@gendigital/sage-openclaw 0.4.4 → 0.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.cjs +2154 -496
- package/dist/index.cjs.map +4 -4
- package/openclaw.plugin.json +1 -1
- package/package.json +24 -8
- package/resources/threats/commands.yaml +51 -1
- package/resources/threats/credentials.yaml +2 -2
- package/resources/threats/files.yaml +14 -22
- package/resources/threats/mac-commands.yaml +355 -0
- package/resources/threats/mac-credentials.yaml +99 -0
- package/resources/threats/mac-files.yaml +124 -0
- package/resources/threats/mac-obfuscation.yaml +92 -0
- package/resources/threats/mac-persistence.yaml +117 -0
- package/resources/threats/mac-supply-chain.yaml +40 -0
- package/resources/threats/obfuscation.yaml +12 -0
- package/resources/threats/persistence.yaml +13 -13
- package/resources/threats/self-defense.yaml +2 -2
- package/resources/threats/win-files.yaml +11 -11
|
@@ -0,0 +1,124 @@
|
|
|
1
|
+
# macOS sensitive file path threat patterns for Sage
|
|
2
|
+
# Author: Gen Digital Inc.
|
|
3
|
+
# License: DRL-1.1 (see threats/LICENSE)
|
|
4
|
+
# Detects Read/Write/Edit/Delete operations targeting macOS security-sensitive files
|
|
5
|
+
|
|
6
|
+
# LaunchAgent/LaunchDaemon plist (migrated from files.yaml CLT-FILE-005)
|
|
7
|
+
- id: "CLT-MAC-FILE-001"
|
|
8
|
+
category: tool
|
|
9
|
+
severity: high
|
|
10
|
+
confidence: 0.90
|
|
11
|
+
action: block
|
|
12
|
+
pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist$"
|
|
13
|
+
match_on: file_path
|
|
14
|
+
title: "Access macOS LaunchAgent/LaunchDaemon plist"
|
|
15
|
+
expires_at: null
|
|
16
|
+
revoked: false
|
|
17
|
+
|
|
18
|
+
# TCC privacy permissions database
|
|
19
|
+
- id: "CLT-MAC-FILE-002"
|
|
20
|
+
category: secrets
|
|
21
|
+
severity: critical
|
|
22
|
+
confidence: 0.95
|
|
23
|
+
action: block
|
|
24
|
+
pattern: "com\\.apple\\.TCC/TCC\\.db"
|
|
25
|
+
match_on: file_path
|
|
26
|
+
title: "Access TCC privacy permissions database"
|
|
27
|
+
expires_at: null
|
|
28
|
+
revoked: false
|
|
29
|
+
|
|
30
|
+
# Authorization database
|
|
31
|
+
- id: "CLT-MAC-FILE-003"
|
|
32
|
+
category: secrets
|
|
33
|
+
severity: critical
|
|
34
|
+
confidence: 0.95
|
|
35
|
+
action: block
|
|
36
|
+
pattern: "(/etc/authorization|/var/db/auth\\.db)"
|
|
37
|
+
match_on: file_path
|
|
38
|
+
title: "Access macOS authorization database"
|
|
39
|
+
expires_at: null
|
|
40
|
+
revoked: false
|
|
41
|
+
|
|
42
|
+
# Kernel extensions
|
|
43
|
+
- id: "CLT-MAC-FILE-004"
|
|
44
|
+
category: tool
|
|
45
|
+
severity: critical
|
|
46
|
+
confidence: 0.90
|
|
47
|
+
action: block
|
|
48
|
+
