@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/obom-runtime.yaml

@@ -0,0 +1,1776 @@
+# OBOM Runtime Security & Compliance Rules
+# Category: obom-runtime
+# Detects host posture, persistence, and runtime indicators from osquery-derived OBOM components
+
+- id: OBOM-LNX-001
+  name: "Linux systemd unit sourced from temporary path"
+  description: "Systemd units loaded from /tmp or /var/tmp can indicate unauthorized persistence."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'systemd_units'
+      and (
+        $contains($nullSafeProp($, 'fragment_path'), '/tmp/')
+        or $contains($nullSafeProp($, 'fragment_path'), '/var/tmp/')
+        or $contains($nullSafeProp($, 'source_path'), '/tmp/')
+        or $contains($nullSafeProp($, 'source_path'), '/var/tmp/')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Systemd unit '{{ name }}' loads from unit path '{{ $firstNonEmpty($prop($, 'fragment_path'), $prop($, 'source_path'), name) }}' with temporary-backed source '{{ $firstNonEmpty($prop($, 'source_path'), $prop($, 'fragment_path')) }}'"
+  mitigation: "Review the unit file and any generated source/drop-in together, move them to trusted system paths, validate ownership/permissions, and re-enable only approved services."
+  evidence: |
+    {
+      "activeState": $prop($, 'active_state'),
+      "unitFileState": $prop($, 'unit_file_state'),
+      "fragmentPath": $prop($, 'fragment_path'),
+      "sourcePath": $prop($, 'source_path')
+    }
+
+- id: OBOM-LNX-002
+  name: "Linux sudoers broad privilege rule"
+  description: "Sudoers entries allowing unrestricted command execution increase lateral movement and privilege escalation risk."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'sudoers_snapshot'
+      and (
+        $contains(description, 'NOPASSWD:ALL')
+        or $contains(description, 'ALL=(ALL) ALL')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Sudo policy '{{ name }}' contains broad privilege grant: {{ description }}"
+  mitigation: "Replace broad grants with command-specific allowlists and enforce MFA/approval workflows for privileged operations."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'path'),
+      "ruleDetails": description
+    }
+
+- id: OBOM-LNX-003
+  name: "Root authorized_keys entry without restrictions"
+  description: "Root SSH keys without command/from/no-agent-forwarding restrictions weaken access controls and traceability."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'authorized_keys_snapshot'
+      and name = 'root'
+      and $hasProp($, 'options')
+      and $safeStr($prop($, 'options')) = ''
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Root authorized_keys entry in '{{ $prop($, 'key_file') }}' lacks restrictive key options"
+  mitigation: "Apply restrictive key options (from=, command=, no-agent-forwarding, no-port-forwarding) and rotate unmanaged keys."
+  evidence: |
+    {
+      "account": name,
+      "algorithm": version,
+      "keyFile": $prop($, 'key_file'),
+      "options": $prop($, 'options')
+    }
+
+- id: OBOM-WIN-001
+  name: "Windows drive without BitLocker protection"
+  description: "Drives with disabled BitLocker protection can violate endpoint encryption requirements and increase data exposure risk."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'windows_bitlocker_info'
+      and $safeStr($prop($, 'protection_status')) != '1'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "BitLocker protection is not enabled for drive '{{ version }}' (device '{{ name }}')"
+  mitigation: "Enable BitLocker with approved encryption policy and escrow recovery keys in managed KMS/AD."
+  evidence: |
+    {
+      "deviceId": name,
+      "driveLetter": version,
+      "protectionStatus": $prop($, 'protection_status'),
+      "encryptionMethod": $prop($, 'encryption_method'),
+      "percentageEncrypted": $prop($, 'percentage_encrypted')
+    }
+
+- id: OBOM-WIN-002
+  name: "Windows Security Center unhealthy state"
+  description: "Poor Security Center health indicates one or more key endpoint protections are disabled or degraded."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'windows_security_center'
+      and (
+        name = 'Poor'
+        or version = 'Poor'
+        or description = 'Poor'
+        or $prop($, 'internet_settings') = 'Poor'
+        or $prop($, 'windows_security_center_service') = 'Poor'
+        or $prop($, 'user_account_control') = 'Poor'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Windows Security Center reports degraded protection posture (antivirus={{ name }}, firewall={{ version }}, autoupdate={{ description }})"
+  mitigation: "Restore endpoint protection controls and enforce policy baselines for AV, firewall, updates, and UAC."
+  evidence: |
+    {
+      "antivirus": name,
+      "firewall": version,
+      "autoupdate": description,
+      "internetSettings": $prop($, 'internet_settings'),
+      "securityCenterService": $prop($, 'windows_security_center_service'),
+      "uac": $prop($, 'user_account_control')
+    }
+
+- id: OBOM-WIN-003
+  name: "Windows Run key references temporary/script execution path"
+  description: "Run/RunOnce entries launching from temp or encoded script commands are common persistence techniques."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+      and (
+        $contains($lowercase($safeStr(description)), '\\appdata\\local\\temp\\')
+        or $contains($lowercase($safeStr(description)), '\\temp\\')
+        or $contains($lowercase($safeStr(description)), '-enc ')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Run key '{{ name }}' launches potentially suspicious command/path: {{ description }}"
+  mitigation: "Validate publisher and hash of the referenced executable/script, remove unauthorized entries, and investigate parent change events."
+  evidence: |
+    {
+      "registryPath": name,
+      "command": description,
+      "registryKey": $prop($, 'key'),
+      "mtime": version
+    }
+
+- id: OBOM-MAC-001
+  name: "macOS firewall disabled or stealth mode off"
+  description: "ALF misconfiguration can expose endpoints to unsolicited inbound traffic and weakens host hardening baselines."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'alf'
+      and (
+        $safeStr(version) = '0'
+        or $safeStr($prop($, 'stealth_enabled')) = '0'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "macOS ALF posture is weak (global_state={{ version }}, stealth_enabled={{ $prop($, 'stealth_enabled') }})"
+  mitigation: "Enable ALF and stealth mode via managed profile or MDM baseline."
+  evidence: |
+    {
+      "globalState": version,
+      "stealthEnabled": $prop($, 'stealth_enabled'),
+      "allowSignedEnabled": $prop($, 'allow_signed_enabled'),
+      "loggingEnabled": $prop($, 'logging_enabled')
+    }
+
+- id: OBOM-MAC-002
+  name: "macOS launchd item from user-writable temporary path"
+  description: "Launchd agents/daemons sourced from temporary paths are a strong persistence and execution abuse signal."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'launchd_services'
+      and (
+        $contains($nullSafeProp($, 'path'), '/tmp/')
+        or $contains($nullSafeProp($, 'path'), '/var/tmp/')
+        or $contains($nullSafeProp($, 'program'), '/tmp/')
+        or $contains($nullSafeProp($, 'program'), '/var/tmp/')
+      )
+      and (
+        $safeStr($prop($, 'run_at_load')) = 'true'
+        or $safeStr($prop($, 'run_at_load')) = '1'
+        or $safeStr($prop($, 'keep_alive')) = 'true'
+        or $safeStr($prop($, 'keep_alive')) = '1'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Launchd item '{{ $firstNonEmpty($prop($, 'label'), name) }}' uses plist '{{ $firstNonEmpty($prop($, 'path'), name) }}' and target '{{ $firstNonEmpty($prop($, 'program'), $prop($, 'program_arguments'), name) }}' from a temporary path with persistence enabled"
+  mitigation: "Review the launchd plist and target executable together, remove unauthorized entries, relocate approved binaries to trusted paths, and enforce signed launchd payloads."
