Server / host

Permissions, SUID/SGID, exposed services and secrets on the host — read-only, with host access authorized by the operator.

Family facts

Code: FAM-HOST
Status: ready — code maturity
Availability: available — whether it is offerable
Ingest: host — how a target enters
Rules of Engagement: Not required
Kind: Family (a selectable assessment)

What it decides

Whether a host’s permissions, privileged binaries, exposed services or stored secrets create an exploitable local exposure.

How it works

With operator-authorized, read-only access it inspects file permissions, unexpected SUID/SGID binaries, world-accessible sensitive files, broadly exposed services, and secrets in readable files.

It is strictly host-recon; privileged runtime behaviour (live sensor alerts) is not part of this family and belongs to Runtime behaviour.

Declared limits

Note

Read-only, operator-authorized (the caller provides the backend and credential); Linux only; benchmarked on captured host state.

References

[1]CIS Benchmarks

References point to public, well-known technical sources for further study.

Container / infra / cloud

ready · available

Network

beta · partial

Runtime behaviour

beta · partial

Forensic postmortem (DFIR)

beta · partial

How the catalog works

Families, states and the honesty guard.