pattern: "(/Library/Extensions/|/System/Library/Extensions/).*\\.kext"
|
|
49
|
+
match_on: file_path
|
|
50
|
+
title: "Access kernel extension (.kext)"
|
|
51
|
+
expires_at: null
|
|
52
|
+
revoked: false
|
|
53
|
+
|
|
54
|
+
# Security Agent Plugins
|
|
55
|
+
- id: "CLT-MAC-FILE-005"
|
|
56
|
+
category: tool
|
|
57
|
+
severity: critical
|
|
58
|
+
confidence: 0.90
|
|
59
|
+
action: block
|
|
60
|
+
pattern: "/Library/Security/SecurityAgentPlugins/"
|
|
61
|
+
match_on: file_path
|
|
62
|
+
title: "Access SecurityAgentPlugins directory"
|
|
63
|
+
expires_at: null
|
|
64
|
+
revoked: false
|
|
65
|
+
|
|
66
|
+
# Periodic scripts directory
|
|
67
|
+
- id: "CLT-MAC-FILE-006"
|
|
68
|
+
category: tool
|
|
69
|
+
severity: high
|
|
70
|
+
confidence: 0.85
|
|
71
|
+
action: require_approval
|
|
72
|
+
pattern: "/etc/periodic/(daily|weekly|monthly)/"
|
|
73
|
+
match_on: file_path
|
|
74
|
+
title: "Access macOS periodic scripts directory"
|
|
75
|
+
expires_at: null
|
|
76
|
+
revoked: false
|
|
77
|
+
|
|
78
|
+
# Emond rules directory
|
|
79
|
+
- id: "CLT-MAC-FILE-007"
|
|
80
|
+
category: tool
|
|
81
|
+
severity: critical
|
|
82
|
+
confidence: 0.90
|
|
83
|
+
action: block
|
|
84
|
+
pattern: "/etc/emond\\.d/rules/"
|
|
85
|
+
match_on: file_path
|
|
86
|
+
title: "Access Event Monitor daemon rules directory"
|
|
87
|
+
expires_at: null
|
|
88
|
+
revoked: false
|
|
89
|
+
|
|
90
|
+
# Safari credential/cookie stores
|
|
91
|
+
- id: "CLT-MAC-FILE-008"
|
|
92
|
+
category: secrets
|
|
93
|
+
severity: critical
|
|
94
|
+
confidence: 0.90
|
|
95
|
+
action: block
|
|
96
|
+
pattern: "/Safari/(Cookies\\.binarycookies|LastSession\\.plist|Databases|LocalStorage)"
|
|
97
|
+
match_on: file_path
|
|
98
|
+
title: "Access Safari credential/cookie store"
|
|
99
|
+
expires_at: null
|
|
100
|
+
revoked: false
|
|
101
|
+
|
|
102
|
+
# Managed Preferences (MDM profiles)
|
|
103
|
+
- id: "CLT-MAC-FILE-009"
|
|
104
|
+
category: tool
|
|
105
|
+
severity: high
|
|
106
|
+
confidence: 0.85
|
|
107
|
+
action: require_approval
|
|
108
|
+
pattern: "/Library/Managed Preferences/"
|
|
109
|
+
match_on: file_path
|
|
110
|
+
title: "Access Managed Preferences (MDM profile injection)"
|
|
111
|
+
expires_at: null
|
|
112
|
+
revoked: false
|
|
113
|
+
|
|
114
|
+
# Keychain files
|
|
115
|
+
- id: "CLT-MAC-FILE-010"
|
|
116
|
+
category: secrets
|
|
117
|
+
severity: critical
|
|
118
|
+
confidence: 0.90
|
|
119
|
+
action: block
|
|
120
|
+
pattern: "/Library/Keychains/.*\\.keychain"
|
|
121
|
+
match_on: file_path
|
|
122
|
+
title: "Access system Keychain file"
