@gendigital/sage-opencode 0.10.0 → 0.11.0

package/resources/threats/mac-commands.yaml

@@ -10,7 +10,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bosascript\\b.*-e.*do shell script"
   case_insensitive: true
   match_on: command
@@ -23,7 +22,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*-l\\s+JavaScript"
   case_insensitive: true
   match_on: command
@@ -36,7 +34,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\|\\s*osascript"
   match_on: command
   title: "Piped input to osascript (stdin AppleScript execution)"
@@ -48,7 +45,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(curl|wget).*\\|.*osascript|osascript.*(curl|wget)"
   case_insensitive: true
   match_on: command
@@ -61,9 +57,8 @@
 # open -a Terminal (launch Terminal with script)
 - id: "CLT-MAC-CMD-005"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bopen\\s+-a\\s+Terminal"
   match_on: command
   title: "Launch Terminal application via open -a"
@@ -73,9 +68,8 @@
 # open with hidden/background flags
 - id: "CLT-MAC-CMD-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bopen\\s+(-[jg]|--hide|--background)"
   match_on: command
   title: "Launch application hidden/background via open"
@@ -87,9 +81,8 @@
 # dscl user/group manipulation
 - id: "CLT-MAC-CMD-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bdscl\\b.*(-create|-delete|-passwd|-append)"
   match_on: command
   title: "Directory Services user/group manipulation via dscl"
@@ -99,9 +92,8 @@
 # networksetup proxy/DNS manipulation
 - id: "CLT-MAC-CMD-008"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bnetworksetup\\b.*(-setwebproxy|-setsocksfirewallproxy|-setdnsservers|-setautoproxyurl)"
   case_insensitive: true
   match_on: command
@@ -114,7 +106,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsystemsetup\\b.*(-setremotelogin\\s+on|-setwakeonnetworkaccess\\s+on)"
   case_insensitive: true
   match_on: command
@@ -127,7 +118,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "kickstart.*-activate.*-configure"
   case_insensitive: true
   match_on: command
@@ -138,9 +128,8 @@
 # installer -pkg -target / (silent package install)
 - id: "CLT-MAC-CMD-011"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\binstaller\\b.*-pkg.*-target"
   case_insensitive: true
   match_on: command
@@ -151,9 +140,8 @@
 # hdiutil mount remote DMG
 - id: "CLT-MAC-CMD-012"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bhdiutil\\b.*\\b(attach|mount)\\b.*https?://"
   case_insensitive: true
   match_on: command
@@ -164,9 +152,8 @@
 # pkgutil --forget (package receipt manipulation)
 - id: "CLT-MAC-CMD-013"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bpkgutil\\b.*--forget"
   match_on: command
   title: "Package receipt removal via pkgutil --forget"
@@ -180,7 +167,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bdiskutil\\b.*\\b(eraseDisk|partitionDisk|secureErase)\\b"
   match_on: command
   title: "Disk erase/partition via diskutil"
@@ -192,7 +178,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\btmutil\\b.*\\b(delete|disable)\\b"
   match_on: command
   title: "Time Machine backup deletion/disable via tmutil (ransomware indicator)"
@@ -206,7 +191,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bspctl\\b.*--master-disable"
   match_on: command
   title: "Gatekeeper disable via spctl --master-disable"
@@ -218,7 +202,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bcsrutil\\b.*\\bdisable\\b"
   match_on: command
   title: "System Integrity Protection disable via csrutil"
@@ -230,7 +213,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdefaults\\b.*\\bwrite\\b.*LSQuarantine"
   case_insensitive: true
   match_on: command
@@ -241,9 +223,8 @@
 # xattr -d com.apple.quarantine (quarantine removal)
 - id: "CLT-MAC-CMD-019"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bxattr\\b.*-d.*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal via xattr"
@@ -255,7 +236,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bpfctl\\b.*\\s-d\\b"
   match_on: command
   title: "Packet filter (firewall) disable via pfctl -d"
@@ -267,7 +247,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\btccutil\\b.*\\breset\\b"
   match_on: command
   title: "TCC privacy permissions reset via tccutil"
@@ -279,7 +258,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\blaunchctl\\b.*\\b(unload|bootout)\\b.*(com\\.apple\\.MRT|com\\.apple\\.XProtect|com\\.apple\\.security)"
   case_insensitive: true
   match_on: command
@@ -292,7 +270,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdefaults\\b.*\\bwrite\\b.*(com\\.apple\\.Finder\\s+AppleShowAllFiles|com\\.apple\\.LaunchServices\\s+LSQuarantine|com\\.apple\\.loginwindow)"
   case_insensitive: true
   match_on: command
@@ -307,7 +284,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdscl\\b.*\\s-passwd\\b"
   match_on: command
   title: "User password change via dscl"
@@ -319,7 +295,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bdseditgroup\\b.*-o\\s+edit.*-a.*admin"
   match_on: command
   title: "Add user to admin group via dseditgroup"
@@ -329,9 +304,8 @@
 # createhomedir — create home directory for arbitrary user
 - id: "CLT-MAC-CMD-026"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bcreatehomedir\\b"
   match_on: command
   title: "Create home directory for user via createhomedir"
@@ -345,9 +319,8 @@
 # screencapture to remote or hidden location
 - id: "CLT-MAC-CMD-027"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bscreencapture\\b.*(-x|-C)"
   match_on: command
   title: "Silent screen capture via screencapture"

