Skip to content

Rustinel v1.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Oct 08:50
· 75 commits to main since this release
v1.9.0
d709ab2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Broader file and memory detection.
    YARA scans qualifying written files on Linux, macOS, and Windows, plus Linux heap and stack mappings and memfd executables.
    macOS memory scans classify each VM region by its own mapping and exclude the dyld shared cache from private-memory scan budgets.
    Written-file inspection uses an 8,192-job queue and an 8,192-target settling table, with bounded reclamation of vanished paths and separate capacity for process and loaded-image resolution.
    Linux resolves process artifacts within their mount namespace, including container paths.
  • More Windows telemetry.
    Classic PowerShell starts, Application and Defender Operational channels, and WMI permanent subscription events expand Sigma coverage.
  • More control over Sigma detection.
    Set scanner.sigma_match_mode = "all" to emit every matching detection rule, and use per-rule compatibility diagnostics to identify unsupported fields.
    Correlation buffers flush on timers and shutdown, while field lookup and CIDR IOC matching use faster indexed paths.
  • Safer updates and privileged inputs.
    Binary updates verify signed release checksums, rule-pack installs verify signed catalogs, and configuration and rule inputs are checked for unsafe write permissions.
    Managed installation and logging paths receive tighter permissions, and active response validates and terminates through one process handle.
  • More reliable service operation.
    Critical worker failures terminate the agent for service-manager recovery, Windows service recovery can be configured during installation, and Unix stop signals drain pending work.
    Superseded process identities are retired on exec, startup diagnostics distinguish detector readiness, and alert writer drops are counted and reported.
    rustinel doctor warns explicitly when dropped written-file jobs leave a YARA and hash IOC detection gap.

Upgrade notes

  • Updating: run rustinel update or install 1.9.0 explicitly with the installer version option.
    Restart the service after replacing the binary, then run rustinel doctor and verify a known detection before broad deployment.
  • Configuration validation: unknown sections or options, including EDR__ environment variables, and invalid active-response settings stop startup.
    Remove obsolete keys and correct reported configuration errors before upgrading managed hosts.
  • Input and output permissions: configuration and rule inputs must not be writable by untrusted accounts.
    Check custom deployment paths with rustinel doctor; unsafe configuration stops startup, and unsafe rule inputs leave the affected detector unloaded at startup or preserve its previous rules during reload.
    Log and capture output permissions are restricted to their owner.
  • YARA severity and active response: file and process-memory alerts use the first valid rule metadata value from severity, level, then score.
    Rules without recognized metadata default to high instead of critical, and active response uses the resulting alert severity.
    Deployments with response.min_severity = "critical" must add severity = "critical" to rules intended to trigger response, or lower the response threshold after reviewing their rules.
  • Signed downloads: custom rule catalogs must include a valid signature from the trusted release key.
    Binary updates also require signed checksum assets; missing or invalid signatures stop replacement.
  • Windows written-file scanning: the file ID is read from the path when the scan is queued, because Kernel-File ETW events carry none.
    Files on network volumes are not scanned and are counted under artifact_resolver.identity_unavailable.
  • Written-file scanning remains bounded.
    Files settle for 250 ms, with at most 8,192 pending targets and 8,192 queued jobs.
    Each new target arriving at table capacity checks up to 64 pending paths for disappearance, continuing from the previous check.
    If the queue is full or no slot is reclaimed, its scan is shed and counted under artifact_resolver.written_file_dropped; base file telemetry and Sigma evaluation still run.
  • Linux process artifacts: container artifacts require a confirmed mount namespace and matching process lifetime.
    Script content is a worker-time snapshot, and files replaced before inspection are rejected.
  • Compatibility tooling: the field-availability contract uses schema version 3 with an explicit field view.
    Update consumers that validate this schema, and review alert volume before enabling all-matches Sigma mode or additional Windows event sources.

Downloads

Platform Architecture Package
Linux x86_64 rustinel-1.9.0-x86_64-unknown-linux-musl.tar.gz
Linux arm64 rustinel-1.9.0-aarch64-unknown-linux-musl.tar.gz
Windows x86_64 rustinel-1.9.0-x86_64-pc-windows-msvc.zip
macOS arm64 rustinel-1.9.0-aarch64-apple-darwin.tar.gz
macOS x86_64 rustinel-1.9.0-x86_64-apple-darwin.tar.gz

Installer

Linux and macOS

curl -fsSL https://rustinel.io/install.sh | sh -s -- --version 1.9.0
cd rustinel
sudo ./rustinel run

macOS support is experimental. Grant Full Disk Access before the first run: https://docs.rustinel.io/macos-permissions/

Windows (elevated PowerShell)

$env:RUSTINEL_VERSION='1.9.0'; irm https://rustinel.io/install.ps1 | iex; Remove-Item Env:\RUSTINEL_VERSION -ErrorAction SilentlyContinue
Set-Location rustinel
.\rustinel.exe run

Quickstart, configuration, and SIEM guides: https://docs.rustinel.io/getting-started/

Scripts install published release binaries only. Verify downloads with the signed rustinel-1.9.0-checksums-sha256.txt and its .minisig file.

