@gendigital/sage-opencode 0.11.0 → 0.13.0

package/resources/threats/obfuscation.yaml

@@ -4,10 +4,14 @@
 
 # --- Base64 decode piped to shell ---
 - id: "CLT-OBFUS-001"
+  version: 1
+  detection_name: "CMD:SageObfuscation-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on both sides of the pipe, same shape as
+  # CLT-CMD-009. Had no boundary at all.
+  pattern: "{{CMD_POS}}base64{{NOT_FILENAME}}\\s+(-d|--decode)\\s*\\|\\s*(?:{{SHELLS}}){{NOT_FILENAME}}"
   match_on: command
   title: "Base64 decode piped to shell execution"
   expires_at: null
@@ -15,10 +19,14 @@
 
 # --- Hex escape sequences in printf ---
 - id: "CLT-OBFUS-002"
+  version: 1
+  detection_name: "CMD:SageObfuscation-B [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "printf\\s+[\"']\\\\x[0-9a-fA-F]{2}(\\\\x[0-9a-fA-F]{2}){3,}"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}printf{{NOT_FILENAME}}\\s+[\"']\\\\x[0-9a-fA-F]{2}(\\\\x[0-9a-fA-F]{2}){3,}"
   match_on: command
   title: "Hex escape sequences in printf (potential obfuscation)"
   expires_at: null
@@ -26,10 +34,12 @@
 
 # --- Reversed string piped to shell ---
 - id: "CLT-OBFUS-003"
+  version: 1
+  detection_name: "CMD:SageObfuscation-C [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\|\\s*rev\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  pattern: "\\|\\s*rev\\s*\\|\\s*(?:{{SHELLS}})"
   match_on: command
   title: "Reversed string piped to shell execution"
   expires_at: null
@@ -37,10 +47,15 @@
 
 # --- Eval with decode ---
 - id: "CLT-OBFUS-004"
+  version: 1
+  detection_name: "CMD:SageObfuscation-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\beval\\s+.*\\$\\(\\s*base64|python[3]?\\s+-c\\s+[\"'].*exec\\(.*decode"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on both branches, same shape as
+  # CLT-CMD-009. `eval` had only a bare `\b`; `python` had no boundary at
+  # all.
+  pattern: "{{CMD_POS}}eval{{NOT_FILENAME}}\\s+.*\\$\\(\\s*base64|{{CMD_POS}}python[3]?{{NOT_FILENAME}}\\s+-c\\s+[\"'].*exec\\(.*decode"
   match_on: [command, content]
   title: "Eval with decode (obfuscated code execution)"
   expires_at: null
@@ -48,10 +63,12 @@
 
 # --- Shell metacharacter escaping ---
 - id: "CLT-OBFUS-005"
+  version: 1
+  detection_name: "CMD:SageObfuscation-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\|\\s*[\\\\'\"]+(bash|sh|zsh|ksh|dash)[\\\\'\"]*(\\s|$)"
+  pattern: "\\|\\s*[\\\\'\"]+(?:{{SHELLS}})[\\\\'\"]*(\\s|$)"
   match_on: command
   title: "Shell metacharacter escaping to hide pipe target"
   expires_at: null
@@ -59,20 +76,24 @@
 
 # --- Alias/function redefinition ---
 - id: "CLT-OBFUS-006"
+  version: 1
+  detection_name: "CMD:SageObfuscation-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\balias\\s+(bash|sh|zsh|curl|wget|nc|netcat|python|ruby|perl|node)="
+  pattern: "\\balias\\s+(?:{{SHELLS}}|curl|wget|nc|netcat|python|ruby|perl|node)="
   match_on: command
   title: "Alias redefinition of security-relevant command"
   expires_at: null
   revoked: false
 
 - id: "CLT-OBFUS-007"
+  version: 1
+  detection_name: "CMD:SageObfuscation-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b(function\\s+)?(bash|sh|curl|wget|nc|python|ruby|perl|node)\\s*\\(\\s*\\)"
+  pattern: "\\b(function\\s+)?(?:{{SHELLS}}|curl|wget|nc|python|ruby|perl|node)\\s*\\(\\s*\\)"
   match_on: command
   title: "Function redefinition of security-relevant command"
   expires_at: null
@@ -80,10 +101,14 @@
 