+  evidence: |
+    {
+      "label": $prop($, 'label'),
+      "plistPath": $prop($, 'path'),
+      "targetPath": $firstNonEmpty($prop($, 'program'), $prop($, 'program_arguments')),
+      "program": $prop($, 'program'),
+      "programArguments": $prop($, 'program_arguments'),
+      "runAtLoad": $prop($, 'run_at_load'),
+      "keepAlive": $prop($, 'keep_alive')
+    }
+
+- id: OBOM-MAC-003
+  name: "macOS firewall exception for binary in untrusted user path"
+  description: "ALF exceptions for binaries in user Downloads/Desktop/tmp increase risk of untrusted inbound network exposure."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'alf_exceptions'
+      and (
+        $contains($safeStr(name), '/Users/')
+        and (
+          $contains($safeStr(name), '/Downloads/')
+          or $contains($safeStr(name), '/Desktop/')
+          or $contains($safeStr(name), '/tmp/')
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "ALF exception allows inbound access for risky path '{{ name }}'"
+  mitigation: "Restrict exceptions to signed, managed applications in trusted system paths."
+  evidence: |
+    {
+      "path": name,
+      "state": version
+    }
+
+- id: OBOM-LNX-004
+  name: "Linux shell history contains suspicious download-execute pattern"
+  description: "Shell history with direct download-and-execute commands may indicate malware staging or hands-on-keyboard activity."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'shell_history_snapshot'
+      and (
+        ($contains($lowercase(description), 'curl ') and $contains($lowercase(description), '| sh'))
+        or ($contains($lowercase(description), 'wget ') and $contains($lowercase(description), '| bash'))
+        or $contains($lowercase(description), 'base64 -d')
+        or $contains($lowercase(description), 'nc -e ')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Suspicious shell history entry for user '{{ name }}': {{ description }}"
+  mitigation: "Correlate with process/network telemetry, validate command intent, and isolate host if command lineage is untrusted."
+  evidence: |
+    {
+      "account": name,
+      "command": description,
+      "historyFile": $prop($, 'history_file'),
+      "timestamp": $prop($, 'time')
+    }
+
+- id: OBOM-LNX-005
+  name: "Docker API exposed over unauthenticated TCP port"
+  description: "Dockerd listening on TCP 2375 enables remote daemon control if not protected by network controls and TLS."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'listening_ports'
+      and $safeStr($prop($, 'port')) = '2375'
+      and (
+        $safeStr($prop($, 'address')) = '0.0.0.0'
+        or $safeStr($prop($, 'address')) = '::'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Potentially insecure Docker API exposure detected on {{ $prop($, 'address') }}:{{ $prop($, 'port') }} for process '{{ name }}'"
+  mitigation: "Disable insecure TCP listener, enforce TLS/mTLS, and restrict daemon access to trusted local interfaces."
+  evidence: |
+    {
+      "process": name,
+      "pid": $prop($, 'pid'),
+      "address": $prop($, 'address'),
+      "port": $prop($, 'port'),
+      "protocol": $prop($, 'protocol')
+    }
+
+- id: OBOM-LNX-006
+  name: "Privileged Linux listener exposed on a non-local interface"
+  description: "Root or service-account listeners bound to all interfaces expand attack surface and should be reviewed even when they appear to come from managed system paths."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'privileged_listening_ports'
+      and (
+        $safeStr($prop($, 'address')) = '0.0.0.0'
+        or $safeStr($prop($, 'address')) = '::'
+      )
+      and $safeStr($prop($, 'port')) != '22'
+      and $safeStr($prop($, 'port')) != '53'
+      and $safeStr(name) != 'systemd-resolved'
+      and $safeStr(name) != 'avahi-daemon'
+      and $safeStr(name) != 'cupsd'
+      and $safeStr($prop($, 'package_source_hint')) != 'user-writable-path'
+      and $safeStr($prop($, 'package_source_hint')) != 'unclassified-path'
+      and $not($contains($lowercase($nullSafeProp($, 'path')), '/tmp/'))
+      and $not($contains($lowercase($nullSafeProp($, 'path')), '/var/tmp/'))
+      and $not($contains($lowercase($nullSafeProp($, 'path')), '/dev/shm/'))
+      and $not($contains($lowercase($nullSafeProp($, 'path')), '/home/'))
+      and $not($contains($lowercase($nullSafeProp($, 'path')), '/run/user/'))
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Privileged listener '{{ name }}' from '{{ $firstNonEmpty($prop($, 'path'), name) }}' is reachable on {{ $prop($, 'address') }}:{{ $prop($, 'port') }} and should be validated against approved exposure"
+  mitigation: "Restrict privileged services to local interfaces where possible, front them with authenticated proxies, and validate the listener path and service ownership against approved admin-surface inventory."
+  evidence: |
+    {
+      "account": $prop($, 'account'),
+      "pid": $prop($, 'pid'),
+      "address": $prop($, 'address'),
+      "port": $prop($, 'port'),
+      "path": $prop($, 'path'),
+      "serviceUnit": $prop($, 'service_unit'),
+      "packageSourceHint": $prop($, 'package_source_hint'),
+      "parentCmdline": $prop($, 'parent_cmdline')
+    }
+
+- id: OBOM-LNX-007
+  name: "Administrative Linux surface running with elevated privileges"
+  description: "Cockpit, PackageKit, pkexec, and related admin surfaces running with elevated privileges should be continuously monitored for exposure and drift."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        $prop($, 'cdx:osquery:category') = 'elevated_processes'
+        or $prop($, 'cdx:osquery:category') = 'privileged_listening_ports'
+        or $prop($, 'cdx:osquery:category') = 'sudo_executions'
+        or $prop($, 'cdx:osquery:category') = 'privilege_transitions'
+      )
+      and (
+        $contains($lowercase($safeStr(name)), 'cockpit')
+        or $contains($lowercase($nullSafeProp($, 'path')), 'cockpit')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'cockpit')
+        or $contains($lowercase($safeStr(name)), 'packagekit')
+        or $contains($lowercase($nullSafeProp($, 'path')), 'packagekit')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'packagekit')
+        or $contains($lowercase($safeStr(name)), 'pkexec')
+        or $contains($lowercase($nullSafeProp($, 'path')), 'pkexec')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'pkexec')
+        or $contains($lowercase($safeStr(name)), 'pkcon')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'pkcon')
+      )
+      and (
+        $safeStr($prop($, 'uid')) = '0'
+        or $safeStr($prop($, 'euid')) = '0'
+        or $safeStr($prop($, 'account')) = 'root'
+        or $safeStr($prop($, 'effective_user')) = 'root'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Administrative surface '{{ name }}' is active with elevated privileges and should be reviewed for exposure"
+  mitigation: "Review network reachability, patch cadence, and whether the administrative package is still needed on this host."
+  evidence: |
+    {
+      "category": $prop($, 'cdx:osquery:category'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "account": $prop($, 'account'),
+      "effectiveUser": $prop($, 'effective_user'),
+      "serviceUnit": $prop($, 'service_unit'),
+      "address": $prop($, 'address'),
+      "port": $prop($, 'port'),
+      "packageSourceHint": $prop($, 'package_source_hint')
+    }
+
+- id: OBOM-LNX-008
+  name: "Interactive sudo chain touched sensitive administrative binary"
+  description: "Interactive sudo or pkexec invocations against package-management and admin-control binaries can indicate privileged changes worth auditing."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'sudo_executions'
+      and $safeStr($prop($, 'auid')) != ''
+      and $safeStr($prop($, 'auid')) != '0'
+      and (
+        $safeStr($prop($, 'euid')) = '0'
+        or $safeStr($prop($, 'effective_user')) = 'root'
+      )
+      and (
+        $contains($lowercase($nullSafeProp($, 'path')), 'pkexec')
+        or $contains($lowercase($nullSafeProp($, 'path')), 'pkcon')
+        or $contains($lowercase($nullSafeProp($, 'path')), 'packagekit')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'pkexec')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'pkcon')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'packagekit')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'cockpit')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'systemctl')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), 'service ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' apt ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' apt-get ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' dnf ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' yum ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' zypper ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' rpm ')
+        or $contains($lowercase($nullSafeProp($, 'cmdline')), ' dpkg ')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Interactive privileged execution by '{{ $prop($, 'login_user') }}' touched sensitive administrative command '{{ $prop($, 'path') }}'"
+  mitigation: "Review whether the command was expected, tie it to change records, and investigate unexpected package-management or control-plane activity."
+  evidence: |
+    {
+      "loginUser": $prop($, 'login_user'),
+      "effectiveUser": $prop($, 'effective_user'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "parentCmdline": $prop($, 'parent_cmdline'),
+      "serviceUnit": $prop($, 'service_unit'),
+      "packageSourceHint": $prop($, 'package_source_hint'),
+      "timestamp": $prop($, 'time')
+    }
+
+- id: OBOM-LNX-009
+  name: "Unexpected Linux privilege transition for non-allowlisted executable"
+  description: "Setuid/setgid transitions outside a small baseline of expected tools can indicate risky privilege-bound packages or exploit activity."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'privilege_transitions'
+      and $safeStr($prop($, 'auid')) != ''
+      and $safeStr($prop($, 'auid')) != '0'
+      and (
+        $safeStr($prop($, 'euid')) = '0'
+        or $safeStr($prop($, 'egid')) = '0'
+      )
+      and $safeStr($prop($, 'path')) != '/usr/bin/sudo'
+      and $safeStr($prop($, 'path')) != '/bin/su'
+      and $safeStr($prop($, 'path')) != '/usr/bin/su'
+      and $safeStr($prop($, 'path')) != '/usr/bin/doas'
+      and $safeStr($prop($, 'path')) != '/usr/bin/passwd'
+      and $safeStr($prop($, 'path')) != '/usr/bin/chsh'
+      and $safeStr($prop($, 'path')) != '/usr/bin/chfn'
+      and $safeStr($prop($, 'path')) != '/usr/bin/gpasswd'
+      and $safeStr($prop($, 'path')) != '/usr/bin/newgrp'
+      and $safeStr($prop($, 'path')) != '/usr/bin/mount'
+      and $safeStr($prop($, 'path')) != '/usr/bin/umount'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Unexpected privilege transition detected for '{{ $prop($, 'path') }}' (auid={{ $prop($, 'auid') }}, euid={{ $prop($, 'euid') }})"
+  mitigation: "Validate binary provenance, file permissions, and recent package changes; treat unfamiliar setuid/setgid paths as high-priority review items."
+  evidence: |
+    {
+      "loginUser": $prop($, 'login_user'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "parentCmdline": $prop($, 'parent_cmdline'),
+      "auid": $prop($, 'auid'),
+      "uid": $prop($, 'uid'),
+      "euid": $prop($, 'euid'),
+      "gid": $prop($, 'gid'),
+      "egid": $prop($, 'egid'),
+      "packageSourceHint": $prop($, 'package_source_hint')
+    }
+
+- id: OBOM-LNX-010
+  name: "Elevated Linux process launched from user-writable or temporary path"
+  description: "Root processes executing from explicit user-controlled, temporary, or per-user runtime paths are a strong signal for persistence or package drift."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'elevated_processes'
+      and $safeStr($prop($, 'uid')) = '0'
+      and (
+        $contains($nullSafeProp($, 'path'), '/tmp/')
+        or $contains($nullSafeProp($, 'path'), '/var/tmp/')
+        or $contains($nullSafeProp($, 'path'), '/dev/shm/')
+        or $contains($nullSafeProp($, 'path'), '/home/')
+        or $contains($nullSafeProp($, 'path'), '/run/user/')
+        or $contains($nullSafeProp($, 'cmdline'), '/tmp/')
+        or $contains($nullSafeProp($, 'cmdline'), '/var/tmp/')
+        or $contains($nullSafeProp($, 'cmdline'), '/dev/shm/')
+        or $contains($nullSafeProp($, 'cmdline'), '/home/')
+        or $contains($nullSafeProp($, 'cmdline'), '/run/user/')
+        or $safeStr($prop($, 'package_source_hint')) = 'user-writable-path'
+      )
+      and $safeStr(name) != 'systemd'
+      and $safeStr(name) != 'init'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Elevated process '{{ name }}' executes from a risky path or command: {{ $firstNonEmpty($prop($, 'path'), $prop($, 'cmdline'), name) }}"
+  mitigation: "Validate the executable path and full command line, move approved binaries into trusted system locations, and investigate any root process sourced from writable directories or per-user runtime paths."
+  evidence: |
+    {
+      "account": $prop($, 'account'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "serviceUnit": $prop($, 'service_unit'),
+      "parentPath": $prop($, 'parent_path'),
+      "parentCmdline": $prop($, 'parent_cmdline'),
+      "startTime": $prop($, 'start_time'),
+      "packageSourceHint": $prop($, 'package_source_hint')
+    }
+
+- id: OBOM-LNX-011
+  name: "Interactive shell parent spawned privileged Linux execution"
+  description: "Shell-driven privileged chains are useful for separating admin changes from long-running service behavior."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'sudo_executions'
+      and $safeStr($prop($, 'auid')) != ''
+      and $safeStr($prop($, 'auid')) != '0'
+      and (
+        $safeStr($prop($, 'euid')) = '0'
+        or $safeStr($prop($, 'effective_user')) = 'root'
+      )
+      and (
+        $safeStr($prop($, 'parent_name')) = 'bash'
+        or $safeStr($prop($, 'parent_name')) = 'sh'
+        or $safeStr($prop($, 'parent_name')) = 'zsh'
+        or $safeStr($prop($, 'parent_name')) = 'dash'
+        or $safeStr($prop($, 'parent_name')) = 'fish'
+        or $contains($lowercase($nullSafeProp($, 'parent_cmdline')), 'bash')
+        or $contains($lowercase($nullSafeProp($, 'parent_cmdline')), 'zsh')
+        or $contains($lowercase($nullSafeProp($, 'parent_cmdline')), 'fish')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Interactive shell lineage for privileged command '{{ $prop($, 'cmdline') }}' merits change-review validation"
+  mitigation: "Correlate the privileged command with shell history, tickets, and package changes to confirm it was expected."
+  evidence: |
+    {
+      "loginUser": $prop($, 'login_user'),
+      "parentName": $prop($, 'parent_name'),
+      "parentCmdline": $prop($, 'parent_cmdline'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "timestamp": $prop($, 'time')
+    }
+
+- id: OBOM-LNX-012
+  name: "Linux Secure Boot inventory contains revoked certificate"
+  description: "Revoked entries in the Secure Boot trust inventory can indicate stale firmware trust policy or unexpected dbx posture drift."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'secureboot_certificates'
+      and $safeStr($prop($, 'revoked')) = '1'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Secure Boot certificate '{{ name }}' is marked revoked in firmware trust inventory"
+  mitigation: "Review db/dbx enrollment, remove stale trust anchors, and reconcile firmware policy with approved platform signing certificates."
