@gendigital/sage-opencode 0.11.0 → 0.13.0

package/resources/threats/win-commands.yaml

@@ -7,10 +7,14 @@
 
 # Pipe to IEX: irm url | iex, iwr url | iex, curl url | iex, Invoke-WebRequest url | Invoke-Expression
 - id: "CLT-WIN-CMD-001"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b([Ii][Rr][Mm]|[Ii][Ww][Rr]|curl|wget|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod)\\b.*\\|\\s*([Ii][Ee][Xx]|[Ii]nvoke-[Ee]xpression)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on both sides of the pipe, same shape as
+  # CLT-CMD-009.
+  pattern: "{{CMD_POS}}([Ii][Rr][Mm]|[Ii][Ww][Rr]|curl(?:\\.exe)?|wget(?:\\.exe)?|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod){{NOT_FILENAME}}.*\\|\\s*([Ii][Ee][Xx]|[Ii]nvoke-[Ee]xpression){{NOT_FILENAME}}"
   match_on: command
   title: "PowerShell download piped to Invoke-Expression"
   expires_at: null
@@ -18,10 +22,15 @@
 
 # IEX wrapping download: iex(irm url), IEX((New-Object Net.WebClient).DownloadString(url))
 - id: "CLT-WIN-CMD-002"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-B [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b([Ii][Ee][Xx]|[Ii]nvoke-[Ee]xpression)\\s*\\(?\\s*\\(?\\s*(\\b([Ii][Rr][Mm]|[Ii][Ww][Rr])\\b|[Nn]ew-[Oo]bject|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on the outer IEX call, same shape as
+  # CLT-CMD-009. The inner group is an argument inside IEX's own parens, not
+  # itself a program name, so it's left as-is.
+  pattern: "{{CMD_POS}}([Ii][Ee][Xx]|[Ii]nvoke-[Ee]xpression){{NOT_FILENAME}}\\s*\\(?\\s*\\(?\\s*(\\b([Ii][Rr][Mm]|[Ii][Ww][Rr])\\b|[Nn]ew-[Oo]bject|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod)"
   match_on: command
   title: "Invoke-Expression wrapping remote download"
   expires_at: null
@@ -29,10 +38,14 @@
 
 # Start-Process with executable
 - id: "CLT-WIN-CMD-003"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "[Ss]tart-[Pp]rocess.*-[Ff]ile[Pp]ath.*\\.(exe|bat|cmd|ps1)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Ss]tart-[Pp]rocess{{NOT_FILENAME}}.*-[Ff]ile[Pp]ath.*\\.(exe|bat|cmd|ps1)"
   match_on: command
   title: "Start-Process launching executable file"
   expires_at: null
@@ -40,10 +53,13 @@
 
 # Download to file then chain-execute: curl -o install.cmd url && install.cmd
 - id: "CLT-WIN-CMD-004"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b(curl|wget|[Ii][Rr][Mm]|[Ii][Ww][Rr]|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod)\\b[^|]*(-[Oo]\\w*\\s+|-[Oo]ut[Ff]ile\\s+)\\S+\\.(cmd|bat|ps1|exe|msi).*(&&|;)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(curl(?:\\.exe)?|wget(?:\\.exe)?|[Ii][Rr][Mm]|[Ii][Ww][Rr]|[Ii]nvoke-[Ww]eb[Rr]equest|[Ii]nvoke-[Rr]est[Mm]ethod){{NOT_FILENAME}}[^|]*(-[Oo]\\w*\\s+|-[Oo]ut[Ff]ile\\s+)\\S+\\.(cmd|bat|ps1|exe|msi).*(&&|;)"
   match_on: command
   title: "Download file then chain-execute"
   expires_at: null
@@ -51,10 +67,14 @@
 
 # .NET WebClient download
 - id: "CLT-WIN-CMD-005"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-E [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Nn]ew-[Oo]bject\\s+[Nn]et\\.[Ww]eb[Cc]lient.*[Dd]ownload(String|File)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Nn]ew-[Oo]bject{{NOT_FILENAME}}\\s+[Nn]et\\.[Ww]eb[Cc]lient.*[Dd]ownload(String|File)"
   match_on: command
   title: ".NET WebClient download (DownloadString/DownloadFile)"
   expires_at: null
@@ -62,10 +82,14 @@
 
 # Start-BitsTransfer cmdlet
 - id: "CLT-WIN-CMD-006"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "[Ss]tart-[Bb]its[Tt]ransfer"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Ss]tart-[Bb]its[Tt]ransfer{{NOT_FILENAME}}"
   match_on: command
   title: "PowerShell BITS transfer download"
   expires_at: null
@@ -75,10 +99,14 @@
 
 # certutil download/decode
 - id: "CLT-WIN-CMD-007"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll].*(-urlcache|-split|-decode)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll](?:\\.exe)?{{NOT_FILENAME}}.*(-urlcache|-split|-decode)"
   match_on: command
   title: "certutil used for download or decode (LOLBin)"
   expires_at: null
@@ -86,10 +114,14 @@
 