 # --- Python encoded payload execution ---
 - id: "CLT-OBFUS-008"
+  version: 1
+  detection_name: "CMD:SageObfuscation-H [Heur]"
   category: tool
   severity: critical
   confidence: 0.85
-  pattern: "python[23]?\\s+-c\\s+[\"'].*\\b(exec|eval|compile|__import__)\\b.*\\b(base64|decode|decompress)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}python[23]?{{NOT_FILENAME}}\\s+-c\\s+[\"'].*\\b(exec|eval|compile|__import__)\\b.*\\b(base64|decode|decompress)\\b"
   match_on: command
   title: "Python encoded payload execution via -c"
   expires_at: null

package/resources/threats/persistence.yaml

@@ -4,10 +4,16 @@
 
 # --- Shell RC file modification ---
 - id: "CLT-PERSIST-001"
+  version: 1
+  detection_name: "CMD:SagePersistence-A [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "(>>|>)\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)"
+  # Exact dotfile basename required; an unbounded alternation matched `profile`
+  # as a prefix of longer names (`cat > profile.py`). The directory prefix is
+  # scoped to home forms so unrelated locations (`/tmp/.profile`,
+  # `./fixtures/.bashrc`) are not startup files and do not match.
+  pattern: "(?:>>|>)\\s*(?:(?:~|\\$HOME|/home/[^/\\s]+|/Users/[^/\\s]+)/)?\\.(?:bashrc|zshrc|zprofile|zshenv|bash_profile|profile)(?![\\w.-])"
   match_on: command
   title: "Write/append to shell RC file (persistence mechanism)"
   expires_at: null
@@ -15,10 +21,13 @@
 
 # --- Crontab manipulation ---
 - id: "CLT-PERSIST-002"
+  version: 1
+  detection_name: "CMD:SagePersistence-B [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bcrontab\\s+(-[er]|[^-])"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}crontab{{NOT_FILENAME}}\\s+(-[er]|[^-])"
   match_on: command
   title: "Crontab manipulation (list, edit, or remove scheduled tasks)"
   expires_at: null
@@ -26,6 +35,8 @@
 
 # --- Cron directory writes ---
 - id: "CLT-PERSIST-003"
+  version: 1
+  detection_name: "CMD:SagePersistence-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -37,10 +48,15 @@
 
 # --- systemd service manipulation ---
 - id: "CLT-PERSIST-005"
+  version: 1
+  detection_name: "CMD:SagePersistence-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bsystemctl\\s+(enable|start)\\b|/etc/systemd/system/"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on the systemctl branch, same shape as
+  # CLT-CMD-009. The path-literal branch is left as-is -- it's a path
+  # mention, not a "program executing" check.
+  pattern: "{{CMD_POS}}systemctl{{NOT_FILENAME}}\\s+(enable|start)\\b|/etc/systemd/system/"
   match_on: command
   title: "systemd service enable/start or unit file write"
   expires_at: null
@@ -48,6 +64,8 @@
 
 # --- SSH authorized_keys modification ---
 - id: "CLT-PERSIST-006"
+  version: 1
+  detection_name: "CMD:SagePersistence-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
@@ -59,10 +77,22 @@
 
 # --- Echo/printf append to shell RC files ---
 - id: "CLT-PERSIST-007"
+  version: 1
+  detection_name: "CMD:SagePersistence-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(echo|printf)\\s+.*>>\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile)"
+  # Deliberately narrower than CLT-PERSIST-001: this rule got the dot
+  # requirement and the trailing boundary, but not 001's home-directory path
+  # prefix. Widening it was out of scope for the false-positive fix that added
+  # that prefix, because confidence 0.90 denies at default sensitivity where
+  # 001's 0.60 only asks. Consequence: `>> /home/user/.bashrc` is matched by 001
+  # and not here. Unify only with intent.
+  #
+  # {{CMD_POS}} + {{NOT_FILENAME}} added separately: the verb alternation had
+  # no boundary at all, so `myecho evil >> ~/.bashrc` matched "echo" as a bare
+  # substring of "myecho".
+  pattern: "{{CMD_POS}}(echo|printf){{NOT_FILENAME}}\\s+.*>>\\s*~?/?(\\$HOME/)?\\.(bashrc|zshrc|profile|bash_profile)(?![\\w.-])"
   match_on: command
   title: "Echo/printf append to shell RC file (code injection persistence)"
   expires_at: null
@@ -70,10 +100,15 @@
 
 # --- at job scheduling ---
 - id: "CLT-PERSIST-008"
+  version: 1
+  detection_name: "CMD:SagePersistence-H [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bat\\b\\s+(-f\\s+|now|midnight|noon|teatime)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. The bare `\bat\b`
+  # boundary let a two-letter word match inside quoted prose or a search
+  # command (`grep -rn "at now" schedule.log`).
+  pattern: "{{CMD_POS}}at{{NOT_FILENAME}}\\s+(-f\\s+|now|midnight|noon|teatime)"
   match_on: command
   title: "At-job scheduling (persistence)"
   expires_at: null

package/resources/threats/prompt-injection.yaml

@@ -9,6 +9,8 @@
 # The most common PI pattern family. Well-established attack surface.
 