+  evidence: |
+    {
+      "subject": $prop($, 'subject'),
+      "issuer": $prop($, 'issuer'),
+      "serial": $prop($, 'serial'),
+      "path": $prop($, 'path'),
+      "notValidAfter": $prop($, 'not_valid_after')
+    }
+
+- id: OBOM-LNX-013
+  name: "Linux Secure Boot certificate expired or expiring soon"
+  description: "Secure Boot trust anchors nearing expiry can cause firmware validation drift and interrupt planned key rotation windows."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'secureboot_certificates'
+      and $safeStr($prop($, 'not_valid_after')) != ''
+      and $number($prop($, 'not_valid_after')) <= ($floor($millis() / 1000) + 2592000)
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Secure Boot certificate '{{ name }}' expires at {{ $prop($, 'not_valid_after') }} and should be rotated or reviewed"
+  mitigation: "Rotate or re-enroll Secure Boot certificates before expiry and validate firmware trust stores against your approved signing hierarchy."
+  evidence: |
+    {
+      "subject": $prop($, 'subject'),
+      "issuer": $prop($, 'issuer'),
+      "serial": $prop($, 'serial'),
+      "path": $prop($, 'path'),
+      "notValidBefore": $prop($, 'not_valid_before'),
+      "notValidAfter": $prop($, 'not_valid_after')
+    }
+
+- id: OBOM-WIN-004
+  name: "Hidden scheduled task uses suspicious execution path"
+  description: "Enabled hidden tasks executing from temp paths or encoded script launchers are common persistence tradecraft."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+      and $safeStr($prop($, 'enabled')) = '1'
+      and $safeStr($prop($, 'hidden')) = '1'
+      and (
+        $contains($lowercase($nullSafeProp($, 'path')), '\\temp\\')
+        or ($contains($lowercase($nullSafeProp($, 'action')), 'powershell') and $contains($lowercase($nullSafeProp($, 'action')), '-enc '))
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Hidden scheduled task '{{ name }}' has suspicious action/path: {{ $prop($, 'action') }}"
+  mitigation: "Validate author and binary lineage, disable unauthorized tasks, and investigate task registration event history."
+  evidence: |
+    {
+      "taskName": name,
+      "taskPath": $prop($, 'path'),
+      "action": $prop($, 'action'),
+      "state": $prop($, 'state')
+    }
+
+- id: OBOM-WIN-005
+  name: "Auto-start Windows service points to user-writable path"
+  description: "Auto-start services from temp or AppData paths may indicate privilege persistence through service hijacking."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'services_snapshot'
+      and $safeStr($prop($, 'start_type')) = 'AUTO_START'
+      and (
+        $contains($lowercase($nullSafeProp($, 'path')), '\\temp\\')
+        or $contains($lowercase($nullSafeProp($, 'path')), '\\appdata\\')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Auto-start service '{{ name }}' launches from a user-writable path: {{ $prop($, 'path') }}"
+  mitigation: "Move binaries to protected system paths, lock ACLs, and validate service image hashes/signatures."
+  evidence: |
+    {
+      "serviceName": name,
+      "displayName": $prop($, 'display_name'),
+      "servicePath": $prop($, 'path'),
+      "account": $prop($, 'user_account')
+    }
+
+- id: OBOM-WIN-006
+  name: "Windows suspicious persistence surface references LOLBAS execution helper"
+  description: "Any Windows persistence or startup surface that invokes a LOLBAS helper deserves review, including vendor- or platform-managed maintenance registrations, because these surfaces can become breachable execution targets."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:lolbas:matched') = 'true'
+      and (
+        $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+        or $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+        or $prop($, 'cdx:osquery:category') = 'startup_items'
+        or $prop($, 'cdx:osquery:category') = 'services_snapshot'
+      )
+      and (
+        $listContains($prop($, 'cdx:lolbas:functions'), 'command')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'script-execution')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'proxy-execution')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'library-load')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'shell')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Windows {{ $prop($, 'cdx:osquery:category') }} registration '{{ $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name) }}' launches '{{ $firstNonEmpty($prop($, 'action'), $prop($, 'executable'), $prop($, 'module_path'), $prop($, 'path'), description, name) }}' via LOLBAS helper(s) {{ $prop($, 'cdx:lolbas:names') }}"
+  mitigation: "Review the registration surface and launched command together, validate the owning change, and do not auto-trust managed or vendor-owned maintenance surfaces without provenance and hardening review."
+  attack:
+    tactics: [TA0003, TA0004, TA0005]
+    techniques: [T1218, T1547]
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "registrationPath": $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name),
+      "targetPath": $firstNonEmpty($prop($, 'action'), $prop($, 'executable'), $prop($, 'module_path'), $prop($, 'path'), description),
+      "lolbasNames": $prop($, 'cdx:lolbas:names'),
+      "functions": $prop($, 'cdx:lolbas:functions'),
+      "matchFields": $prop($, 'cdx:lolbas:matchFields'),
+      "path": $prop($, 'path'),
+      "action": $prop($, 'action'),
+      "command": description
+    }
+
+- id: OBOM-WIN-007
+  name: "Windows WMI or AppCompat persistence uses LOLBAS"
+  description: "WMI command consumers and AppCompat shims that invoke LOLBAS utilities are high-signal persistence and defense-evasion indicators."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:lolbas:matched') = 'true'
+      and (
+        $prop($, 'cdx:osquery:category') = 'appcompat_shims'
+        or $prop($, 'cdx:osquery:category') = 'wmi_cli_event_consumers'
+        or $prop($, 'cdx:osquery:category') = 'wmi_cli_event_consumers_snapshot'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "WMI/AppCompat persistence artifact '{{ name }}' references LOLBAS helper(s) {{ $prop($, 'cdx:lolbas:names') }}"
+  mitigation: "Treat as a persistence investigation, review WMI repository and shim databases, and remove unauthorized subscriptions or shim registrations."
+  attack:
+    tactics: [TA0003, TA0004, TA0005]
+    techniques: [T1218, T1546]
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "lolbasNames": $prop($, 'cdx:lolbas:names'),
+      "functions": $prop($, 'cdx:lolbas:functions'),
+      "matchFields": $prop($, 'cdx:lolbas:matchFields'),
+      "path": $prop($, 'path'),
+      "executable": $prop($, 'executable'),
+      "commandLine": $prop($, 'command_line'),
+      "commandTemplate": $prop($, 'command_line_template')
+    }
+
+- id: OBOM-WIN-008
+  name: "Windows startup or process activity uses network-capable LOLBAS"
+  description: "Network-capable LOLBAS helpers such as PowerShell, Certutil, Bitsadmin, or WMIC become higher priority when they appear in persistence surfaces or suspicious live process command lines."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:lolbas:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:lolbas:functions'), 'download')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'upload')
+      )
+      and (
+        $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+        or $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+        or $prop($, 'cdx:osquery:category') = 'startup_items'
+        or (
+          $prop($, 'cdx:osquery:category') = 'processes'
+          and (
+            $contains($lowercase($nullSafeProp($, 'cmdline')), 'http://')
+            or $contains($lowercase($nullSafeProp($, 'cmdline')), 'https://')
+            or $contains($lowercase($nullSafeProp($, 'cmdline')), '-enc ')
+          )
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Network-capable LOLBAS helper(s) {{ $prop($, 'cdx:lolbas:names') }} detected in '{{ $prop($, 'cdx:osquery:category') }}'"
+  mitigation: "Correlate with outbound connections and downloads, restrict unmanaged scripting/network utilities, and investigate encoded or remote-fetch command lines."