 # bitsadmin transfer
 - id: "CLT-WIN-CMD-008"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-H [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Bb][Ii][Tt][Ss][Aa][Dd][Mm][Ii][Nn].*/transfer"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Bb][Ii][Tt][Ss][Aa][Dd][Mm][Ii][Nn](?:\\.exe)?{{NOT_FILENAME}}.*/transfer"
   match_on: command
   title: "bitsadmin file transfer (LOLBin)"
   expires_at: null
@@ -97,10 +129,14 @@
 
 # mshta remote HTA execution
 - id: "CLT-WIN-CMD-009"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-I [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Mm][Ss][Hh][Tt][Aa]\\s+.*https?://"
+  # {{CMD_POS}} + {{NOT_FILENAME}} (with optional `.exe` suffix), same shape
+  # as CLT-MITRE-096. Had no boundary at all.
+  pattern: "{{CMD_POS}}[Mm][Ss][Hh][Tt][Aa](?:\\.exe)?{{NOT_FILENAME}}\\s+.*https?://"
   match_on: command
   title: "mshta executing remote HTA file (LOLBin)"
   expires_at: null
@@ -108,10 +144,14 @@
 
 # regsvr32 scriptlet loading
 - id: "CLT-WIN-CMD-010"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-J [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Rr][Ee][Gg][Ss][Vv][Rr]32.*/[SsIi].*\\.(dll|sct)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Rr][Ee][Gg][Ss][Vv][Rr]32(?:\\.exe)?{{NOT_FILENAME}}.*/[SsIi].*\\.(dll|sct)"
   match_on: command
   title: "regsvr32 loading DLL/scriptlet (LOLBin)"
   expires_at: null
@@ -119,10 +159,14 @@
 
 # rundll32 javascript execution
 - id: "CLT-WIN-CMD-011"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-K [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Rr][Uu][Nn][Dd][Ll][Ll]32.*javascript:"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\\.exe)?{{NOT_FILENAME}}.*javascript:"
   match_on: command
   title: "rundll32 executing JavaScript (LOLBin)"
   expires_at: null
@@ -130,10 +174,14 @@
 
 # cmstp INF install (UAC bypass)
 - id: "CLT-WIN-CMD-012"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-L [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "[Cc][Mm][Ss][Tt][Pp].*/[AaUuSs].*\\.inf"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Cc][Mm][Ss][Tt][Pp](?:\\.exe)?{{NOT_FILENAME}}.*/[AaUuSs].*\\.inf"
   match_on: command
   title: "cmstp INF install (UAC bypass LOLBin)"
   expires_at: null
@@ -141,10 +189,13 @@
 
 # wmic process create
 - id: "CLT-WIN-CMD-013"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-M [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b[Ww][Mm][Ii][Cc]\\b.*\\bprocess\\s+call\\s+create\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ww][Mm][Ii][Cc](?:\\.exe)?{{NOT_FILENAME}}.*\\bprocess\\s+call\\s+create\\b"
   match_on: command
   title: "wmic process call create (LOLBin)"
   expires_at: null
@@ -152,10 +203,13 @@
 
 # msiexec remote install
 - id: "CLT-WIN-CMD-014"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-N [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b[Mm][Ss][Ii][Ee][Xx][Ee][Cc]\\b.*/[QqIi].*https?://"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Mm][Ss][Ii][Ee][Xx][Ee][Cc](?:\\.exe)?{{NOT_FILENAME}}.*/[QqIi].*https?://"
   match_on: command
   title: "msiexec remote MSI install (LOLBin)"
   expires_at: null
@@ -163,10 +217,13 @@
 
 # forfiles command execution
 - id: "CLT-WIN-CMD-015"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-O [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\b[Ff][Oo][Rr][Ff][Ii][Ll][Ee][Ss]\\b.*/[Cc].*\\b(cmd|powershell)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ff][Oo][Rr][Ff][Ii][Ll][Ee][Ss](?:\\.exe)?{{NOT_FILENAME}}.*/[Cc].*\\b(cmd|powershell)\\b"
   match_on: command
   title: "forfiles dispatching cmd/powershell (LOLBin)"
   expires_at: null
@@ -174,10 +231,13 @@
 
 # pcalua execution
 - id: "CLT-WIN-CMD-016"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-P [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\b[Pp][Cc][Aa][Ll][Uu][Aa]\\b.*-a.*\\.(exe|dll)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Pp][Cc][Aa][Ll][Uu][Aa](?:\\.exe)?{{NOT_FILENAME}}.*-a.*\\.(exe|dll)"
   match_on: command
   title: "pcalua executing binary (LOLBin)"
   expires_at: null
@@ -185,10 +245,13 @@
 
