Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

modules/passive/ldap_harvester.py

@@ -19,6 +19,7 @@ from pathlib import Path
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.passive.ldap_harvester")
 
@@ -270,12 +271,12 @@ class LDAPHarvester(BaseModule):
         if "ms-mcs-admpwd" in body_str:
             self._stats["laps_reads_detected"] += 1
             logger.warning("LAPS password read detected from %s (base DN: %s)", src_ip, base_dn)
-            self.bus.emit("CREDENTIAL_FOUND", {
+            emit_credential_found(self.bus, self.name, {
                 "source": "laps_read",
                 "source_ip": src_ip,
                 "base_dn": base_dn,
                 "detail": "LAPS password attribute requested in LDAP search",
-            }, source_module=self.name)
+            })
 
     def _handle_search_result_entry(self, body: bytes, src_ip: str,
                                      ts: float) -> None: