate web applications invoking maintenance scripts through shell wrappers.
• Database or web service containers whose entrypoint intentionally spawns an interpreter.

Drill or fixture: Use rules test with an exec event whose parent_comm is a web/database service and whose filename is an interpreter.

SID 100004: Download piped directly to a shell (ingress tool transfer)

• Event: exec
• Signature: exec_rule.ingress-tool-transfer
• Classtype: ingress-tool-transfer
• Severity: HIGH
• Origin: builtin

Match fields:

• argv_regex: \b(curl|wget|fetch)\b.*\|\s*(ba|da|z)?sh\b

Expected false positives:

• Bootstrap scripts that intentionally pipe downloaded install content into a shell.
• Developer setup tooling run interactively during provisioning.

Drill or fixture: Use rules test with argv like curl http://example.invalid/x | sh.

SID 100060: mprotect made memory writable and executable

• Event: syscall
• Signature: syscall_rule.memory-obfuscation
• Classtype: memory-obfuscation
• Severity: CRITICAL
• Origin: builtin

Match fields:

• syscalls: mprotect
• predicate: built-in predicate

Expected false positives:

• JIT runtimes or emulators that make pages writable and executable.
• Security tooling that deliberately tests W^X policy.

Drill or fixture: Use rules test with syscall mprotect and args[2] containing write+exec permissions, for example 0x6.

SID 100061: mmap requested writable and executable memory

• Event: syscall
• Signature: syscall_rule.memory-obfuscation
• Classtype: memory-obfuscation
• Severity: CRITICAL
• Origin: builtin

Match fields:

• syscalls: mmap
• predicate: built-in predicate

Expected false positives:

• JIT runtimes, emulators, or language VMs that allocate RWX memory.
• Compatibility layers that request executable writable mappings.

Drill or fixture: Use rules test with syscall mmap and args[2] containing write+exec permissions.

SID 100062: memfd_create used for anonymous in-memory file staging

• Event: syscall
• Signature: syscall_rule.fileless-execution
• Classtype: fileless-execution
• Severity: MEDIUM
• Origin: builtin

Match fields:

• syscalls: memfd_create
• predicate: built-in predicate

Expected false positives:

• Browsers, sandbox helpers, and runtimes that legitimately use anonymous memfd files.
• Container or IPC frameworks using memfd as a transport primitive.

Drill or fixture: Use rules test with syscall memfd_create; include text to document the captured name.

SID 100063: ptrace anti-debug or attach operation observed

• Event: syscall
• Signature: syscall_rule.anti-analysis
• Classtype: anti-analysis
• Severity: HIGH
• Origin: builtin

Match fields:

• syscalls: ptrace
• predicate: built-in predicate

Expected false positives:

• Debuggers, profilers, crash handlers, and endpoint tooling that attach to processes.
• Developer sessions running strace, gdb, or similar tracing tools.

Drill or fixture: Use rules test with syscall ptrace and request 16 (PTRACE_ATTACH) or 0x4206 (PTRACE_SEIZE).

SID 100064: seccomp sandboxing call observed (possible anti-analysis hardening)

• Event: syscall
• Signature: syscall_rule.anti-analysis
• Classtype: anti-analysis
• Severity: MEDIUM
• Origin: builtin

Match fields:

• syscalls: prctl, seccomp
• predicate: built-in predicate

Expected false positives:

• Browsers, container runtimes, and sandboxed services enabling seccomp as normal hardening.
• Security test harnesses validating seccomp policy.

Drill or fixture: Use rules test with syscall seccomp, or syscall prctl with arg0 set to 22 (PR_SET_SECCOMP).

SID 100065: cross-process memory read/write syscall observed

• Event: syscall
• Signature: syscall_rule.credential-access
• Classtype: credential-access
• Severity: HIGH
• Origin: builtin

Match fields:

• syscalls: process_vm_readv, process_vm_writev
• predicate: built-in predicate

Expected false positives:

• Debuggers, profilers, memory scanners, and EDR tools inspecting another process.
• Backup or checkpoint tooling that reads process memory intentionally.

Drill or fixture: Use rules test with syscall process_vm_readv or process_vm_writev.

SID 100066: memory locking syscall observed (possible protected in-memory payload)

• Event: syscall
• Signature: syscall_rule.memory-obfuscation
• Classtype: memory-obfuscation
• Severity: MEDIUM
• Origin: builtin

Match fields:

• syscalls: mlock, mlock2, mlockall
• predicate: built-in predicate

Expected false positives:

• Databases, crypto agents, and credential stores locking sensitive memory.
• Realtime or performance-sensitive services using mlock intentionally.

Drill or fixture: Use rules test with syscall mlock, mlock2, or mlockall.

SID 100067: Interpreter connected to an unusual public port

• Event: tcp_connect
• Signature: host_rule.suspicious-egress
• Classtype: suspicious-egress
• Severity: HIGH
• Origin: builtin

Match fields:

• events: tcp_connect
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• peer_public: True
• peer_port_exclude: 22, 53, 80, 123, 443, 853

Expected false positives:

• Interactive admin scripts that intentionally connect to a non-standard public service.
• Developer tooling using interpreters for custom APIs on high ports.

Drill or fixture: Use rules test with a tcp_connect event whose comm is an interpreter and whose public peer_port is not a common service port.