+  attack:
+    tactics: [TA0002, TA0010, TA0011]
+    techniques: [T1041, T1059.001, T1105]
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "lolbasNames": $prop($, 'cdx:lolbas:names'),
+      "functions": $prop($, 'cdx:lolbas:functions'),
+      "command": description,
+      "cmdline": $prop($, 'cmdline'),
+      "action": $prop($, 'action')
+    }
+
+- id: OBOM-WIN-009
+  name: "Network-facing Windows listener is a LOLBAS execution helper"
+  description: "A listening process backed by a LOLBAS execution helper is a strong remote-control or staging indicator on Windows endpoints."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'listening_ports'
+      and $prop($, 'cdx:lolbas:matched') = 'true'
+      and (
+        $safeStr($prop($, 'address')) = '0.0.0.0'
+        or $safeStr($prop($, 'address')) = '::'
+      )
+      and (
+        $listContains($prop($, 'cdx:lolbas:functions'), 'command')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'script-execution')
+        or $listContains($prop($, 'cdx:lolbas:functions'), 'shell')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Listening process '{{ name }}' on {{ $prop($, 'address') }}:{{ $prop($, 'port') }} matches LOLBAS helper(s) {{ $prop($, 'cdx:lolbas:names') }}"
+  mitigation: "Review parent process lineage, isolate unmanaged listeners, and block or remove unexpected inbound admin or scripting surfaces."
+  attack:
+    tactics: [TA0002, TA0005, TA0011]
+    techniques: [T1059, T1105, T1218]
+  evidence: |
+    {
+      "lolbasNames": $prop($, 'cdx:lolbas:names'),
+      "functions": $prop($, 'cdx:lolbas:functions'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "address": $prop($, 'address'),
+      "port": $prop($, 'port')
+    }
+
+- id: OBOM-WIN-010
+  name: "Windows persistence artifact uses LOLBAS with UAC-bypass context"
+  description: "Persistence surfaces that reference LOLBAS helpers documented with UAC-bypass behavior should be treated as privilege-escalation investigations."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:lolbas:matched') = 'true'
+      and $listContains($prop($, 'cdx:lolbas:contexts'), 'uac-bypass')
+      and (
+        $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+        or $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+        or $prop($, 'cdx:osquery:category') = 'startup_items'
+        or $prop($, 'cdx:osquery:category') = 'wmi_cli_event_consumers'
+        or $prop($, 'cdx:osquery:category') = 'wmi_cli_event_consumers_snapshot'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "UAC-bypass-capable LOLBAS helper(s) {{ $prop($, 'cdx:lolbas:names') }} detected in Windows persistence artifact '{{ name }}'"
+  mitigation: "Investigate as a possible privilege-escalation foothold, remove unauthorized registration points, and enforce WDAC/AppLocker policies for known proxy binaries."
+  attack:
+    tactics: [TA0004, TA0005]
+    techniques: [T1548.002, T1218]
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "lolbasNames": $prop($, 'cdx:lolbas:names'),
+      "contexts": $prop($, 'cdx:lolbas:contexts'),
+      "path": $prop($, 'path'),
+      "action": $prop($, 'action'),
+      "command": description
+    }
+
+- id: OBOM-MAC-004
+  name: "macOS launchd override disables Apple-managed service"
+  description: "Launchd overrides disabling Apple-managed services can indicate tampering with built-in security or platform controls."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'launchd_overrides'
+      and $safeStr($prop($, 'key')) = 'Disabled'
+      and (
+        $safeStr($prop($, 'value')) = '1'
+        or $lowercase($safeStr($prop($, 'value'))) = 'true'
+      )
+      and $startsWith($safeStr($prop($, 'label')), 'com.apple.')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Launchd override disables Apple-managed label '{{ $prop($, 'label') }}'"
+  mitigation: "Review override provenance, restore approved launchd settings, and investigate unauthorized local configuration changes."
+  evidence: |
+    {
+      "label": $prop($, 'label'),
+      "key": $prop($, 'key'),
+      "value": $prop($, 'value'),
+      "uid": $prop($, 'uid'),
+      "plistPath": $prop($, 'path')
+    }
+
+- id: OBOM-MAC-005
+  name: "macOS Gatekeeper enforcement is disabled or weakened"
+  description: "Gatekeeper should enforce assessments and identified-developer checks on managed macOS endpoints."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'gatekeeper'
+      and (
+        $safeStr($prop($, 'assessments_enabled')) != '1'
+        or $safeStr($prop($, 'dev_id_enabled')) != '1'
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Gatekeeper posture is weakened (assessments_enabled={{ $prop($, 'assessments_enabled') }}, dev_id_enabled={{ $prop($, 'dev_id_enabled') }})"
+  mitigation: "Re-enable Gatekeeper assessments and identified-developer enforcement with spctl or an MDM configuration profile, then validate the host against baseline policy."
+  evidence: |
+    {
+      "gatekeeperVersion": version,
+      "opaqueVersion": description,
+      "assessmentsEnabled": $prop($, 'assessments_enabled'),
+      "devIdEnabled": $prop($, 'dev_id_enabled')
+    }
+
+- id: OBOM-LNX-014
+  name: "Linux reverse shell behavior detected in live process telemetry"
+  description: "A shell process with a live remote socket is a strong signal for hands-on-keyboard abuse, staging, or remote command execution."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'behavioral_reverse_shell'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Reverse-shell-like process behavior detected for '{{ name }}' reaching {{ $prop($, 'remote_address') }}:{{ $prop($, 'remote_port') }}"
+  mitigation: "Isolate the host, review process lineage and parent shell context, and confirm whether the remote session is expected administrative activity."
+  evidence: |
+    {
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "parentCmdline": $prop($, 'parent_cmdline'),
+      "remoteAddress": $prop($, 'remote_address'),
+      "remotePort": $prop($, 'remote_port')
+    }
+
+- id: OBOM-LNX-015
+  name: "Linux process uses LD_PRELOAD from writable or temporary path"
+  description: "LD_PRELOAD pointing at user-controlled paths can indicate library hijacking, stealth persistence, or runtime tampering."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'ld_preload'
+      and (
+        $contains($lowercase($safeStr($prop($, 'value'))), '/tmp/')
+        or $contains($lowercase($safeStr($prop($, 'value'))), '/var/tmp/')
+        or $contains($lowercase($safeStr($prop($, 'value'))), '/dev/shm/')
+        or $contains($lowercase($safeStr($prop($, 'value'))), '/home/')
+        or $contains($lowercase($safeStr($prop($, 'value'))), '/run/user/')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Process '{{ name }}' sets LD_PRELOAD to a risky path: {{ $prop($, 'value') }}"
+  mitigation: "Review the preload library, remove unauthorized runtime injection, and compare the process with package ownership and startup history."
+  evidence: |
+    {
+      "processPath": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline'),
+      "cwd": $prop($, 'cwd'),
+      "ldPreload": $prop($, 'value')
+    }
+
+- id: OBOM-LNX-016
+  name: "Linux cron entry fetches remote content or runs from writable path"
+  description: "Cron jobs that fetch remote content or execute from temporary and user-writable paths are a high-signal persistence pattern."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'crontab_snapshot'
+      and (
+        (
+          (
+            $contains($lowercase($safeStr($prop($, 'command'))), 'curl ')
+            or $contains($lowercase($safeStr($prop($, 'command'))), 'wget ')
+          )
+          and (
+            $contains($lowercase($safeStr($prop($, 'command'))), 'http://')
+            or $contains($lowercase($safeStr($prop($, 'command'))), 'https://')
+            or $contains($lowercase($safeStr($prop($, 'command'))), '| sh')
+            or $contains($lowercase($safeStr($prop($, 'command'))), '| bash')
+          )
+        )
+        or $contains($lowercase($safeStr($prop($, 'command'))), '/tmp/')
+        or $contains($lowercase($safeStr($prop($, 'command'))), '/var/tmp/')
+        or $contains($lowercase($safeStr($prop($, 'command'))), '/dev/shm/')
+        or $contains($lowercase($safeStr($prop($, 'command'))), '/home/')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Cron entry '{{ name }}' has a risky command: {{ $prop($, 'command') }}"
+  mitigation: "Move bootstrap downloads into a managed deployment path, review cron ownership, and remove unauthorized recurring tasks."
