131 lines
6 KiB
Python
131 lines
6 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Canonical registry of every built-in SID.
|
|
|
|
Aggregates the constants where they are defined; nothing is renumbered or
|
|
moved. The core poll detectors carry some SIDs inline in the Alert they build,
|
|
so those rows are tabulated here and cross-checked by tests.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
from . import fim, pkgdb, posture, rootcheck
|
|
from .detectors import (
|
|
credential_access,
|
|
input_snooper,
|
|
memory_obfuscation,
|
|
stealth_network,
|
|
)
|
|
from .events.rules import DEFAULT_EXEC_RULES
|
|
from .events.host_rules import DEFAULT_HOST_RULES
|
|
from .events.syscall_rules import DEFAULT_SYSCALL_RULES
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class SidInfo:
|
|
sid: int
|
|
name: str
|
|
engine: str
|
|
module: str
|
|
|
|
|
|
def _rule_rows(rules, engine: str, module: str) -> tuple[SidInfo, ...]:
|
|
return tuple(
|
|
SidInfo(r.sid, f"{engine}.{r.classtype}", engine, module)
|
|
for r in rules
|
|
)
|
|
|
|
|
|
_DETECTORS = "enodia_sentinel.detectors"
|
|
|
|
BUILTIN_SIDS: tuple[SidInfo, ...] = (
|
|
*_rule_rows(DEFAULT_EXEC_RULES, "exec_rule",
|
|
"enodia_sentinel.events.rules"),
|
|
*_rule_rows(DEFAULT_SYSCALL_RULES, "syscall_rule",
|
|
"enodia_sentinel.events.syscall_rules"),
|
|
*_rule_rows(DEFAULT_HOST_RULES, "host_rule",
|
|
"enodia_sentinel.events.host_rules"),
|
|
SidInfo(100010, "reverse_shell", "detector", f"{_DETECTORS}.reverse_shell"),
|
|
SidInfo(100011, "ld_preload", "detector", f"{_DETECTORS}.ld_preload"),
|
|
SidInfo(100012, "deleted_exe", "detector", f"{_DETECTORS}.deleted_exe"),
|
|
SidInfo(100013, "new_listener", "detector", f"{_DETECTORS}.new_listener"),
|
|
SidInfo(100014, "new_suid", "detector", f"{_DETECTORS}.new_suid"),
|
|
SidInfo(100015, "persistence", "detector", f"{_DETECTORS}.persistence"),
|
|
SidInfo(100016, "egress", "detector", f"{_DETECTORS}.egress"),
|
|
SidInfo(input_snooper.SID_INPUT_SNOOPER, "input_snooper", "detector",
|
|
f"{_DETECTORS}.input_snooper"),
|
|
SidInfo(credential_access.SID_CREDENTIAL_ACCESS, "credential_access",
|
|
"detector", f"{_DETECTORS}.credential_access"),
|
|
SidInfo(stealth_network.SID_STEALTH_NETWORK, "stealth_network",
|
|
"detector", f"{_DETECTORS}.stealth_network"),
|
|
SidInfo(memory_obfuscation.SID_MEMORY_OBFUSCATION, "memory_obfuscation",
|
|
"detector", f"{_DETECTORS}.memory_obfuscation"),
|
|
SidInfo(memory_obfuscation.SID_PROCESS_HIDING_LIBRARY,
|
|
"process_hiding_library", "detector",
|
|
f"{_DETECTORS}.memory_obfuscation"),
|
|
SidInfo(memory_obfuscation.SID_PROCESS_INJECTION_LIBRARY,
|
|
"process_injection_library", "detector",
|
|
f"{_DETECTORS}.memory_obfuscation"),
|
|
SidInfo(fim.SID_MODIFIED, "fim_modified", "fim", "enodia_sentinel.fim"),
|
|
SidInfo(fim.SID_ADDED, "fim_added", "fim", "enodia_sentinel.fim"),
|
|
SidInfo(fim.SID_REMOVED, "fim_removed", "fim", "enodia_sentinel.fim"),
|
|
SidInfo(fim.SID_PKG, "pkg_verify_mismatch", "fim", "enodia_sentinel.fim"),
|
|
SidInfo(pkgdb.SID_PKGDB, "pkgdb_tamper", "pkgdb", "enodia_sentinel.pkgdb"),
|
|
SidInfo(pkgdb.SID_SIGLEVEL, "pacman_siglevel_disabled", "pkgdb",
|
|
"enodia_sentinel.pkgdb"),
|
|
SidInfo(pkgdb.SID_PKGVERIFY, "pkg_signature_mismatch", "pkgdb",
|
|
"enodia_sentinel.pkgdb"),
|
|
SidInfo(rootcheck.SID_HIDDEN_PROC, "rootkit_hidden_process", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_HIDDEN_MODULE, "rootkit_hidden_module", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_HIDDEN_PORT, "rootkit_hidden_port", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_PROMISC, "promiscuous_interface", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_KNOWN_ROOTKIT_MODULE, "rootkit_known_module",
|
|
"rootcheck", "enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_TAINTED_MODULE, "rootkit_tainted_module",
|
|
"rootcheck", "enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_KERNEL_TAINTED, "kernel_tainted", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_HIDDEN_UDP_PORT, "rootkit_hidden_udp_port",
|
|
"rootcheck", "enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_HIDDEN_RAW_SOCKET, "rootkit_hidden_raw_socket",
|
|
"rootcheck", "enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_RAW_ICMP_SOCKET, "raw_icmp_socket", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_HIDDEN_PROTOCOL_SOCKET,
|
|
"rootkit_hidden_protocol_socket", "rootcheck",
|
|
"enodia_sentinel.rootcheck"),
|
|
SidInfo(rootcheck.SID_PS_HIDDEN_PROCESS, "rootkit_ps_hidden_process",
|
|
"rootcheck", "enodia_sentinel.rootcheck"),
|
|
SidInfo(posture.SID_SSH_ROOT_LOGIN, "ssh_root_login", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SSH_PASSWORD_AUTH, "ssh_password_auth", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SSH_EMPTY_PASSWORD, "ssh_empty_password", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SUDO_NOPASSWD, "sudo_nopasswd", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SUDO_NOAUTH, "sudo_no_authenticate", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SUDOERS_WRITABLE, "sudoers_writable", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_PATH_WRITABLE, "path_writable", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SENSITIVE_FILE_PERM, "sensitive_file_perm", "posture",
|
|
"enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SYSTEMD_UNIT_WRITABLE, "systemd_unit_writable",
|
|
"posture", "enodia_sentinel.posture"),
|
|
SidInfo(posture.SID_SYSTEMD_EXEC_UNSAFE, "systemd_exec_unsafe", "posture",
|
|
"enodia_sentinel.posture"),
|
|
)
|
|
|
|
|
|
def all_sids() -> frozenset[int]:
|
|
return frozenset(s.sid for s in BUILTIN_SIDS)
|
|
|
|
|
|
def engine_sids(engine: str) -> frozenset[int]:
|
|
return frozenset(s.sid for s in BUILTIN_SIDS if s.engine == engine)
|