|
|
123
|
+
expires_at: null
|
|
124
|
+
revoked: false
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
# macOS obfuscation threat patterns for Sage
|
|
2
|
+
# Author: Gen Digital Inc.
|
|
3
|
+
# License: DRL-1.1 (see threats/LICENSE)
|
|
4
|
+
|
|
5
|
+
# osascript 'do shell script' wrapping (shell via AppleScript)
|
|
6
|
+
- id: "CLT-MAC-OBFUS-001"
|
|
7
|
+
category: tool
|
|
8
|
+
severity: critical
|
|
9
|
+
confidence: 0.90
|
|
10
|
+
action: block
|
|
11
|
+
pattern: "\\bosascript\\b.*do shell script"
|
|
12
|
+
case_insensitive: true
|
|
13
|
+
match_on: command
|
|
14
|
+
title: "Shell command obfuscated via AppleScript do shell script"
|
|
15
|
+
expires_at: null
|
|
16
|
+
revoked: false
|
|
17
|
+
|
|
18
|
+
# JXA (JavaScript for Automation) execution
|
|
19
|
+
- id: "CLT-MAC-OBFUS-002"
|
|
20
|
+
category: tool
|
|
21
|
+
severity: critical
|
|
22
|
+
confidence: 0.90
|
|
23
|
+
action: block
|
|
24
|
+
pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
|
|
25
|
+
case_insensitive: true
|
|
26
|
+
match_on: command
|
|
27
|
+
title: "JXA inline execution (JavaScript for Automation obfuscation)"
|
|
28
|
+
expires_at: null
|
|
29
|
+
revoked: false
|
|
30
|
+
|
|
31
|
+
# Base64 decode piped to osascript
|
|
32
|
+
- id: "CLT-MAC-OBFUS-003"
|
|
33
|
+
category: tool
|
|
34
|
+
severity: critical
|
|
35
|
+
confidence: 0.95
|
|
36
|
+
action: block
|
|
37
|
+
pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
|
|
38
|
+
match_on: command
|
|
39
|
+
title: "Base64 decode piped to osascript (encoded payload execution)"
|
|
40
|
+
expires_at: null
|
|
41
|
+
revoked: false
|
|
42
|
+
|
|
43
|
+
# DYLD_INSERT_LIBRARIES injection
|
|
44
|
+
- id: "CLT-MAC-OBFUS-004"
|
|
45
|
+
category: tool
|
|
46
|
+
severity: critical
|
|
47
|
+
confidence: 0.90
|
|
48
|
+
action: block
|
|
49
|
+
pattern: "DYLD_INSERT_LIBRARIES=.*\\.(dylib|so)"
|
|
50
|
+
match_on: command
|
|
51
|
+
title: "Dynamic library injection via DYLD_INSERT_LIBRARIES"
|
|
52
|
+
expires_at: null
|
|
53
|
+
revoked: false
|
|
54
|
+
|
|
55
|
+
# Quarantine attribute removal (evasion)
|
|
56
|
+
- id: "CLT-MAC-OBFUS-005"
|
|
57
|
+
category: tool
|
|
58
|
+
severity: high
|
|
59
|
+
confidence: 0.85
|
|
60
|
+
action: require_approval
|
|
61
|
+
pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
|
|
62
|
+
match_on: command
|
|
63
|
+
title: "Quarantine attribute removal (Gatekeeper evasion)"
|
|
64
|
+
expires_at: null
|
|
65
|
+
revoked: false
|
|
66
|
+
|
|
67
|
+
# Python encoded payload moved to obfuscation.yaml (CLT-OBFUS-008)
|
|
68
|
+
|
|
69
|
+
# plutil plist manipulation (payload hiding)
|
|
70
|
+
- id: "CLT-MAC-OBFUS-006"
|
|
71
|
+
category: tool
|
|
72
|
+
severity: high
|
|
73
|
+
confidence: 0.80
|
|
74
|
+
action: require_approval
|
|
75
|
+
pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
|
|
76
|
+
match_on: command
|
|
77
|
+
title: "Plist conversion to binary (payload obfuscation)"
|
|
78
|
+
expires_at: null
|
|
79
|
+
revoked: false
|
|
80
|
+
|
|
81
|
+
# Swift/swiftc inline execution
|
|
82
|
+
- id: "CLT-MAC-OBFUS-007"
|
|
83
|
+
category: tool
|
|
84
|
+
severity: high
|
|
85
|
+
confidence: 0.80
|
|
86
|
+
action: require_approval
|
|
87
|
+
pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
|
|
88
|
+
case_insensitive: true
|
|
89
|
+
match_on: command
|
|
90
|
+
title: "Swift inline execution with system calls"