+  evidence: |
+    {
+      "command": $prop($, 'command'),
+      "path": $prop($, 'path'),
+      "minute": $prop($, 'minute'),
+      "hour": $prop($, 'hour')
+    }
+
+- id: OBOM-LNX-017
+  name: "Linux sysctl posture diverges from common hardening baseline"
+  description: "Weak ASLR and redirect-handling sysctl values are commonly called out in Lynis and CIS-style hardening reviews."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'sysctl_hardening'
+      and (
+        (name = 'kernel.randomize_va_space' and $safeStr(version) != '2')
+        or (name = 'kernel.kptr_restrict' and $safeStr(version) = '0')
+        or (
+          (
+            name = 'net.ipv4.conf.all.accept_redirects'
+            or name = 'net.ipv4.conf.default.accept_redirects'
+            or name = 'net.ipv4.conf.all.send_redirects'
+            or name = 'net.ipv4.conf.default.send_redirects'
+          )
+          and $safeStr(version) = '1'
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Sysctl '{{ name }}' has a weak hardening value: {{ version }}"
+  mitigation: "Align the sysctl value with your baseline, apply the setting persistently, and validate whether the deviation is truly required for this host."
+  evidence: |
+    {
+      "sysctl": name,
+      "value": version
+    }
+
+- id: OBOM-LNX-018
+  name: "Linux temporary mount is missing key hardening flags"
+  description: "Temporary and shared-memory mounts should usually carry noexec, nosuid, and nodev protections on hardened hosts."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'mount_hardening'
+      and (
+        name = '/tmp'
+        or name = '/var/tmp'
+        or name = '/dev/shm'
+      )
+      and (
+        $not($contains($lowercase($safeStr(version)), 'noexec'))
+        or $not($contains($lowercase($safeStr(version)), 'nosuid'))
+        or $not($contains($lowercase($safeStr(version)), 'nodev'))
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Mount '{{ name }}' is missing one or more hardening flags: {{ version }}"
+  mitigation: "Review whether the mount should carry noexec, nosuid, and nodev, then enforce the chosen baseline through fstab, systemd mounts, or image build policy."
+  evidence: |
+    {
+      "mount": name,
+      "flags": version,
+      "device": description,
+      "type": $prop($, 'type')
+    }
+
+- id: OBOM-LNX-019
+  name: "Live Linux runtime artifact matches GTFOBins execution helper"
+  description: "GTFOBins-capable binaries in privileged or network-active runtime contexts deserve elevated review because they compress execution, persistence, and lateral movement tradecraft into familiar tools."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $prop($, 'cdx:osquery:category') = 'sudo_executions'
+        or $prop($, 'cdx:osquery:category') = 'privilege_transitions'
+        or $prop($, 'cdx:osquery:category') = 'privileged_listening_ports'
+        or $prop($, 'cdx:osquery:category') = 'behavioral_reverse_shell'
+        or (
+          $prop($, 'cdx:osquery:category') = 'elevated_processes'
+          and (
+            $safeStr($prop($, 'package_source_hint')) = 'user-writable-path'
+            or $contains($nullSafeProp($, 'path'), '/tmp/')
+            or $contains($nullSafeProp($, 'path'), '/var/tmp/')
+            or $contains($nullSafeProp($, 'path'), '/dev/shm/')
+            or $contains($nullSafeProp($, 'path'), '/home/')
+            or $contains($nullSafeProp($, 'path'), '/run/user/')
+            or $contains($nullSafeProp($, 'cmdline'), '/tmp/')
+            or $contains($nullSafeProp($, 'cmdline'), '/var/tmp/')
+            or $contains($nullSafeProp($, 'cmdline'), '/dev/shm/')
+            or $contains($nullSafeProp($, 'cmdline'), '/home/')
+            or $contains($nullSafeProp($, 'cmdline'), '/run/user/')
+          )
+        )
+      )
+      and (
+        $listContains($prop($, 'cdx:gtfobins:functions'), 'shell')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'command')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'reverse-shell')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Runtime artifact '{{ name }}' matches GTFOBins helper(s) {{ $prop($, 'cdx:gtfobins:names') }} in '{{ $prop($, 'cdx:osquery:category') }}'"
+  mitigation: "Validate the binary provenance and operator intent, then review related sudo, privilege-transition, listener, and remote-connection telemetry before suppressing the finding."
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "gtfobinsNames": $prop($, 'cdx:gtfobins:names'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "contexts": $prop($, 'cdx:gtfobins:contexts'),
+      "riskTags": $prop($, 'cdx:gtfobins:riskTags'),
+      "path": $prop($, 'path'),
+      "cmdline": $prop($, 'cmdline')
+    }
+
+- id: OBOM-WIN-011
+  name: "Windows Public profile inbound firewall allow rule"
+  description: "Inbound allow rules on the Public firewall profile can expose services beyond expected trust boundaries."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'windows_firewall_rules'
+      and (
+        $lowercase($safeStr($prop($, 'enabled'))) = '1'
+        or $lowercase($safeStr($prop($, 'enabled'))) = 'true'
+      )
+      and $lowercase($safeStr($prop($, 'direction'))) = 'in'
+      and $lowercase($safeStr($prop($, 'action'))) = 'allow'
+      and $contains($lowercase($safeStr($prop($, 'profile'))), 'public')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Firewall rule '{{ name }}' allows inbound traffic on the Public profile"
+  mitigation: "Narrow the rule scope, move it to a more trusted profile when justified, and verify the backing service really needs public-network reachability."
+  evidence: |
+    {
+      "action": $prop($, 'action'),
+      "direction": $prop($, 'direction'),
+      "profile": $prop($, 'profile'),
+      "localPorts": $prop($, 'local_ports'),
+      "remoteAddresses": $prop($, 'remote_addresses')
+    }
+
+- id: OBOM-WIN-012
+  name: "Windows startup or listener binary has invalid Authenticode status"
+  description: "Persistence and network-facing artifacts backed by definitively invalid Authenticode status deserve urgent review on managed Windows hosts."
+  severity: critical
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+        or $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+        or $prop($, 'cdx:osquery:category') = 'startup_items'
+        or $prop($, 'cdx:osquery:category') = 'services_snapshot'
+        or $prop($, 'cdx:osquery:category') = 'listening_ports'
+      )
+      and $not(
+        $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'image_path'),
+              $prop($, 'executable'),
+              $prop($, 'action'),
+              $prop($, 'module_path'),
+              $prop($, 'path'),
+              description,
+              name
+            )
+          ),
+          '.lnk'
+        )
+      )
+      and $hasProp($, 'cdx:windows:authenticode:status')
+      and $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) != 'valid'
+      and $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) != 'unknown'
+      and $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) != 'unknownerror'
+      and $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) != 'unknown_error'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Windows {{ $prop($, 'cdx:osquery:category') }} registration '{{ $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name) }}' resolves to '{{ $firstNonEmpty($prop($, 'image_path'), $prop($, 'executable'), $prop($, 'action'), $prop($, 'module_path'), $prop($, 'path'), description, name) }}' with Authenticode status {{ $prop($, 'cdx:windows:authenticode:status') }}"
+  mitigation: "Review the startup/listener registration and backing binary together, treat the executable as suspicious until provenance is confirmed, compare the hash and signer with an approved baseline, and investigate who registered the surface."