 - id: "CLT-PI-001"
+  version: 1
+  detection_name: "Other:SagePromptInjection-A [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -20,6 +22,8 @@
   revoked: false
 
 - id: "CLT-PI-002"
+  version: 1
+  detection_name: "Other:SagePromptInjection-B [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -31,6 +35,8 @@
   revoked: false
 
 - id: "CLT-PI-003"
+  version: 1
+  detection_name: "Other:SagePromptInjection-C [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -42,6 +48,8 @@
   revoked: false
 
 - id: "CLT-PI-004"
+  version: 1
+  detection_name: "Other:SagePromptInjection-D [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -53,6 +61,8 @@
   revoked: false
 
 - id: "CLT-PI-005"
+  version: 1
+  detection_name: "Other:SagePromptInjection-E [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -67,6 +77,8 @@
 # Attempts to reassign the AI's identity or role.
 
 - id: "CLT-PI-010"
+  version: 1
+  detection_name: "Other:SagePromptInjection-J [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -78,6 +90,8 @@
   revoked: false
 
 - id: "CLT-PI-011"
+  version: 1
+  detection_name: "Other:SagePromptInjection-K [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -92,6 +106,8 @@
   # an activation prefix (pretend/act as/you are) before the persona name.
 
 - id: "CLT-PI-012"
+  version: 1
+  detection_name: "Other:SagePromptInjection-L [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -103,6 +119,8 @@
   revoked: false
 
 - id: "CLT-PI-013"
+  version: 1
+  detection_name: "Other:SagePromptInjection-M [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -117,6 +135,8 @@
 # Attempts to disable safety mechanisms.
 
 - id: "CLT-PI-020"
+  version: 1
+  detection_name: "Other:SagePromptInjection-T [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.85
@@ -128,6 +148,8 @@
   revoked: false
 
 - id: "CLT-PI-021"
+  version: 1
+  detection_name: "Other:SagePromptInjection-U [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -139,6 +161,8 @@
   revoked: false
 
 - id: "CLT-PI-022"
+  version: 1
+  detection_name: "Other:SagePromptInjection-V [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.80
@@ -150,6 +174,8 @@
   revoked: false
 
 - id: "CLT-PI-023"
+  version: 1
+  detection_name: "Other:SagePromptInjection-W [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -164,6 +190,8 @@
 # Instructions to hide activity from the user.
 
 - id: "CLT-PI-030"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AD [Heur]"
   category: prompt_injection
   severity: critical
   confidence: 0.90
@@ -178,6 +206,8 @@
 # Attempts to extract the system prompt or instructions.
 
 - id: "CLT-PI-040"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AN [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -189,6 +219,8 @@
   revoked: false
 
 - id: "CLT-PI-041"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AO [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -200,6 +232,8 @@
   revoked: false
 
 - id: "CLT-PI-042"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AP [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -211,6 +245,8 @@
   revoked: false
 
 - id: "CLT-PI-043"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AQ [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -225,6 +261,8 @@
 # Injection hiding in HTML, markdown, or JSON structures.
 
 - id: "CLT-PI-050"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AX [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -239,6 +277,8 @@
   # for keywords appearing within 20 chars of the opening tag.
 
 - id: "CLT-PI-051"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AY [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -251,6 +291,8 @@
   revoked: false
 
 - id: "CLT-PI-052"
+  version: 1
+  detection_name: "Other:SagePromptInjection-AZ [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -269,6 +311,8 @@
 # Fake conversation turn markers to confuse the model.
 
 - id: "CLT-PI-060"
+  version: 1
+  detection_name: "Other:SagePromptInjection-BH [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -280,6 +324,8 @@
   revoked: false
 
 - id: "CLT-PI-061"
+  version: 1
+  detection_name: "Other:SagePromptInjection-BI [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -294,6 +340,8 @@
 # Obfuscated injection attempts.
 
 - id: "CLT-PI-070"
+  version: 1
+  detection_name: "Other:SagePromptInjection-BR [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.60
@@ -309,6 +357,8 @@
 # are NOT PI — these only match when combined with credential targets.
 
 - id: "CLT-PI-080"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CB [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.80
@@ -320,6 +370,8 @@
   revoked: false
 
 - id: "CLT-PI-081"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CC [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.80
@@ -339,6 +391,8 @@
 # Sage-specific modifications to each rule are noted in its comment block.
 