|
|
91
|
+
expires_at: null
|
|
92
|
+
revoked: false
|
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
# macOS persistence mechanism threat patterns for Sage
|
|
2
|
+
# Author: Gen Digital Inc.
|
|
3
|
+
# License: DRL-1.1 (see threats/LICENSE)
|
|
4
|
+
# Covers: LaunchAgents, Login Items, Authorization plugins, periodic scripts, emond, dylib hijack
|
|
5
|
+
|
|
6
|
+
# LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
|
|
7
|
+
- id: "CLT-MAC-PERSIST-001"
|
|
8
|
+
category: tool
|
|
9
|
+
severity: high
|
|
10
|
+
confidence: 0.90
|
|
11
|
+
action: block
|
|
12
|
+
pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist"
|
|
13
|
+
match_on: command
|
|
14
|
+
title: "macOS LaunchAgent/LaunchDaemon persistence"
|
|
15
|
+
expires_at: null
|
|
16
|
+
revoked: false
|
|
17
|
+
|
|
18
|
+
# Login Items via osascript
|
|
19
|
+
- id: "CLT-MAC-PERSIST-002"
|
|
20
|
+
category: tool
|
|
21
|
+
severity: high
|
|
22
|
+
confidence: 0.85
|
|
23
|
+
action: require_approval
|
|
24
|
+
pattern: "\\bosascript\\b.*login item"
|
|
25
|
+
case_insensitive: true
|
|
26
|
+
match_on: command
|
|
27
|
+
title: "Add login item via osascript"
|
|
28
|
+
expires_at: null
|
|
29
|
+
revoked: false
|
|
30
|
+
|
|
31
|
+
# Login window manipulation via defaults
|
|
32
|
+
- id: "CLT-MAC-PERSIST-003"
|
|
33
|
+
category: tool
|
|
34
|
+
severity: high
|
|
35
|
+
confidence: 0.85
|
|
36
|
+
action: require_approval
|
|
37
|
+
pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
|
|
38
|
+
case_insensitive: true
|
|
39
|
+
match_on: command
|
|
40
|
+
title: "Login window hook manipulation via defaults write"
|
|
41
|
+
expires_at: null
|
|
42
|
+
revoked: false
|
|
43
|
+
|
|
44
|
+
# Authorization plugin persistence
|
|
45
|
+
- id: "CLT-MAC-PERSIST-004"
|
|
46
|
+
category: tool
|
|
47
|
+
severity: critical
|
|
48
|
+
confidence: 0.90
|
|
49
|
+
action: block
|
|
50
|
+
pattern: "/Library/Security/SecurityAgentPlugins/"
|
|
51
|
+
match_on: command
|
|
52
|
+
title: "Authorization plugin drop in SecurityAgentPlugins"
|
|
53
|
+
expires_at: null
|
|
54
|
+
revoked: false
|
|
55
|
+
|
|
56
|
+
# Periodic script drop
|
|
57
|
+
- id: "CLT-MAC-PERSIST-005"
|
|
58
|
+
category: tool
|
|
59
|
+
severity: high
|
|
60
|
+
confidence: 0.85
|
|
61
|
+
action: require_approval
|
|
62
|
+
pattern: "/etc/periodic/(daily|weekly|monthly)/"
|
|
63
|
+
match_on: command
|
|
64
|
+
title: "Periodic script persistence drop"
|
|
65
|
+
expires_at: null
|
|
66
|
+
revoked: false
|
|
67
|
+
|
|
68
|
+
# at job scheduling moved to persistence.yaml (CLT-PERSIST-008)
|
|
69
|
+
|
|
70
|
+
# emond rules
|
|
71
|
+
- id: "CLT-MAC-PERSIST-006"
|
|
72
|
+
category: tool
|
|
73
|
+
severity: critical
|
|
74
|
+
confidence: 0.90
|
|
75
|
+
action: block
|
|
76
|
+
pattern: "/etc/emond\\.d/rules/"
|
|
77
|
+
match_on: command
|
|
78
|
+
title: "Event Monitor daemon rules persistence"