 # installutil abuse
 - id: "CLT-WIN-CMD-017"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-Q [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\b[Ii]nstall[Uu]til\\b.*/[Ll]og[Ff]ile="
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ii]nstall[Uu]til(?:\\.exe)?{{NOT_FILENAME}}.*/[Ll]og[Ff]ile="
   match_on: command
   title: "installutil .NET execution (LOLBin)"
   expires_at: null
@@ -196,10 +259,14 @@
 
 # regasm/regsvcs
 - id: "CLT-WIN-CMD-018"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-R [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\b[Rr]eg[Aa]sm\\b.*/[Uu]|\\b[Rr]eg[Ss]vcs\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Rr]eg[Aa]sm(?:\\.exe)?{{NOT_FILENAME}}.*/[Uu]|{{CMD_POS}}[Rr]eg[Ss]vcs(?:\\.exe)?{{NOT_FILENAME}}"
   match_on: command
   title: "regasm/regsvcs .NET assembly execution (LOLBin)"
   expires_at: null
@@ -209,10 +276,13 @@
 
 # format drive
 - id: "CLT-WIN-CMD-019"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-S [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b[Ff][Oo][Rr][Mm][Aa][Tt]\\s+[A-Za-z]:"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ff][Oo][Rr][Mm][Aa][Tt](?:\\.exe)?{{NOT_FILENAME}}\\s+[A-Za-z]:"
   match_on: command
   title: "Format drive command"
   expires_at: null
@@ -220,10 +290,13 @@
 
 # rd /s /q recursive delete
 - id: "CLT-WIN-CMD-020"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-T [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b(rd|rmdir)\\b\\s+/[Ss]\\s+/[Qq]\\s+[A-Za-z]:\\\\"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(rd|rmdir)(?:\\.exe)?{{NOT_FILENAME}}\\s+/[Ss]\\s+/[Qq]\\s+[A-Za-z]:\\\\"
   match_on: command
   title: "Recursive forced deletion from drive root"
   expires_at: null
@@ -231,10 +304,13 @@
 
 # del /f /s /q force delete
 - id: "CLT-WIN-CMD-021"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-U [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b[Dd][Ee][Ll]\\b\\s+/[Ff].*\\s+/[Ss].*\\s+[A-Za-z]:\\\\"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Dd][Ee][Ll](?:\\.exe)?{{NOT_FILENAME}}\\s+/[Ff].*\\s+/[Ss].*\\s+[A-Za-z]:\\\\"
   match_on: command
   title: "Force delete all files from drive root"
   expires_at: null
@@ -242,10 +318,18 @@
 
 # diskpart
 - id: "CLT-WIN-CMD-022"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-V [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bdiskpart\\b"
+  # {{CMD_POS}}, same shape as CLT-CMD-009. No {{HAS_ARG}}: a bare `diskpart`
+  # invocation opens its interactive prompt, which is itself the dangerous
+  # case, so a bare mention must still fire. The `.exe` suffix is allowlisted
+  # ahead of {{NOT_FILENAME}}'s trailing-dot guard, since `diskpart.exe` is
+  # the real Windows invocation, not a filename.
+  pattern: "{{CMD_POS}}diskpart(?:\\.exe)?{{NOT_FILENAME}}"
+  case_insensitive: true
   match_on: command
   title: "diskpart disk partition manipulation"
   expires_at: null
@@ -255,10 +339,14 @@
 
 # PowerShell TCP reverse shell
 - id: "CLT-WIN-CMD-023"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-W [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Nn]ew-[Oo]bject\\s+[Ss]ystem\\.[Nn]et\\.[Ss]ockets\\.[Tt][Cc][Pp][Cc]lient"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-005. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Nn]ew-[Oo]bject{{NOT_FILENAME}}\\s+[Ss]ystem\\.[Nn]et\\.[Ss]ockets\\.[Tt][Cc][Pp][Cc]lient"
   match_on: command
   title: "PowerShell TCP reverse shell via .NET socket"
   expires_at: null
@@ -266,10 +354,13 @@
 
 # PowerShell UDP reverse shell
 - id: "CLT-WIN-CMD-024"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-X [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Nn]ew-[Oo]bject\\s+[Ss]ystem\\.[Nn]et\\.[Ss]ockets\\.[Uu][Dd][Pp][Cc]lient"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-005.
+  pattern: "{{CMD_POS}}[Nn]ew-[Oo]bject{{NOT_FILENAME}}\\s+[Ss]ystem\\.[Nn]et\\.[Ss]ockets\\.[Uu][Dd][Pp][Cc]lient"
   match_on: command
   title: "PowerShell UDP reverse shell via .NET socket"
   expires_at: null
@@ -279,10 +370,13 @@
 
 # runas
 - id: "CLT-WIN-CMD-025"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-Y [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b[Rr][Uu][Nn][Aa][Ss]\\s+/user:"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Rr][Uu][Nn][Aa][Ss](?:\\.exe)?{{NOT_FILENAME}}\\s+/user:"
   match_on: command
   title: "runas with alternate user credentials"
   expires_at: null
@@ -290,10 +384,14 @@
 
