@gendigital/sage-opencode 0.11.0 → 0.13.0

package/resources/threats/commands.yaml

@@ -5,20 +5,30 @@
 
 # --- Pipe to shell (Remote Code Execution) ---
 - id: "CLT-CMD-001"
+  version: 1
+  detection_name: "CMD:SageCommand-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "curl\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on both sides of the pipe, same shape as
+  # CLT-CMD-009. Had no boundary at all. curl admits an optional .exe suffix
+  # -- it ships as a real Windows binary (built into Windows 10+).
+  pattern: "{{CMD_POS}}curl(?:\\.exe)?{{NOT_FILENAME}}\\s[^|]*\\|\\s*(?:{{SHELLS}}){{NOT_FILENAME}}"
   match_on: command
   title: "Remote code execution via curl pipe to shell"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-002"
+  version: 1
+  detection_name: "CMD:SageCommand-B [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "wget\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-001. wget admits an
+  # optional .exe suffix -- real Windows builds exist (GnuWin32, Git for
+  # Windows).
+  pattern: "{{CMD_POS}}wget(?:\\.exe)?{{NOT_FILENAME}}\\s[^|]*\\|\\s*(?:{{SHELLS}}){{NOT_FILENAME}}"
   match_on: command
   title: "Remote code execution via wget pipe to shell"
   expires_at: null
@@ -26,30 +36,41 @@
 
 # --- Reverse shells ---
 - id: "CLT-CMD-003"
+  version: 1
+  detection_name: "CMD:SageCommand-C [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b(bash|sh|zsh|ksh|dash)\\s+-i\\b[\\s\\S]{0,160}/dev/tcp/"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Bare `\b` let
+  # the shell name match in quoted prose.
+  pattern: "{{CMD_POS}}(?:{{SHELLS}}){{NOT_FILENAME}}\\s+-i\\b[\\s\\S]{0,160}/dev/tcp/"
   match_on: command
   title: "Reverse shell via /dev/tcp"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-004"
+  version: 1
+  detection_name: "CMD:SageCommand-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bnc\\b.*\\s-e\\s"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}nc{{NOT_FILENAME}}.*\\s-e\\s"
   match_on: command
   title: "Reverse shell via netcat -e"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-005"
+  version: 1
+  detection_name: "CMD:SageCommand-E [Heur]"
   category: tool
   severity: critical
   confidence: 0.85
-  pattern: "bash\\s+-i\\s+>\\s*&\\s*/dev/"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}bash{{NOT_FILENAME}}\\s+-i\\s+>\\s*&\\s*/dev/"
   match_on: command
   title: "Interactive reverse shell via bash"
   expires_at: null
@@ -57,40 +78,64 @@
 
 # --- Destructive operations ---
 - id: "CLT-CMD-006"
+  version: 1
+  detection_name: "CMD:SageCommand-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each alternative's `rm`, same shape as
+  # CLT-CMD-009.
+  pattern: "{{CMD_POS}}rm{{NOT_FILENAME}}\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|{{CMD_POS}}rm{{NOT_FILENAME}}\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|{{CMD_POS}}rm{{NOT_FILENAME}}\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
   match_on: command
   title: "Recursive forced deletion from root"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-007"
+  version: 1
+  detection_name: "CMD:SageCommand-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bmkfs\\b"
+  # {{CMD_POS}} + {{HAS_ARG}}, same shape as CLT-CMD-009. The fstype suffix
+  # is allowlisted ahead of {{NOT_FILENAME}}'s trailing-dot guard, since
+  # mkfs.<fstype> is the real invocation, not a filename, and the old
+  # `\bmkfs\b` matched it too. Suffixes are the actual mkfs.* binary names
+  # shipped by e2fsprogs, xfsprogs, btrfs-progs, dosfstools, exfatprogs,
+  # ntfs-3g, hfsprogs, udftools, util-linux, f2fs-tools, jfsutils,
+  # reiserfsprogs, nilfs-utils — not guessed shapes; a fabricated suffix like
+  # `fat32` is not a real binary and must not be added on spec alone.
+  pattern: "{{CMD_POS}}mkfs(?:\\.(?:ext[234]|xfs|btrfs|vfat|fat|msdos|exfat|ntfs|hfsplus|udf|minix|bfs|cramfs|f2fs|jfs|reiserfs|nilfs2))?{{NOT_FILENAME}}{{HAS_ARG}}"
   match_on: command
   title: "Filesystem format command"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-008"
+  version: 1
+  detection_name: "CMD:SageCommand-H [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\bdd\\s+if=.*of=/dev/"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}dd{{NOT_FILENAME}}\\s+if=.*of=/dev/"
   match_on: command
   title: "Direct disk write via dd"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-009"
+  version: 1
+  detection_name: "CMD:SageCommand-I [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bshred\\b"
+  # Requires the binary to actually be executed: a bare word boundary matched
+  # filenames (`shred.py`) and path segments (`shred-latency-probe`), and a
+  # whitespace boundary also accepted argument position (`man shred | head`).
+  # `{{CMD_POS}}` is the shared vocabulary for this — see threats/_macros.yaml
+  # and "Writing command-position patterns" in docs/developer-guide.md.
+  pattern: "{{CMD_POS}}shred{{NOT_FILENAME}}{{HAS_ARG}}"
   match_on: command
   title: "Secure file destruction via shred"
   expires_at: null
@@ -98,10 +143,16 @@
 