 - id: "CLT-PI-091"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CM [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -356,6 +410,8 @@
   # precision signal.
 
 - id: "CLT-PI-092"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CN [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85
@@ -372,6 +428,8 @@
   # capitalized variants (Act/You/Pretend/Be) to cover sentence-start phrasing.
 
 - id: "CLT-PI-093"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CO [Heur]"
   category: prompt_injection
   severity: warning
   confidence: 0.85

package/resources/threats/self-defense.yaml

@@ -6,10 +6,16 @@
 
 # Delete .sage directory
 - id: "CLT-SELF-001"
+  version: 1
+  detection_name: "CMD:SageSelfDefense-A [Heur]"
   category: self_defense
   severity: critical
   confidence: 0.60
-  pattern: "(rm|del|rmdir|rd|Remove-Item|unlink)\\s.*\\.sage(\\s|[\\\\/]|$)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. The bare
+  # verb alternation fired on prose warning against the deletion (this is
+  # Sage's own self-protection rule, so an agent merely explaining not to
+  # delete .sage would self-trigger it).
+  pattern: "{{CMD_POS}}(rm|del|rmdir|rd|Remove-Item|unlink){{NOT_FILENAME}}\\s.*\\.sage(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command
   title: "Attempt to delete Sage configuration directory"
@@ -18,6 +24,8 @@
 
 # Access Sage config files
 - id: "CLT-SELF-002"
+  version: 1
+  detection_name: "FN:SageSelfDefense-B [Heur]"
   category: self_defense
   severity: warning
   confidence: 0.60
@@ -29,10 +37,13 @@
 
 # Delete Claude Code hook or plugin config
 - id: "CLT-SELF-003"
+  version: 1
+  detection_name: "CMD:SageSelfDefense-C [Heur]"
   category: self_defense
   severity: warning
   confidence: 0.60
-  pattern: "(rm|del|Remove-Item|unlink)\\s.*\\.claude[\\\\/].*(hooks\\.json|installed_plugins)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-SELF-001 above.
+  pattern: "{{CMD_POS}}(rm|del|Remove-Item|unlink){{NOT_FILENAME}}\\s.*\\.claude[\\\\/].*(hooks\\.json|installed_plugins)"
   case_insensitive: true
   match_on: command
   title: "Attempt to delete Claude Code hook or plugin configuration"
@@ -41,6 +52,8 @@
 
 # Disable Sage security features via config
 - id: "CLT-SELF-004"
+  version: 1
+  detection_name: "Other:SageSelfDefense-D [Heur]"
   category: self_defense
   severity: warning
   confidence: 0.60

package/resources/threats/supply_chain.yaml

@@ -4,10 +4,15 @@
 
 # --- Install scripts piped to shell ---
 - id: "CLT-SUPPLY-001"
+  version: 1
+  detection_name: "CMD:SageSupplyChain-A [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.85
-  pattern: "(curl|wget)\\s+.*install.*\\|\\s*(bash|sh|zsh|sudo\\s+bash|sudo\\s+sh)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on both the fetcher and the destination
+  # shell, same shape as CLT-CMD-009. The bare pattern fired on prose merely
+  # describing the technique.
+  pattern: "{{CMD_POS}}(curl|wget){{NOT_FILENAME}}\\s+.*install.*\\|\\s*(bash|sh|zsh|sudo\\s+bash|sudo\\s+sh){{NOT_FILENAME}}"
   match_on: command
   title: "Install script piped to shell (supply chain risk)"
   expires_at: null

package/resources/threats/urls.yaml

@@ -5,6 +5,8 @@
 
 # --- Known malware hosting patterns ---
 - id: "CLT-URL-001"
+  version: 1
+  detection_name: "FN:SageUrl-A [Heur]"
   category: network_egress
   severity: critical
   confidence: 0.85
@@ -16,6 +18,8 @@
 
 # --- Paste sites used for C2 ---
 - id: "CLT-URL-002"
+  version: 1
+  detection_name: "FN:SageUrl-B [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.60
@@ -26,6 +30,8 @@
   revoked: false
 
 - id: "CLT-URL-003"
+  version: 1
+  detection_name: "FN:SageUrl-C [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.60
@@ -40,6 +46,8 @@
 # (10/8, 172.16/12, 192.168/16), and link-local (169.254/16) ranges,
 # which are common in local development and rarely indicate C2 traffic.
 - id: "CLT-URL-004"
+  version: 1
+  detection_name: "FN:SageUrl-D [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.60
@@ -51,6 +59,8 @@
 
 # --- Executable downloads ---
 - id: "CLT-URL-005"
+  version: 1
+  detection_name: "FN:SageUrl-E [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.60