 # Set-ExecutionPolicy Bypass/Unrestricted
 - id: "CLT-WIN-CMD-026"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-Z [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "[Ss]et-[Ee]xecution[Pp]olicy\\s+([Bb]ypass|[Uu]nrestricted)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Ss]et-[Ee]xecution[Pp]olicy{{NOT_FILENAME}}\\s+([Bb]ypass|[Uu]nrestricted)"
   match_on: command
   title: "Disabling PowerShell execution policy"
   expires_at: null
@@ -301,10 +399,16 @@
 
 # fodhelper UAC bypass
 - id: "CLT-WIN-CMD-027"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AA [Heur]"
   category: tool
   severity: warning
   confidence: 0.80
-  pattern: "\\b[Ff]od[Hh]elper\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} (with optional `.exe` suffix), same shape
+  # as CLT-MITRE-096. No {{HAS_ARG}}: a bare `fodhelper` invocation is
+  # itself the UAC-bypass technique (it triggers a hijacked registry key
+  # with no arguments needed), same reasoning as CLT-WIN-CMD-022 (diskpart).
+  pattern: "{{CMD_POS}}[Ff]od[Hh]elper(?:\\.exe)?{{NOT_FILENAME}}"
   match_on: command
   title: "fodhelper.exe UAC bypass"
   expires_at: null
@@ -314,10 +418,13 @@
 
 # Remove-Item -Recurse -Force
 - id: "CLT-WIN-CMD-028"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AB [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bRemove-Item\\b(?=[^;&|#\\r\\n]*\\s-(?:Recurse|r)\\b)(?=[^;&|#\\r\\n]*\\s-(?:Force|f)\\b)[^;&|#\\r\\n]*?(?:[A-Za-z]:\\\\(?:Windows|ProgramData|Users\\\\Public|Program Files(?: \\(x86\\))?)(?=\\\\|\\s|[\"']|$)|(?:\\$env:(?:SystemRoot|ProgramData|windir)|\\$\\{env:(?:SystemRoot|ProgramData|windir)\\})(?=\\\\|\\s|[\"']|$))"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}Remove-Item{{NOT_FILENAME}}(?=[^;&|#\\r\\n]*\\s-(?:Recurse|r)\\b)(?=[^;&|#\\r\\n]*\\s-(?:Force|f)\\b)[^;&|#\\r\\n]*?(?:[A-Za-z]:\\\\(?:Windows|ProgramData|Users\\\\Public|Program Files(?: \\(x86\\))?)(?=\\\\|\\s|[\"']|$)|(?:\\$env:(?:SystemRoot|ProgramData|windir)|\\$\\{env:(?:SystemRoot|ProgramData|windir)\\})(?=\\\\|\\s|[\"']|$))"
   case_insensitive: true
   match_on: command
   title: "PowerShell recursive forced deletion (Remove-Item -Recurse -Force)"
@@ -326,10 +433,13 @@
 
 # Clear-RecycleBin -Force
 - id: "CLT-WIN-CMD-029"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AC [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bClear-RecycleBin\\b.*-Force"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}Clear-RecycleBin{{NOT_FILENAME}}.*-Force"
   match_on: command
   title: "PowerShell destructive recycle bin cleanup"
   expires_at: null
@@ -339,10 +449,13 @@
 
 # ncat reverse shell
 - id: "CLT-WIN-CMD-030"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AD [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bncat\\b.*\\s-e\\s+(cmd|powershell|cmd\\.exe|powershell\\.exe)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}ncat(?:\\.exe)?{{NOT_FILENAME}}.*\\s-e\\s+(cmd|powershell|cmd\\.exe|powershell\\.exe)"
   match_on: command
   title: "Reverse shell via ncat -e cmd/powershell"
   expires_at: null
@@ -352,10 +465,13 @@
 
 # vssadmin delete shadows
 - id: "CLT-WIN-CMD-031"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AE [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bvssadmin\\b.*\\bdelete\\s+shadows\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}vssadmin(?:\\.exe)?{{NOT_FILENAME}}.*\\bdelete\\s+shadows\\b"
   case_insensitive: true
   match_on: command
   title: "Shadow copy deletion via vssadmin (ransomware indicator)"
@@ -364,10 +480,13 @@
 
 # wmic shadowcopy delete
 - id: "CLT-WIN-CMD-032"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AF [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bwmic\\b.*\\bshadowcopy\\b.*\\bdelete\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}wmic(?:\\.exe)?{{NOT_FILENAME}}.*\\bshadowcopy\\b.*\\bdelete\\b"
   match_on: command
   title: "Shadow copy deletion via wmic (ransomware indicator)"
   expires_at: null
@@ -375,10 +494,14 @@
 