SID 100068: Interpreter opened a listener on an unusual local port

• Event: listen
• Signature: host_rule.suspicious-listener
• Classtype: suspicious-listener
• Severity: HIGH
• Origin: builtin

Match fields:

• events: listen
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• local_port_exclude: 22, 53, 80, 123, 443, 853

Expected false positives:

• Developer HTTP servers, netcat listeners, or local test harnesses intentionally opened from an interpreter.
• Administrative troubleshooting that temporarily listens on a high port.

Drill or fixture: Use rules test with a listen event whose comm is an interpreter and whose local_port is not a common service port.

SID 100069: Interpreter wrote to a persistence path

• Event: file_write
• Signature: host_rule.persistence-write
• Classtype: persistence-write
• Severity: HIGH
• Origin: builtin

Match fields:

• events: file_write
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• path_prefixes: /etc/cron.d/, /etc/crontab, /etc/systemd/system/, /etc/ld.so.preload, /root/.ssh/authorized_keys, /etc/sudoers, /etc/sudoers.d/

Expected false positives:

• Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.
• Administrative SSH-key or service-unit maintenance performed by a reviewed script.

Drill or fixture: Use rules test with tests/fixtures/sids/100069-interpreter-persistence-write.json.

SID 100070: Permissions or ownership changed on a persistence path

• Event: chmod,chown
• Signature: host_rule.persistence-permission-change
• Classtype: persistence-permission-change
• Severity: HIGH
• Origin: builtin

Match fields:

• events: chmod, chown
• path_prefixes: /etc/cron.d/, /etc/crontab, /etc/systemd/system/, /etc/ld.so.preload, /root/.ssh/authorized_keys, /etc/sudoers, /etc/sudoers.d/

Expected false positives:

• Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.
• Manual recovery work that repairs permissions after a known-good change.

Drill or fixture: Use rules test with tests/fixtures/sids/100070-persistence-permission-change.json.

SID 100071: Interpreter requested a root UID transition

• Event: setuid
• Signature: host_rule.privilege-transition
• Classtype: privilege-transition
• Severity: HIGH
• Origin: builtin

Match fields:

• events: setuid
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• target_uids: 0

Expected false positives:

• Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.
• Privileged installer or service-management scripts during maintenance windows.

Drill or fixture: Use rules test with tests/fixtures/sids/100071-interpreter-setuid-root.json.

SID 100072: Interpreter requested a root GID transition

• Event: setgid
• Signature: host_rule.privilege-transition
• Classtype: privilege-transition
• Severity: HIGH
• Origin: builtin

Match fields:

• events: setgid
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• target_gids: 0

Expected false positives:

• Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.
• Privileged installer or service-management scripts during maintenance windows.

Drill or fixture: Use rules test with tests/fixtures/sids/100072-interpreter-setgid-root.json.

SID 100073: Interpreter bound an unusual local port

• Event: bind
• Signature: host_rule.suspicious-bind
• Classtype: suspicious-bind
• Severity: HIGH
• Origin: builtin

Match fields:

• events: bind
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• local_port_exclude: 22, 53, 80, 123, 443, 853

Expected false positives:

• Developer or diagnostic scripts binding high local ports intentionally.
• Short-lived local service wrappers that bind before handing sockets to a supervised process.

Drill or fixture: Use rules test with tests/fixtures/sids/100073-interpreter-unusual-bind.json.

SID 100076: Interpreter accepted inbound traffic on an unusual local port

• Event: accept
• Signature: host_rule.suspicious-accept
• Classtype: suspicious-accept
• Severity: HIGH
• Origin: builtin

Match fields:

• events: accept
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• peer_public: True
• local_port_exclude: 22, 53, 80, 123, 443, 853

Expected false positives:

• Developer servers or test harnesses accepting inbound public traffic from an interpreter.
• Administrative troubleshooting with temporary netcat/socat listeners.

Drill or fixture: Use rules test with tests/fixtures/sids/100076-interpreter-unusual-accept.json.

SID 100077: Interpreter requested sensitive Linux capabilities

• Event: capset
• Signature: host_rule.capability-escalation
• Classtype: capability-escalation
• Severity: HIGH
• Origin: builtin

Match fields:

• events: capset
• comm: ash, bash, curl, dash, fetch, ksh, lua, nc, ncat, netcat, node, nodejs, perl, php, python, python2, python3, ruby, sh, socat, wget, zsh
• capabilities_any: CAP_DAC_READ_SEARCH, CAP_NET_ADMIN, CAP_NET_RAW, CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_SYS_PTRACE

Expected false positives:

• Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.
• Container or network lab setup scripts using interpreters to configure namespaces or packet capture.

Drill or fixture: Use rules test with tests/fixtures/sids/100077-interpreter-capset-sensitive.json.

SID 100078: Kernel module load requested from a writable runtime path

• Event: module_load
• Signature: host_rule.suspicious-module-load
• Classtype: suspicious-module-load
• Severity: CRITICAL
• Origin: builtin

Match fields:

• events: module_load
• path_prefixes: /tmp/, /var/tmp/, /dev/shm/, /run/user/

Expected false positives:

• Kernel development labs loading locally built modules from temporary build directories.
• Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.

Drill or fixture: Use rules test with tests/fixtures/sids/100078-module-load-writable-path.json.