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "registrationPath": $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name),
+      "targetPath": $firstNonEmpty($prop($, 'image_path'), $prop($, 'executable'), $prop($, 'action'), $prop($, 'module_path'), $prop($, 'path'), description),
+      "path": $prop($, 'path'),
+      "imagePath": $prop($, 'image_path'),
+      "action": $prop($, 'action'),
+      "authenticodeStatus": $prop($, 'cdx:windows:authenticode:status'),
+      "signerSubject": $prop($, 'cdx:windows:authenticode:signerSubject')
+    }
+
+- id: OBOM-WIN-014
+  name: "Windows user-controlled startup or listener binary has unresolved Authenticode status"
+  description: "Unknown Authenticode state on binaries launched from user-controlled startup or network-facing surfaces deserves review even when Windows cannot conclusively mark the signature invalid."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        $prop($, 'cdx:osquery:category') = 'windows_run_keys'
+        or $prop($, 'cdx:osquery:category') = 'scheduled_tasks'
+        or $prop($, 'cdx:osquery:category') = 'startup_items'
+        or $prop($, 'cdx:osquery:category') = 'services_snapshot'
+        or $prop($, 'cdx:osquery:category') = 'listening_ports'
+      )
+      and $not(
+        $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'image_path'),
+              $prop($, 'executable'),
+              $prop($, 'action'),
+              $prop($, 'module_path'),
+              $prop($, 'path'),
+              description,
+              name
+            )
+          ),
+          '.lnk'
+        )
+      )
+      and $hasProp($, 'cdx:windows:authenticode:status')
+      and (
+        $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) = 'unknown'
+        or $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) = 'unknownerror'
+        or $lowercase($safeStr($prop($, 'cdx:windows:authenticode:status'))) = 'unknown_error'
+      )
+      and (
+        $isWindowsUserControlledPath(
+          $firstNonEmpty(
+            $prop($, 'image_path'),
+            $prop($, 'executable'),
+            $prop($, 'action'),
+            description,
+            $prop($, 'path'),
+            name
+          )
+        )
+        or $isWindowsUserControlledPath(
+          $firstNonEmpty($prop($, 'path'), $prop($, 'key'), name)
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Windows {{ $prop($, 'cdx:osquery:category') }} registration '{{ $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name) }}' resolves to '{{ $firstNonEmpty($prop($, 'image_path'), $prop($, 'executable'), $prop($, 'action'), $prop($, 'module_path'), $prop($, 'path'), description, name) }}' with unresolved Authenticode status {{ $prop($, 'cdx:windows:authenticode:status') }}"
+  mitigation: "Review the startup/listener registration and backing binary together, confirm signature collection completed successfully, compare the hash and signer with an approved baseline, and prioritize cleanup of user-controlled execution paths."
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "registrationPath": $firstNonEmpty($prop($, 'key'), $prop($, 'path'), name),
+      "targetPath": $firstNonEmpty($prop($, 'image_path'), $prop($, 'executable'), $prop($, 'action'), $prop($, 'module_path'), $prop($, 'path'), description),
+      "path": $prop($, 'path'),
+      "imagePath": $prop($, 'image_path'),
+      "action": $prop($, 'action'),
+      "authenticodeStatus": $prop($, 'cdx:windows:authenticode:status'),
+      "signerSubject": $prop($, 'cdx:windows:authenticode:signerSubject')
+    }
+
+- id: OBOM-WIN-013
+  name: "Windows host has no active WDAC policies"
+  description: "A managed Windows endpoint with no active WDAC policy loses an important application control and allowlisting layer."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:windows:wdac:activePolicyCount')
+      and $safeStr($prop($, 'cdx:windows:wdac:activePolicyCount')) = '0'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Windows Defender Application Control is not enforcing any active policy on this host"
+  mitigation: "Deploy or restore the approved WDAC policy set and review why policy enforcement is absent on the endpoint."
+  evidence: |
+    {
+      "component": name,
+      "activePolicyCount": $prop($, 'cdx:windows:wdac:activePolicyCount')
+    }
+
+- id: OBOM-MAC-006
+  name: "macOS running app launches from Downloads, Desktop, or temporary path"
+  description: "User-space execution from Downloads, Desktop, or temporary folders is a useful triage signal for ad hoc tooling and unreviewed payloads."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'running_apps'
+      and (
+        $contains($safeStr($prop($, 'bundle_path')), '/Users/')
+        and (
+          $contains($safeStr($prop($, 'bundle_path')), '/Downloads/')
+          or $contains($safeStr($prop($, 'bundle_path')), '/Desktop/')
+          or $contains($safeStr($prop($, 'bundle_path')), '/tmp/')
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Running app '{{ name }}' originates from a risky user path: {{ $prop($, 'bundle_path') }}"
+  mitigation: "Validate the app origin, move approved software into managed application paths, and investigate unexpected user-land execution."
+  evidence: |
+    {
+      "bundlePath": $prop($, 'bundle_path'),
+      "bundleExecutable": $prop($, 'bundle_executable'),
+      "isFinishedLaunching": $prop($, 'is_finished_launching')
+    }
+
+- id: OBOM-MAC-007
+  name: "macOS startup or application artifact failed notarization assessment"
+  description: "Launchd, startup, and application artifacts with rejected notarization assessment deserve review before they are treated as trusted software."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        (
+          (
+            $prop($, 'cdx:osquery:category') = 'launchd_services'
+            or $prop($, 'cdx:osquery:category') = 'startup_items'
+          )
+          and (
+            $not(
+              $isDarwinSystemPath(
+                $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))
+              )
+            )
+            or $not(
+              $isDarwinSystemPath(
+                $firstNonEmpty(
+                  $prop($, 'program'),
+                  $prop($, 'bundle_executable'),
+                  $prop($, 'bundle_path'),
+                  $prop($, 'path')
+                )
+              )
+            )
+          )
+        )
+        or (
+          $prop($, 'cdx:osquery:category') = 'running_apps'
+          and $not(
+            $isDarwinSystemPath(
+              $firstNonEmpty($prop($, 'bundle_path'), $prop($, 'path'))
+            )
+          )
+        )
+      )
+      and $hasProp($, 'cdx:darwin:notarization:assessment')
+      and $lowercase($safeStr($prop($, 'cdx:darwin:notarization:assessment'))) = 'rejected'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "macOS {{ $prop($, 'cdx:osquery:category') }} artifact '{{ name }}' uses registration path '{{ $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'), name) }}' and target '{{ $firstNonEmpty($prop($, 'program'), $prop($, 'bundle_executable'), $prop($, 'bundle_path'), $prop($, 'path'), name) }}' with notarization assessment {{ $prop($, 'cdx:darwin:notarization:assessment') }}"
+  mitigation: "Review the registration/config path and backing executable together, confirm the signer or team identifier against approved inventory, and remove or quarantine unexpected startup items or app bundles."