 # bcdedit recovery disable
 - id: "CLT-WIN-CMD-033"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AG [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bbcdedit\\b.*/set\\b.*\\b(recoveryenabled\\b.*\\b(No|no|NO|false|0)|bootems\\s+off|advancedoptions\\s+off|optionsedit\\s+off)\\b|\\breg\\b.*\\bdelete\\b.*\\bSYSTEM\\\\.*CurrentControlSet\\\\Control\\\\SafeBoot\\b|\\breg\\b.*\\badd\\b.*\\bSOFTWARE\\\\.*Microsoft\\\\Windows NT\\\\.*CurrentVersion\\\\Winlogon\\b.*/v.*Userinit"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative's leading identifier,
+  # same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}bcdedit(?:\\.exe)?{{NOT_FILENAME}}.*/set\\b.*\\b(recoveryenabled\\b.*\\b(No|no|NO|false|0)|bootems\\s+off|advancedoptions\\s+off|optionsedit\\s+off)\\b|{{CMD_POS}}reg(?:\\.exe)?{{NOT_FILENAME}}.*\\bdelete\\b.*\\bSYSTEM\\\\.*CurrentControlSet\\\\Control\\\\SafeBoot\\b|{{CMD_POS}}reg(?:\\.exe)?{{NOT_FILENAME}}.*\\badd\\b.*\\bSOFTWARE\\\\.*Microsoft\\\\Windows NT\\\\.*CurrentVersion\\\\Winlogon\\b.*/v.*Userinit"
   match_on: command
   title: "Recovery/boot disable via bcdedit, SafeBoot reg delete, or Winlogon Userinit (ransomware indicator)"
   expires_at: null
@@ -386,10 +509,13 @@
 
 # PowerShell WMI/CIM shadow copy deletion
 - id: "CLT-WIN-CMD-034"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AH [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b(Get-WmiObject|Get-CimInstance)\\b.*\\bWin32_ShadowCopy\\b.*\\b(Remove-WmiObject|Remove-CimInstance|Delete)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(Get-WmiObject|Get-CimInstance){{NOT_FILENAME}}.*\\bWin32_ShadowCopy\\b.*\\b(Remove-WmiObject|Remove-CimInstance|Delete)\\b"
   match_on: command
   title: "PowerShell shadow copy deletion (ransomware indicator)"
   expires_at: null
@@ -399,10 +525,13 @@
 
 # wevtutil event log clearing
 - id: "CLT-WIN-CMD-035"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AI [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bwevtutil\\b.*\\b(cl|clear-log)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}wevtutil(?:\\.exe)?{{NOT_FILENAME}}.*\\b(cl|clear-log)\\b"
   match_on: command
   title: "Windows event log clearing via wevtutil (anti-forensics)"
   expires_at: null
@@ -410,10 +539,18 @@
 
 # PowerShell event log clearing
 - id: "CLT-WIN-CMD-036"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AJ [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b(Clear-EventLog|Remove-EventLog)\\b"
+  # A cmdlet occupies command position the same way a binary does — the path
+  # prefix {{CMD_POS}} allows is optional, not required, so lacking one isn't
+  # a reason to skip it. {{CMD_POS}} also closes the quoted-mention and
+  # filename-mention gaps that the symmetric guard alone (see
+  # CLT-WIN-PERSIST-008) can't.
+  pattern: "{{CMD_POS}}(Clear-EventLog|Remove-EventLog){{NOT_FILENAME}}"
+  case_insensitive: true
   match_on: command
   title: "PowerShell event log clearing (anti-forensics)"
   expires_at: null
@@ -421,10 +558,13 @@
 
 # Set-MpPreference Defender disable
 - id: "CLT-WIN-CMD-037"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AK [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\b(Set|Add)-MpPreference\\b.*(-Disable|-Exclusion)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(Set|Add)-MpPreference{{NOT_FILENAME}}.*(-Disable|-Exclusion)"
   match_on: command
   title: "Windows Defender settings modification via Set/Add-MpPreference"
   expires_at: null
@@ -432,10 +572,16 @@
 
 # Security service tampering
 - id: "CLT-WIN-CMD-038"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AL [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b(sc\\s+(stop|config)|net\\s+stop|Stop-Service)\\b.*\\b(WinDefend|MpsSvc|wscsvc|SecurityHealthService)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-CMD-009. The whole alternation is wrapped in a non-capturing group so
+  # the trailing service-name check applies to all three branches, not just
+  # the last.
+  pattern: "(?:{{CMD_POS}}sc(?:\\.exe)?{{NOT_FILENAME}}\\s+(stop|config)|{{CMD_POS}}net(?:\\.exe)?{{NOT_FILENAME}}\\s+stop|{{CMD_POS}}Stop-Service{{NOT_FILENAME}}).*\\b(WinDefend|MpsSvc|wscsvc|SecurityHealthService)\\b"
   match_on: command
   title: "Security service tampering (WinDefend/firewall service stop/disable)"
   expires_at: null
@@ -443,10 +589,13 @@
 