|
|
79
|
+
expires_at: null
|
|
80
|
+
revoked: false
|
|
81
|
+
|
|
82
|
+
# DYLD_INSERT_LIBRARIES in RC files
|
|
83
|
+
- id: "CLT-MAC-PERSIST-007"
|
|
84
|
+
category: tool
|
|
85
|
+
severity: critical
|
|
86
|
+
confidence: 0.90
|
|
87
|
+
action: block
|
|
88
|
+
pattern: "DYLD_INSERT_LIBRARIES"
|
|
89
|
+
match_on: command
|
|
90
|
+
title: "DYLD_INSERT_LIBRARIES dylib injection (persistence/hijack)"
|
|
91
|
+
expires_at: null
|
|
92
|
+
revoked: false
|
|
93
|
+
|
|
94
|
+
# Folder Actions via osascript
|
|
95
|
+
- id: "CLT-MAC-PERSIST-008"
|
|
96
|
+
category: tool
|
|
97
|
+
severity: high
|
|
98
|
+
confidence: 0.85
|
|
99
|
+
action: require_approval
|
|
100
|
+
pattern: "\\bosascript\\b.*folder action"
|
|
101
|
+
case_insensitive: true
|
|
102
|
+
match_on: command
|
|
103
|
+
title: "Folder Action script persistence via osascript"
|
|
104
|
+
expires_at: null
|
|
105
|
+
revoked: false
|
|
106
|
+
|
|
107
|
+
# launchctl load/bootstrap persistent agent
|
|
108
|
+
- id: "CLT-MAC-PERSIST-009"
|
|
109
|
+
category: tool
|
|
110
|
+
severity: high
|
|
111
|
+
confidence: 0.85
|
|
112
|
+
action: require_approval
|
|
113
|
+
pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
|
|
114
|
+
match_on: command
|
|
115
|
+
title: "Load persistent launch agent/daemon via launchctl"
|
|
116
|
+
expires_at: null
|
|
117
|
+
revoked: false
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
# macOS supply chain threat patterns for Sage
|
|
2
|
+
# Author: Gen Digital Inc.
|
|
3
|
+
# License: DRL-1.1 (see threats/LICENSE)
|
|
4
|
+
|
|
5
|
+
# brew install without version pin
|
|
6
|
+
- id: "CLT-MAC-SUPPLY-001"
|
|
7
|
+
category: supply_chain
|
|
8
|
+
severity: medium
|
|
9
|
+
confidence: 0.65
|
|
10
|
+
action: require_approval
|
|
11
|
+
pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
|
|
12
|
+
match_on: command
|
|
13
|
+
title: "Homebrew install without version pin"
|
|
14
|
+
expires_at: null
|
|
15
|
+
revoked: false
|
|
16
|
+
|
|
17
|
+
# installer -pkg from remote URL
|
|
18
|
+
- id: "CLT-MAC-SUPPLY-002"
|
|
19
|
+
category: supply_chain
|
|
20
|
+
severity: high
|
|
21
|
+
confidence: 0.85
|
|
22
|
+
action: block
|
|
23
|
+
pattern: "\\binstaller\\b.*-pkg.*https?://"
|
|
24
|
+
case_insensitive: true
|
|
25
|
+
match_on: command
|
|
26
|
+
title: "Remote package install via installer -pkg (unsigned)"
|
|
27
|
+
expires_at: null
|
|
28
|
+
revoked: false
|
|
29
|
+
|
|
30
|
+
# brew install --cask from non-default tap
|
|
31
|
+
- id: "CLT-MAC-SUPPLY-003"
|
|
32
|
+
category: supply_chain
|
|
33
|
+
severity: medium
|
|
34
|
+
confidence: 0.65
|
|
35
|
+
action: require_approval
|
|
36
|
+
pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
|
|
37
|
+
match_on: command
|
|
38
|
+
title: "Homebrew cask install (binary application)"
|
|
39
|
+
expires_at: null
|
|
40
|
+