package/resources/threats/mac-credentials.yaml

@@ -7,7 +7,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bfind-generic-password\\b.*-w"
   match_on: command
   title: "Keychain password extraction via security find-generic-password"
@@ -19,7 +18,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bfind-internet-password\\b.*-w"
   match_on: command
   title: "Keychain internet password extraction via security find-internet-password"
@@ -31,7 +29,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bdump-keychain\\b"
   match_on: command
   title: "Full keychain dump via security dump-keychain"
@@ -43,7 +40,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsecurity\\b.*\\bunlock-keychain\\b.*-p"
   match_on: command
   title: "Keychain unlock with plaintext password"
@@ -53,9 +49,8 @@
 # Keychain export
 - id: "CLT-MAC-CRED-005"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bsecurity\\b.*\\bexport\\b.*-k"
   match_on: command
   title: "Keychain item export via security export"
@@ -67,7 +62,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsecurity\\b.*\\bdelete-keychain\\b"
   match_on: command
   title: "Keychain deletion via security delete-keychain"
@@ -77,9 +71,8 @@
 # Directory Services auth data read
 - id: "CLT-MAC-CRED-007"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bdscl\\b.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
   match_on: command
   title: "Read user authentication data via dscl"
@@ -91,7 +84,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsqlite3\\b.*(/Library/Keychains/|login\\.keychain)"
   match_on: command
   title: "Direct Keychain database access via sqlite3"

package/resources/threats/mac-files.yaml

@@ -6,9 +6,8 @@
 # LaunchAgent/LaunchDaemon plist (migrated from files.yaml CLT-FILE-005)
 - id: "CLT-MAC-FILE-001"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.90
-  action: block
   pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist$"
   match_on: file_path
   title: "Access macOS LaunchAgent/LaunchDaemon plist"
@@ -20,7 +19,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "com\\.apple\\.TCC/TCC\\.db"
   match_on: file_path
   title: "Access TCC privacy permissions database"
@@ -32,7 +30,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "(/etc/authorization|/var/db/auth\\.db)"
   match_on: file_path
   title: "Access macOS authorization database"
@@ -44,7 +41,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(/Library/Extensions/|/System/Library/Extensions/).*\\.kext"
   match_on: file_path
   title: "Access kernel extension (.kext)"
@@ -56,7 +52,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Library/Security/SecurityAgentPlugins/"
   match_on: file_path
   title: "Access SecurityAgentPlugins directory"
@@ -66,9 +61,8 @@
 # Periodic scripts directory
 - id: "CLT-MAC-FILE-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/periodic/(daily|weekly|monthly)/"
   match_on: file_path
   title: "Access macOS periodic scripts directory"
@@ -80,7 +74,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/etc/emond\\.d/rules/"
   match_on: file_path
   title: "Access Event Monitor daemon rules directory"
@@ -92,7 +85,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Safari/(Cookies\\.binarycookies|LastSession\\.plist|Databases|LocalStorage)"
   match_on: file_path
   title: "Access Safari credential/cookie store"
@@ -102,9 +94,8 @@
 # Managed Preferences (MDM profiles)
 - id: "CLT-MAC-FILE-009"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/Library/Managed Preferences/"
   match_on: file_path
   title: "Access Managed Preferences (MDM profile injection)"
@@ -116,7 +107,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Library/Keychains/.*\\.keychain"
   match_on: file_path
   title: "Access system Keychain file"