 # netsh firewall disable
 - id: "CLT-WIN-CMD-039"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AM [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bnetsh\\b.*\\badvfirewall\\b.*\\bstate\\s+off\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}.*\\badvfirewall\\b.*\\bstate\\s+off\\b"
   match_on: command
   title: "Windows Firewall disabling via netsh"
   expires_at: null
@@ -456,10 +605,14 @@
 
 # Password-protected archive creation
 - id: "CLT-WIN-CMD-040"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AN [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b(rar|winrar)(\\.exe)?\\b.*\\s-h?p|\\b(7z|7za)(\\.exe)?\\b.*\\s-p|\\bzip\\b.*\\s(-P\\s|--password\\b)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-CMD-009. The `.exe` suffix stays optional ahead of {{NOT_FILENAME}}.
+  pattern: "{{CMD_POS}}(rar|winrar)(?:\\.exe)?{{NOT_FILENAME}}.*\\s-h?p|{{CMD_POS}}(7z|7za)(?:\\.exe)?{{NOT_FILENAME}}.*\\s-p|{{CMD_POS}}zip(?:\\.exe)?{{NOT_FILENAME}}.*\\s(-P\\s|--password\\b)"
   match_on: command
   title: "Password-protected archive creation (potential data exfiltration)"
   expires_at: null
@@ -467,10 +620,13 @@
 
 # Bulk document archiving with wildcards
 - id: "CLT-WIN-CMD-041"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AO [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b(rar|winrar|7z|7za|zip|tar)(\\.exe)?\\b.*\\*\\.(docx?|xlsx?|pptx?|pdf|csv)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-040.
+  pattern: "{{CMD_POS}}(rar|winrar|7z|7za|zip|tar)(?:\\.exe)?{{NOT_FILENAME}}.*\\*\\.(docx?|xlsx?|pptx?|pdf|csv)\\b"
   match_on: command
   title: "Bulk document archiving with wildcards (data exfiltration indicator)"
   expires_at: null
@@ -480,6 +636,8 @@
 
 # AutoIt3 /AutoIt3ExecuteScript flag — prevalent malware delivery mechanism
 - id: "CLT-WIN-CMD-042"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AP [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
@@ -494,10 +652,14 @@
 
 # wscript/cscript executing scripts from C:\Users\Public (world-writable staging)
 - id: "CLT-WIN-CMD-043"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AQ [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "(wscript|cscript)(\\.exe)?\\b.*\\\\Users\\\\Public\\\\"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-OBFUS-009. Had no
+  # leading boundary at all.
+  pattern: "{{CMD_POS}}(wscript|cscript)(?:\\.exe)?{{NOT_FILENAME}}.*\\\\Users\\\\Public\\\\"
   case_insensitive: true
   match_on: command
   title: "Script execution from C:\\Users\\Public (suspicious staging location)"
@@ -508,10 +670,14 @@
 
 # regsvr32 /i: with remote URL (Squiblydoo — shellcode or scrobj.dll variant)
 - id: "CLT-WIN-CMD-044"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AR [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "regsvr32(\\.exe)?\\b.*/[Ii]:[^\\s]*https?://"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-043. Had no
+  # leading boundary at all.
+  pattern: "{{CMD_POS}}regsvr32(?:\\.exe)?{{NOT_FILENAME}}.*/[Ii]:[^\\s]*https?://"
   case_insensitive: true
   match_on: command
   title: "regsvr32 /i: with remote URL (Squiblydoo attack)"
@@ -520,10 +686,16 @@
 
 # cmdl32.exe Connection Manager Profile Installer abuse
 - id: "CLT-WIN-CMD-045"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AS [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bcmdl32(\\.exe)?\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Known
+  # casualty, accepted: a bare fully-quoted invocation with no wrapper
+  # (`"C:\...\cmdl32.exe" ...`) no longer matches, same gap CLT-MITRE-096
+  # (tscon) already has.
+  pattern: "{{CMD_POS}}cmdl32(?:\\.exe)?{{NOT_FILENAME}}"
   case_insensitive: true
   match_on: command
   title: "cmdl32.exe Connection Manager abuse (LOLBin)"
@@ -534,10 +706,13 @@
 
 # curl/wget download to file then start (single & in cmd.exe)
 - id: "CLT-WIN-CMD-046"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AT [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b(curl|wget)\\b[^&]*(--(output|o\\b)|-o\\b)[^&]*&\\s*(start\\b|cmd)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(curl|wget)(?:\\.exe)?{{NOT_FILENAME}}[^&]*(--(output|o\\b)|-o\\b)[^&]*&\\s*(start\\b|cmd)"
   case_insensitive: true
   match_on: command
   title: "Download file then execute via cmd start (download-execute chain)"
@@ -546,10 +721,14 @@
 