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "registrationPath": $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path')),
+      "targetPath": $firstNonEmpty($prop($, 'program'), $prop($, 'bundle_executable'), $prop($, 'bundle_path'), $prop($, 'path')),
+      "label": $prop($, 'label'),
+      "path": $prop($, 'path'),
+      "bundlePath": $prop($, 'bundle_path'),
+      "bundleExecutable": $prop($, 'bundle_executable'),
+      "program": $prop($, 'program'),
+      "programArguments": $prop($, 'program_arguments'),
+      "teamIdentifier": $prop($, 'cdx:darwin:codesign:teamIdentifier'),
+      "notarizationAssessment": $prop($, 'cdx:darwin:notarization:assessment')
+    }
+
+- id: OBOM-MAC-008
+  name: "macOS user-controlled startup or application artifact has unknown notarization assessment"
+  description: "Launchd, startup, and application artifacts with unknown notarization assessment should be reviewed when they execute from user-controlled macOS paths."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        (
+          (
+            $prop($, 'cdx:osquery:category') = 'launchd_services'
+            or $prop($, 'cdx:osquery:category') = 'startup_items'
+          )
+          and (
+            $not(
+              $isDarwinSystemPath(
+                $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))
+              )
+            )
+            or $not(
+              $isDarwinSystemPath(
+                $firstNonEmpty(
+                  $prop($, 'program'),
+                  $prop($, 'bundle_executable'),
+                  $prop($, 'bundle_path'),
+                  $prop($, 'path')
+                )
+              )
+            )
+          )
+        )
+        or (
+          $prop($, 'cdx:osquery:category') = 'running_apps'
+          and $not(
+            $isDarwinSystemPath(
+              $firstNonEmpty($prop($, 'bundle_path'), $prop($, 'path'))
+            )
+          )
+        )
+      )
+      and $hasProp($, 'cdx:darwin:notarization:assessment')
+      and $lowercase($safeStr($prop($, 'cdx:darwin:notarization:assessment'))) = 'unknown'
+      and (
+        $contains(
+          $lowercase($firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))),
+          '/users/'
+        )
+        or $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'program'),
+              $prop($, 'bundle_executable'),
+              $prop($, 'bundle_path'),
+              $prop($, 'path')
+            )
+          ),
+          '/users/'
+        )
+        or $contains(
+          $lowercase($firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))),
+          '/downloads/'
+        )
+        or $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'program'),
+              $prop($, 'bundle_executable'),
+              $prop($, 'bundle_path'),
+              $prop($, 'path')
+            )
+          ),
+          '/downloads/'
+        )
+        or $contains(
+          $lowercase($firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))),
+          '/desktop/'
+        )
+        or $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'program'),
+              $prop($, 'bundle_executable'),
+              $prop($, 'bundle_path'),
+              $prop($, 'path')
+            )
+          ),
+          '/desktop/'
+        )
+        or $contains(
+          $lowercase($firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))),
+          '/tmp/'
+        )
+        or $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'program'),
+              $prop($, 'bundle_executable'),
+              $prop($, 'bundle_path'),
+              $prop($, 'path')
+            )
+          ),
+          '/tmp/'
+        )
+        or $contains(
+          $lowercase($firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'))),
+          '/private/var/'
+        )
+        or $contains(
+          $lowercase(
+            $firstNonEmpty(
+              $prop($, 'program'),
+              $prop($, 'bundle_executable'),
+              $prop($, 'bundle_path'),
+              $prop($, 'path')
+            )
+          ),
+          '/private/var/'
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "macOS {{ $prop($, 'cdx:osquery:category') }} artifact '{{ name }}' uses registration path '{{ $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path'), name) }}' and target '{{ $firstNonEmpty($prop($, 'program'), $prop($, 'bundle_executable'), $prop($, 'bundle_path'), $prop($, 'path'), name) }}' with unknown notarization assessment on a user-controlled path"
+  mitigation: "Review the registration/config path and backing executable together, re-check notarization and code-signing metadata, and move approved software out of user-controlled paths before suppressing the finding."
+  evidence: |
+    {
+      "queryCategory": $prop($, 'cdx:osquery:category'),
+      "registrationPath": $firstNonEmpty($prop($, 'path'), $prop($, 'bundle_path')),
+      "targetPath": $firstNonEmpty($prop($, 'program'), $prop($, 'bundle_executable'), $prop($, 'bundle_path'), $prop($, 'path')),
+      "label": $prop($, 'label'),
+      "path": $prop($, 'path'),
+      "bundlePath": $prop($, 'bundle_path'),
+      "bundleExecutable": $prop($, 'bundle_executable'),
+      "program": $prop($, 'program'),
+      "programArguments": $prop($, 'program_arguments'),
+      "teamIdentifier": $prop($, 'cdx:darwin:codesign:teamIdentifier'),
+      "notarizationAssessment": $prop($, 'cdx:darwin:notarization:assessment')
+    }
+
+- id: OBOM-LNX-020
+  name: "Privileged Linux listener exposed on a non-local interface from writable or unclassified path"
+  description: "Root or service-account listeners bound to all interfaces from user-controlled or unclassified paths are high-signal persistence or runtime-drift indicators."
+  severity: high
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'privileged_listening_ports'
+      and (
+        $safeStr($prop($, 'address')) = '0.0.0.0'
+        or $safeStr($prop($, 'address')) = '::'
+      )
+      and $safeStr($prop($, 'port')) != '22'
+      and $safeStr($prop($, 'port')) != '53'
+      and $safeStr(name) != 'systemd-resolved'
+      and $safeStr(name) != 'avahi-daemon'
+      and $safeStr(name) != 'cupsd'
+      and (
+        $safeStr($prop($, 'package_source_hint')) = 'user-writable-path'
+        or $safeStr($prop($, 'package_source_hint')) = 'unclassified-path'
+        or $contains($lowercase($nullSafeProp($, 'path')), '/tmp/')
+        or $contains($lowercase($nullSafeProp($, 'path')), '/var/tmp/')
+        or $contains($lowercase($nullSafeProp($, 'path')), '/dev/shm/')
+        or $contains($lowercase($nullSafeProp($, 'path')), '/home/')
+        or $contains($lowercase($nullSafeProp($, 'path')), '/run/user/')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Privileged listener '{{ name }}' is reachable on {{ $prop($, 'address') }}:{{ $prop($, 'port') }} from risky path '{{ $firstNonEmpty($prop($, 'path'), name) }}'"
+  mitigation: "Treat the listener path as a high-priority review item, validate package ownership and recent changes, and remove or isolate privileged services sourced from writable or unclassified locations."
+  evidence: |
+    {
+      "account": $prop($, 'account'),
+      "pid": $prop($, 'pid'),
+      "address": $prop($, 'address'),
+      "port": $prop($, 'port'),
+      "path": $prop($, 'path'),
+      "serviceUnit": $prop($, 'service_unit'),
+      "packageSourceHint": $prop($, 'package_source_hint'),
+      "parentCmdline": $prop($, 'parent_cmdline')
+    }
+
+- id: OBOM-LNX-021
+  name: "Linux APT source uses plaintext HTTP transport"
+  description: "Plain HTTP APT mirrors weaken transport integrity and are often called out in baseline hardening reviews even when package signatures remain enabled."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        $prop($, 'cdx:osquery:category') = 'apt_sources'
+        or $prop($, 'cdx:osquery:category') = 'apt_ppa_sources'
+      )
+      and $startsWith($lowercase($safeStr($prop($, 'base_uri'))), 'http://')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'source')
+    }
+  message: "APT source '{{ name }}' still uses plaintext HTTP transport: {{ $prop($, 'base_uri') }}"
+  mitigation: "Move the repository to HTTPS or an authenticated local mirror, then confirm the source file and mirror policy match your approved package-trust baseline."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'source'),
+      "baseUri": $prop($, 'base_uri'),
+      "release": $prop($, 'release'),
+      "components": $prop($, 'components'),
+      "maintainer": $prop($, 'maintainer')
+    }
+
+- id: OBOM-LNX-022
+  name: "Linux authorized_keys entry uses deprecated ssh-rsa algorithm"
+  description: "ssh-rsa authorized_keys entries rely on an older signature algorithm profile and should be reviewed during SSH hardening work."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'authorized_keys_snapshot'
+      and $lowercase($safeStr(version)) = 'ssh-rsa'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl,
+      "file": $prop($, 'key_file')
+    }
+  message: "Authorized key for account '{{ name }}' in '{{ $prop($, 'key_file') }}' still uses deprecated ssh-rsa"
+  mitigation: "Replace the key with ed25519 or a modern RSA/SHA-2 compatible key, then re-review key restrictions and account ownership before retaining access."
+  evidence: |
+    {
+      "account": name,
+      "algorithm": version,
+      "keyFile": $prop($, 'key_file'),
+      "comment": description,
+      "uid": $prop($, 'uid')
+    }