package/resources/threats/mac-obfuscation.yaml

@@ -7,7 +7,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*do shell script"
   case_insensitive: true
   match_on: command
@@ -20,7 +19,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
   case_insensitive: true
   match_on: command
@@ -33,7 +31,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
   match_on: command
   title: "Base64 decode piped to osascript (encoded payload execution)"
@@ -45,7 +42,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "DYLD_INSERT_LIBRARIES=.*\\.(dylib|so)"
   match_on: command
   title: "Dynamic library injection via DYLD_INSERT_LIBRARIES"
@@ -55,9 +51,8 @@
 # Quarantine attribute removal (evasion)
 - id: "CLT-MAC-OBFUS-005"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal (Gatekeeper evasion)"
@@ -69,9 +64,8 @@
 # plutil plist manipulation (payload hiding)
 - id: "CLT-MAC-OBFUS-006"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
   match_on: command
   title: "Plist conversion to binary (payload obfuscation)"
@@ -81,9 +75,8 @@
 # Swift/swiftc inline execution
 - id: "CLT-MAC-OBFUS-007"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
   case_insensitive: true
   match_on: command

package/resources/threats/mac-persistence.yaml

@@ -6,9 +6,8 @@
 # LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
 - id: "CLT-MAC-PERSIST-001"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.90
-  action: block
   pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist"
   match_on: command
   title: "macOS LaunchAgent/LaunchDaemon persistence"
@@ -18,9 +17,8 @@
 # Login Items via osascript
 - id: "CLT-MAC-PERSIST-002"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bosascript\\b.*login item"
   case_insensitive: true
   match_on: command
@@ -31,9 +29,8 @@
 # Login window manipulation via defaults
 - id: "CLT-MAC-PERSIST-003"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
   case_insensitive: true
   match_on: command
@@ -46,7 +43,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Library/Security/SecurityAgentPlugins/"
   match_on: command
   title: "Authorization plugin drop in SecurityAgentPlugins"
@@ -56,9 +52,8 @@
 # Periodic script drop
 - id: "CLT-MAC-PERSIST-005"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/periodic/(daily|weekly|monthly)/"
   match_on: command
   title: "Periodic script persistence drop"
@@ -72,7 +67,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/etc/emond\\.d/rules/"
   match_on: command
   title: "Event Monitor daemon rules persistence"
@@ -84,7 +78,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "DYLD_INSERT_LIBRARIES"
   match_on: command
   title: "DYLD_INSERT_LIBRARIES dylib injection (persistence/hijack)"
@@ -94,9 +87,8 @@
 # Folder Actions via osascript
 - id: "CLT-MAC-PERSIST-008"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bosascript\\b.*folder action"
   case_insensitive: true
   match_on: command
@@ -107,9 +99,8 @@
 # launchctl load/bootstrap persistent agent
 - id: "CLT-MAC-PERSIST-009"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
   match_on: command
   title: "Load persistent launch agent/daemon via launchctl"

package/resources/threats/mac-supply-chain.yaml

@@ -5,9 +5,8 @@
 # brew install without version pin
 - id: "CLT-MAC-SUPPLY-001"
   category: supply_chain
-  severity: medium
-  confidence: 0.65
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
   match_on: command
   title: "Homebrew install without version pin"
@@ -17,9 +16,8 @@
 # installer -pkg from remote URL
 - id: "CLT-MAC-SUPPLY-002"
   category: supply_chain
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\binstaller\\b.*-pkg.*https?://"
   case_insensitive: true
   match_on: command
@@ -30,9 +28,8 @@
 # brew install --cask from non-default tap
 - id: "CLT-MAC-SUPPLY-003"
   category: supply_chain
-  severity: medium
-  confidence: 0.65
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
   match_on: command
   title: "Homebrew cask install (binary application)"