 # Shadow copy resize + VSS/SystemRestore disable + wbadmin backup deletion (ex CLT-TECH-005)
 - id: "CLT-WIN-CMD-047"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AU [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(vssadmin.*resize.*shadowstorage|net.*stop.*swprv|reg.*add.*HKLM.*SOFTWARE.*Microsoft.*Windows NT.*CurrentVersion.*SystemRestore.*/v.*DisableSR.*/t.*REG_DWORD.*/d.*1.*/f|reg.*add.*HKLM.*SYSTEM.*CurrentControlSet.*services.*VSS.*/v.*Start.*/t.*REG_DWORD.*/d.*4.*/f|wbadmin.*delete.*catalog|wbadmin.*delete.*systemstatebackup)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative's leading identifier,
+  # same shape as CLT-CMD-009. Had no boundary at all.
+  pattern: "{{CMD_POS}}vssadmin(?:\\.exe)?{{NOT_FILENAME}}.*resize.*shadowstorage|{{CMD_POS}}net(?:\\.exe)?{{NOT_FILENAME}}.*stop.*swprv|{{CMD_POS}}reg(?:\\.exe)?{{NOT_FILENAME}}.*add.*HKLM.*SOFTWARE.*Microsoft.*Windows NT.*CurrentVersion.*SystemRestore.*/v.*DisableSR.*/t.*REG_DWORD.*/d.*1.*/f|{{CMD_POS}}reg(?:\\.exe)?{{NOT_FILENAME}}.*add.*HKLM.*SYSTEM.*CurrentControlSet.*services.*VSS.*/v.*Start.*/t.*REG_DWORD.*/d.*4.*/f|{{CMD_POS}}wbadmin(?:\\.exe)?{{NOT_FILENAME}}.*delete.*catalog|{{CMD_POS}}wbadmin(?:\\.exe)?{{NOT_FILENAME}}.*delete.*systemstatebackup"
   case_insensitive: true
   match_on: command
   title: "Shadow copy/VSS/SystemRestore disable or wbadmin backup deletion"
@@ -558,10 +737,14 @@
 
 # Legacy firewall disable via netsh opmode (ex CLT-TECH-007, MpsSvc parts covered by CLT-WIN-CMD-038)
 - id: "CLT-WIN-CMD-048"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AV [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "netsh\\s+firewall\\s+set\\s+opmode\\s+mode[= ]+DISABLE"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}\\s+firewall\\s+set\\s+opmode\\s+mode[= ]+DISABLE"
   case_insensitive: true
   match_on: command
   title: "Legacy firewall disable via netsh opmode (pre-Vista)"
@@ -570,10 +753,14 @@
 
 # Firewall exclusion: add allowed program (ex CLT-TECH-008)
 - id: "CLT-WIN-CMD-049"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AW [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "(netsh\\s+firewall.+add.+allowedprogram.+ENABLE|netsh.+advfirewall.+firewall.+add.+rule.+name.+program|netsh\\s+advfirewall\\s+firewall.+allow.+program.+enable[= ]+yes)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-WIN-CMD-048.
+  pattern: "{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}\\s+firewall.+add.+allowedprogram.+ENABLE|{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}.+advfirewall.+firewall.+add.+rule.+name.+program|{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}\\s+advfirewall\\s+firewall.+allow.+program.+enable[= ]+yes"
   case_insensitive: true
   match_on: command
   title: "Excluding program from firewall detection via netsh"
@@ -582,10 +769,13 @@
 
 # AppLocker bypass via regsvr32 /i:http (ex CLT-TECH-006)
 - id: "CLT-WIN-CMD-050"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AX [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "regsvr32.+i:\\s*http"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-044.
+  pattern: "{{CMD_POS}}regsvr32(?:\\.exe)?{{NOT_FILENAME}}.+i:\\s*http"
   case_insensitive: true
   match_on: command
   title: "AppLocker bypass via regsvr32 /i:http"
@@ -594,10 +784,18 @@
 
 # Mavinject DLL injection (ex CLT-TECH-009)
 - id: "CLT-WIN-CMD-051"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AY [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(\\\\|/)Mavinject(64|32)\\.exe"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. The old
+  # mandatory leading slash was a path-mention check, not real command
+  # position -- it matched `cat /tools/Mavinject32.exe-notes.md` and missed
+  # a bare `Mavinject64.exe` invocation with no path prefix at all.
+  # {{CMD_POS}}'s path prefix is optional, so this both closes the mention
+  # false positive and admits the bare invocation.
+  pattern: "{{CMD_POS}}Mavinject(64|32)\\.exe{{NOT_FILENAME}}"
   case_insensitive: true
   match_on: command
   title: "Mavinject DLL injection (LOLBin)"
@@ -606,10 +804,13 @@
 
 # PyDev inject_dll injection (ex CLT-TECH-010)
 - id: "CLT-WIN-CMD-052"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-AZ [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(\\\\|/)inject_dll_(x86|amd64)\\.exe"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-051.
+  pattern: "{{CMD_POS}}inject_dll_(x86|amd64)\\.exe{{NOT_FILENAME}}"
   case_insensitive: true
   match_on: command
   title: "PyDev inject_dll injection (LOLBin)"
@@ -618,10 +819,14 @@
 
