feat(detectors): add RSA SecurID software token detector

[momomuchu]

Description

Closes #4395.

Adds a detector for RSA SecurID software tokens distributed as .sdtid XML files. Each token export contains a <SN> serial (12 digits) and a <Seed> TOTP seed (128-bit hex, or an AES-encrypted seed in base64). The seed lets an attacker generate valid one-time passcodes and defeat the MFA factor, so both parts are reported as a multi-part credential (serial + seed).

Detection rationale

• <SN>(\d{12})</SN> and <Seed>([A-Za-z0-9+/]{16,}={0,2})</Seed> must both be present.
• A structural guard requires an RSA SecurID marker (<TKNBatch>, <TKNBasic>, or .sdtid) before emitting, so generic XML with unrelated <SN>/<Seed> elements is not flagged. This is the primary false-positive defense.
• No public endpoint can validate a software token, so results are unverified.

Test coverage

8 pattern cases: 2 positive (hex seed, base64/encrypted seed) and 6 negative (SN only, Seed only, wrong element names, short seed, wrong-length serial, missing structural marker). All synthetic/fake values — no real token material.

Note on generated protobuf

proto/detector_type.proto is updated with the new RSASecurID enum, and the generated detector_type.pb.go carries the matching constant + name/value map entries so the package builds and the enum resolves. The embedded descriptor blob was not regenerated (the make protos toolchain runs in a pinned Docker image unavailable in my environment). Running make protos before merge will regenerate it cleanly from the updated proto source.

Checklist

• go test ./pkg/detectors/rsasecurid/... passing
• go vet / gofmt clean
• Registered in pkg/engine/defaults

---

Note

Low Risk
Additive secret scanner with tests and structural guards; no changes to auth or runtime behavior beyond new findings.

Overview
Adds a new RSA SecurID detector for .sdtid XML exports: it only fires when SecurID structure markers (TKNBatch, TKNBasic, or .sdtid) are present together with a 12-digit <SN> and a <Seed> (hex or base64). Findings are emitted as a multi-part credential (serial + seed) with no verification (no public validation API).

Keywords() aligns with those structural markers so the Aho–Corasick prefilter does not skip <TKNBasic>-only blobs. Tests cover positive/negative patterns plus prefilter/keyword coverage.

The scanner is wired into default detectors and DetectorType_RSASecurID (1059) is added in proto/detector_type.proto and the generated Go maps (full make protos may still be needed for the embedded descriptor).

^{Reviewed by Cursor Bugbot for commit 73453d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Reviewed by Cursor Bugbot for commit db29e15. Configure here.}

[cursor]

Stale descriptor blob breaks String() for new enum

High Severity

The Go constant and DetectorType_name/DetectorType_value maps were manually updated for RSASecurID, but the file_detector_type_proto_rawDesc binary descriptor blob was not regenerated. The String() method uses protoimpl.X.EnumStringOf which resolves names from the descriptor, not the name map. As a result, DetectorType_RSASecurID.String() returns "1058" instead of "RSASecurID", affecting engine logging, JSON output, GitHub Actions output, and dedup hashing.

Additional Locations (2)

• pkg/pb/detector_typepb/detector_type.pb.go#L2171-L2172
• pkg/pb/detector_typepb/detector_type.pb.go#L3227-L3228

 

^{Reviewed by Cursor Bugbot for commit db29e15. Configure here.}

[rajpratham1]

Good addition overall, but I think the Cursor finding is valid. contextPat recognizes both and , whereas Keywords() only returns "TKNBatch" and "sdtid". Since the Aho-Corasick prefilter gates execution of FromData, a valid token containing only may never be scanned. Could you add "TKNBasic" to Keywords() (or otherwise align the prefilter with contextPat) so all supported formats are reachable?