Provenance

All release artifacts have SLSA build provenance attestations signed by GitHub:

gh attestation verify <artifact> \
  --repo Karib0u/rustinel \
  --signer-workflow Karib0u/rustinel/.github/workflows/release.yml

What's Changed

Breaking Changes

  • fix(config): reject unknown keys and invalid response settings by @Karib0u in #610
  • fix(logging): protect log and capture output paths by @Karib0u in #618
  • feat(update): verify signed release checksums and rules catalog by @Karib0u in #623
  • fix(yara): honor rule severity metadata by @Karib0u in #675

Performance

  • perf(ioc): index CIDR indicators by @Karib0u in #572
  • perf(ioc): avoid allocation-heavy match deduplication by @Karib0u in #590
  • perf(engine): stop re-resolving field contracts on every Sigma read by @Karib0u in #667
  • fix(artifact): isolate image resolution from written-file pressure by @Karib0u in #681
  • fix(state): retire stale process identities on exec by @Karib0u in #690
  • fix(yara): preserve persistent-file scans after churn bursts by @Karib0u in #692

Features

  • feat(sigma): add per-rule compatibility diagnostics by @Karib0u in #585
  • feat(yara): scan qualifying written files by @Karib0u in #586
  • feat(engine): add an all-matches Sigma alert mode by @Karib0u in #587
  • feat(windows-eventlog): add ps_classic_start via classic PowerShell channel by @Karib0u in #589
  • feat(windows-eventlog): add Application channel source by @Karib0u in #592
  • feat(windows-eventlog): collect Defender Operational events by @Karib0u in #593
  • feat(windows-etw): collect WMI permanent subscription events by @Karib0u in #594

Bug Fixes

  • fix(workflows): use self-repository syntax by @Karib0u in #571
  • fix(windows): handle benign ETW diagnostics by @Karib0u in #574
  • fix(logging): keep console output actionable by @Karib0u in #575
  • fix(startup): report detector readiness accurately by @Karib0u in #576
  • fix(nix): update release pin to 1.8.0 by @Karib0u in #588
  • fix(test): stabilize macOS artifact timeout check by @Karib0u in #591
  • fix(runtime): drain on Unix service stop signals by @Karib0u in #608
  • fix(unix-setup): protect managed config and macOS binary path by @Karib0u in #624
  • fix(alerts): count and report alert writer drops by @Karib0u in #625
  • fix(runtime): restart after critical worker failure by @Karib0u in #626
  • fix(service): grant cross-user capabilities to managed unit by @Karib0u in #628
  • fix(config): exclude writable Windows paths from trust by @Karib0u in #629
  • fix(engine): flush correlation reorder buffers on timer and shutdown by @Karib0u in #630
  • docs(site): restructure documentation and enforce writing rules by @Karib0u in #656
  • fix(yara-memory): scan Linux heap and stack mappings by @Karib0u in #674
  • fix(sensors): define callback panic behavior across build profiles by @Karib0u in #676
  • fix(reload): guarantee fallback polling in regression test by @Karib0u in #677
  • fix(windows): allow installation to configure service recovery by @Karib0u in #678
  • fix(artifact): resolve memfd executables for YARA and hashing by @Karib0u in #679
  • fix(response): validate and terminate through one process handle by @Karib0u in #680
  • fix(yara-memory): classify macOS regions by their own VM entry by @Karib0u in #683
  • fix(yara): scan written files on macOS and Windows by @Karib0u in #687
  • fix(linux): resolve process artifacts in their mount namespace by @Karib0u in #689

Documentation

  • docs(field-availability): clarify since values when availability narrows by @Karib0u in #657

Dependencies

  • chore(deps): bump the patch-updates group with 2 updates by @dependabot[bot] in #580
  • chore(deps): bump smallvec from 1.15.2 to 1.16.1 by @dependabot[bot] in #581
  • chore(deps): bump rsigma-parser from 0.21.0 to 0.22.0 by @dependabot[bot] in #583
  • chore(deps): bump rsigma-eval from 0.21.0 to 0.22.0 by @dependabot[bot] in #582
  • chore(deps): bump clap from 4.6.6 to 4.6.7 in the patch-updates group by @dependabot[bot] in #622
  • fix(deps): update YARA-X and restore supply chain checks by @Karib0u in #673

Maintenance

  • ci(linux): load eBPF programs on real kernels by @Karib0u in #573
  • chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #577
  • chore(deps): bump taiki-e/install-action from 2.87.8 to 2.87.12 by @dependabot[bot] in #578
  • chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @dependabot[bot] in #579
  • refactor(sigma): make Sysmon field names a view by @Karib0u in #584
  • chore(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 by @dependabot[bot] in #620
  • chore(deps): bump taiki-e/install-action from 2.87.12 to 2.87.17 by @dependabot[bot] in #621
  • fix(ci): run Windows atomics from a protected engine dir by @Karib0u in #627

Full Changelog: v1.8.0...v1.9.0

Contributors

Karib0u and dependabot
Assets 9
Loading