 # PowerShdll execution (ex CLT-TECH-028)
 - id: "CLT-WIN-CMD-053"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BA [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "(rundll32\\.exe PowerShdll\\.dll,main|POWERSHDLL\\.(DLL|EXE))"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-CMD-009.
+  pattern: "{{CMD_POS}}rundll32\\.exe{{NOT_FILENAME}} PowerShdll\\.dll,main|{{CMD_POS}}POWERSHDLL\\.(DLL|EXE){{NOT_FILENAME}}"
   case_insensitive: true
   match_on: command
   title: "PowerShdll execution (LOLBin)"
@@ -630,10 +835,14 @@
 
 # SyncAppvPublishingServer execution (ex CLT-TECH-030)
 - id: "CLT-WIN-CMD-054"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BB [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "SyncAppvPublishingServer\\.vbs \".*(iwr|iex)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}SyncAppvPublishingServer\\.vbs{{NOT_FILENAME}} \".*(iwr|iex)"
   case_insensitive: true
   match_on: command
   title: "Execution via SyncAppvPublishingServer (LOLBin)"
@@ -642,10 +851,15 @@
 
 # sdclt/CompMgmtLauncher UAC bypass (ex CLT-TECH-033)
 - id: "CLT-WIN-CMD-055"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BC [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(sdclt\\.exe|CompMgmtLauncher\\.exe)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. `.exe` is
+  # kept optional (widening slightly from the old mandatory suffix) for
+  # consistency with the rest of the corpus.
+  pattern: "{{CMD_POS}}(sdclt|CompMgmtLauncher)(?:\\.exe)?{{NOT_FILENAME}}"
   case_insensitive: true
   match_on: command
   title: "UAC bypass via sdclt or CompMgmtLauncher"
@@ -654,10 +868,14 @@
 
 # PowerShell fileless execution via iex $env (ex CLT-TECH-017)
 - id: "CLT-WIN-CMD-056"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BD [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.*iex.*\\$env"
+  # {{CMD_POS}} + {{NOT_FILENAME}} (with optional `.exe` suffix), same shape
+  # as CLT-MITRE-096. Had no boundary at all.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*iex.*\\$env"
   case_insensitive: true
   match_on: command
   title: "PowerShell fileless execution via iex $env"
@@ -666,10 +884,13 @@
 
 # PowerShell version downgrade (ex CLT-TECH-018)
 - id: "CLT-WIN-CMD-057"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BE [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.*-Version"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-056.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*-Version"
   case_insensitive: true
   match_on: command
   title: "PowerShell version downgrade attack"
@@ -678,10 +899,14 @@
 
 # PowerShell download cradle iex+downloadstring (ex CLT-TECH-023)
 - id: "CLT-WIN-CMD-058"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BF [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(powershell.*(iex|invoke-expression).*downloadstring|powershell.*Start-BitsTransfer.*(iex|invoke-expression)|powershell.*xmlhttp.*send.*(iex|invoke-expression))"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative, same shape as
+  # CLT-WIN-CMD-056.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*(iex|invoke-expression).*downloadstring|{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*Start-BitsTransfer.*(iex|invoke-expression)|{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*xmlhttp.*send.*(iex|invoke-expression)"
   case_insensitive: true
   match_on: command
   title: "PowerShell download cradle (iex+downloadstring)"
@@ -690,10 +915,13 @@
 
 # PowerShell Reflection.Assembly Load (ex CLT-TECH-024)
 - id: "CLT-WIN-CMD-059"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BG [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.+\\[Reflection\\.Assembly\\]::Load"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-056.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.+\\[Reflection\\.Assembly\\]::Load"
   case_insensitive: true
   match_on: command
   title: "PowerShell Reflection.Assembly Load"
@@ -702,10 +930,13 @@
 
 # PowerShell certificate validation bypass (ex CLT-TECH-025)
 - id: "CLT-WIN-CMD-060"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BH [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.+ServerCertificateValidationCallback\\s*=\\s*\\{\\s*\\$true\\s*\\}"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-056.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.+ServerCertificateValidationCallback\\s*=\\s*\\{\\s*\\$true\\s*\\}"
   case_insensitive: true
   match_on: command
   title: "PowerShell certificate validation bypass"
@@ -714,10 +945,13 @@
 
 # PowerShell GetTypeFromCLSID (ex CLT-TECH-029)
 - id: "CLT-WIN-CMD-061"
+  version: 1
+  detection_name: "CMD:SageWindowsCommand-BI [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.+GetTypeFromCLSID"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-056.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.+GetTypeFromCLSID"
   case_insensitive: true
   match_on: command
   title: "PowerShell GetTypeFromCLSID usage"