revoked: false
|
|
@@ -84,3 +84,15 @@
|
|
|
84
84
|
title: "Function redefinition of security-relevant command"
|
|
85
85
|
expires_at: null
|
|
86
86
|
revoked: false
|
|
87
|
+
|
|
88
|
+
# --- Python encoded payload execution ---
|
|
89
|
+
- id: "CLT-OBFUS-008"
|
|
90
|
+
category: tool
|
|
91
|
+
severity: critical
|
|
92
|
+
confidence: 0.85
|
|
93
|
+
action: block
|
|
94
|
+
pattern: "python[23]?\\s+-c\\s+[\"'].*\\b(exec|eval|compile|__import__)\\b.*\\b(base64|decode|decompress)\\b"
|
|
95
|
+
match_on: command
|
|
96
|
+
title: "Python encoded payload execution via -c"
|
|
97
|
+
expires_at: null
|
|
98
|
+
revoked: false
|
|
@@ -38,18 +38,6 @@
|
|
|
38
38
|
expires_at: null
|
|
39
39
|
revoked: false
|
|
40
40
|
|
|
41
|
-
# --- macOS LaunchAgent/LaunchDaemon ---
|
|
42
|
-
- id: "CLT-PERSIST-004"
|
|
43
|
-
category: tool
|
|
44
|
-
severity: high
|
|
45
|
-
confidence: 0.90
|
|
46
|
-
action: block
|
|
47
|
-
pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist"
|
|
48
|
-
match_on: command
|
|
49
|
-
title: "macOS LaunchAgent/LaunchDaemon persistence"
|
|
50
|
-
expires_at: null
|
|
51
|
-
revoked: false
|
|
52
|
-
|
|
53
41
|
# --- systemd service manipulation ---
|
|
54
42
|
- id: "CLT-PERSIST-005"
|
|
55
43
|
category: tool
|
|
@@ -68,7 +56,7 @@
|
|
|
68
56
|
severity: critical
|
|
69
57
|
confidence: 0.95
|
|
70
58
|
action: block
|
|
71
|
-
pattern: ">>\\s
|
|
59
|
+
pattern: ">>\\s*(~|\\/(root|home\\/[a-zA-Z0-9._-]{1,32}))?/?\\.ssh/authorized_keys"
|
|
72
60
|
match_on: command
|
|
73
61
|
title: "Append to SSH authorized_keys (unauthorized access persistence)"
|
|
74
62
|
expires_at: null
|
|
@@ -85,3 +73,15 @@
|
|
|
85
73
|
title: "Echo/printf append to shell RC file (code injection persistence)"
|
|
86
74
|
expires_at: null
|
|
87
75
|
revoked: false
|
|
76
|
+
|
|
77
|
+
# --- at job scheduling ---
|
|
78
|
+
- id: "CLT-PERSIST-008"
|
|
79
|
+
category: tool
|
|
80
|
+
severity: high
|
|
81
|
+
confidence: 0.80
|
|
82
|
+
action: require_approval
|
|
83
|
+
pattern: "\\bat\\b\\s+(-f\\s+|now|midnight|noon|teatime)"
|
|
84
|
+
match_on: command
|
|
85
|
+
title: "At-job scheduling (persistence)"
|
|
86
|
+
expires_at: null
|
|
87
|
+
revoked: false
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
expires_at: null
|
|
18
18
|
revoked: false
|
|
19
19
|
|
|
20
|
-
#
|
|
20
|
+
# Access Sage config files
|
|
21
21
|
- id: "CLT-SELF-002"
|
|
22
22
|
category: self_defense
|
|
23
23
|
severity: high
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
action: require_approval
|
|
26
26
|
pattern: "\\.sage[\\\\/](allowlist|config)\\.json"
|
|
27
27
|
match_on: file_path
|
|
28
|
-
title: "
|
|
28
|
+
title: "Access Sage configuration files"
|
|
29
29
|
expires_at: null
|
|
30
30
|
revoked: false
|
|
31
31
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# Windows sensitive file path threat patterns for Sage
|
|
2
2
|
# Author: Gen Digital Inc.
|
|
3
3
|
# License: DRL-1.1 (see threats/LICENSE)
|
|
4
|
-
# Detects Write/Edit operations targeting Windows security-sensitive files
|
|
4
|
+
# Detects Read/Write/Edit/Delete operations targeting Windows security-sensitive files
|
|
5
5
|
|
|
6
6
|
# SAM/SECURITY/SYSTEM hive
|
|
7
7
|
- id: "CLT-WIN-FILE-001"
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
action: block
|
|
12
12
|
pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)config(\\\\|/)(SAM|SECURITY|SYSTEM)"
|
|
13
13
|
match_on: file_path
|
|
14
|
-
title: "
|
|
14
|
+
title: "Access SAM/SECURITY/SYSTEM registry hive"
|
|
15
15
|
expires_at: null
|
|
16
16
|
revoked: false
|
|
17
17
|
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
action: block
|
|
24
24
|
pattern: "[Nn][Tt][Dd][Ss]\\.[Dd][Ii][Tt]"
|
|
25
25
|
match_on: file_path
|
|
26
|
-
title: "
|
|
26
|
+
title: "Access NTDS.dit (Active Directory database)"
|
|
27
27
|
expires_at: null
|
|
28
28
|
revoked: false
|
|
29
29
|
|
|
@@ -35,7 +35,7 @@
|
|
|
35
35
|
action: require_approval
|
|
36
36
|
pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/)etc(\\\\|/)hosts"
|
|
37
37
|
match_on: file_path
|
|
38
|
-
title: "
|
|
38
|
+
title: "Access Windows hosts file"
|
|
39
39
|
expires_at: null
|
|
40
40
|
revoked: false
|
|
41
41
|
|
|
@@ -47,7 +47,7 @@
|
|
|
47
47
|
action: require_approval
|
|
48
48
|
pattern: "(\\\\|/)(Startup|Start Menu(\\\\|/)Programs(\\\\|/)Startup)(\\\\|/)"
|
|
49
49
|
match_on: file_path
|
|
50
|
-
title: "
|
|
50
|
+
title: "Access Windows Startup folder"
|
|
51
51
|
expires_at: null
|
|
52
52
|
revoked: false
|
|
53
53
|
|
|
@@ -59,7 +59,7 @@
|
|
|
59
59
|
action: block
|
|
60
60
|
pattern: "(\\\\|/)Windows(\\\\|/)(System32|SysWOW64)(\\\\|/).*\\.(bat|cmd|ps1|vbs|wsf)$"
|
|
61
61
|
match_on: file_path
|
|
62
|
-
title: "
|
|
62
|
+
title: "Access executable script in System32/SysWOW64"
|
|
63
63
|
expires_at: null
|
|
64
64
|
revoked: false
|
|
65
65
|
|
|
@@ -71,7 +71,7 @@
|
|
|
71
71
|
action: block
|
|
72
72
|
pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/).*\\.sys$"
|
|
73
73
|
match_on: file_path
|
|
74
|
-
title: "
|
|
74
|
+
title: "Access driver file in System32/drivers"
|
|
75
75
|
expires_at: null
|
|
76
76
|
revoked: false
|
|
77
77
|
|
|
@@ -83,7 +83,7 @@
|
|
|
83
83
|
action: require_approval
|
|
84
84
|
pattern: "(Windows|WINDOWS)[/\\\\]System32[/\\\\]Tasks[/\\\\]"
|
|
85
85
|
match_on: file_path
|
|
86
|
-
title: "
|
|
86
|
+
title: "Access Windows Task Scheduler directory"
|
|
87
87
|
expires_at: null
|
|
88
88
|
revoked: false
|
|
89
89
|
|
|
@@ -95,7 +95,7 @@
|
|
|
95
95
|
action: require_approval
|
|
96
96
|
pattern: "\\.ssh[\\\\](id_rsa|id_ed25519|id_ecdsa|id_dsa|config|authorized_keys)$"
|
|
97
97
|
match_on: file_path
|
|
98
|
-
title: "
|
|
98
|
+
title: "Access SSH key or config file (Windows path)"
|
|
99
99
|
expires_at: null
|
|
100
100
|
revoked: false
|
|
101
101
|
|
|
@@ -107,7 +107,7 @@
|
|
|
107
107
|
action: require_approval
|
|
108
108
|
pattern: "\\.aws[\\\\]credentials$"
|
|
109
109
|
match_on: file_path
|
|
110
|
-
title: "
|
|
110
|
+
title: "Access AWS credentials file (Windows path)"
|
|
111
111
|
expires_at: null
|
|
112
112
|
revoked: false
|
|
113
113
|
|
|
@@ -119,6 +119,6 @@
|
|
|
119
119
|
action: block
|
|
120
120
|
pattern: "(Google[/\\\\]Chrome|Mozilla[/\\\\]Firefox|Microsoft[/\\\\]Edge)[/\\\\].*[/\\\\](Login Data|logins\\.json|Cookies)$"
|
|
121
121
|
match_on: file_path
|
|
122
|
-
title: "
|
|
122
|
+
title: "Access browser credential store"
|
|
123
123
|
expires_at: null
|
|
124
124
|
revoked: false
|