 # --- Download + execute chains ---
 - id: "CLT-CMD-010"
+  version: 1
+  detection_name: "CMD:SageCommand-J [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(curl|wget)\\s[\\s\\S]*?(&&|;)\\s*chmod\\s+\\+x"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on the fetcher, same shape as CLT-CMD-009,
+  # with an optional .exe suffix on each (real Windows binaries). `chmod`
+  # itself needs no boundary fix -- it's already anchored to a real
+  # separator (`&&`/`;`) literally in the pattern, not a bare mention.
+  pattern: "{{CMD_POS}}(curl|wget)(?:\\.exe)?{{NOT_FILENAME}}\\s[\\s\\S]*?(&&|;)\\s*chmod\\s+\\+x"
   match_on: command
   title: "Download and execute chain"
   expires_at: null
@@ -109,16 +160,21 @@
 
 # --- Privilege escalation ---
 - id: "CLT-CMD-011"
+  version: 1
+  detection_name: "CMD:SageCommand-K [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bchmod\\s+777\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}chmod{{NOT_FILENAME}}\\s+777\\b"
   match_on: command
   title: "Overly permissive file permissions"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-012"
+  version: 1
+  detection_name: "CMD:SageCommand-L [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -130,10 +186,14 @@
 
 # --- Data exfiltration ---
 - id: "CLT-CMD-013"
+  version: 1
+  detection_name: "CMD:SageCommand-M [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.60
-  pattern: "curl\\s[^|;]*(-d|--data|--data-binary)\\s\\S*(/etc/passwd|/etc/shadow|\\.ssh/|id_rsa|credentials|secrets)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all. curl admits an optional .exe suffix, same as CLT-CMD-001.
+  pattern: "{{CMD_POS}}curl(?:\\.exe)?{{NOT_FILENAME}}\\s[^|;]*(-d|--data|--data-binary)\\s\\S*(/etc/passwd|/etc/shadow|\\.ssh/|id_rsa|credentials|secrets)"
   match_on: command
   title: "Possible data exfiltration of sensitive files"
   expires_at: null
@@ -141,10 +201,18 @@
 
 # --- Privileged pipe to shell ---
 - id: "CLT-CMD-014"
+  version: 1
+  detection_name: "CMD:SageCommand-N [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\bsudo\\s+(curl|wget)\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `sudo` itself, not on curl/wget --
+  # this rule means "privileged", so it must keep requiring the literal
+  # `sudo` wrapper rather than folding into {{CMD_POS}}'s generic wrapper
+  # allowance (which would also admit the unprivileged case CLT-CMD-001
+  # already covers). curl/wget admit an optional .exe suffix, same as
+  # CLT-CMD-001/002.
+  pattern: "{{CMD_POS}}sudo{{NOT_FILENAME}}\\s+(curl|wget)(?:\\.exe)?{{NOT_FILENAME}}\\s[^|]*\\|\\s*(?:{{SHELLS}}){{NOT_FILENAME}}"
   match_on: command
   title: "Privileged pipe-to-shell (sudo curl/wget piped to shell)"
   expires_at: null
@@ -156,10 +224,14 @@
 # Uses `[\s\S]` to span newlines (loader does not set the `s` flag) and a
 # bounded non-greedy quantifier to avoid catastrophic backtracking.
 - id: "CLT-CMD-015"
+  version: 1
+  detection_name: "CMD:SageCommand-O [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "python[3]?\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}python[3]?{{NOT_FILENAME}}\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
   match_on: command
   title: "Python one-liner invoking shell/exec/subprocess call"
   expires_at: null
@@ -167,43 +239,68 @@
 
 # --- Indirect execution patterns ---
 - id: "CLT-CMD-016"
+  version: 1
+  detection_name: "CMD:SageCommand-P [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bbash\\s+<\\(\\s*(curl|wget)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}bash{{NOT_FILENAME}}\\s+<\\(\\s*(curl|wget)\\b"
   match_on: command
   title: "Process substitution executing remote content"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-017"
+  version: 1
+  detection_name: "CMD:SageCommand-Q [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\beval\\b[^;|]*\\b(curl|wget)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}eval{{NOT_FILENAME}}[^;|]*\\b(curl|wget)\\b"
   match_on: command
   title: "Eval executing remote download command"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-018"
+  version: 1
+  detection_name: "CMD:SageCommand-R [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  # The lookarounds prevent matching short-option flags like `du -sh` or
-  # identifiers like `shell`/`bashrc`; only standalone command invocations
-  # (preceded by whitespace, `/`, etc.) are flagged.
-  pattern: "\\bxargs\\b[^|;\\r\\n]{0,400}(?:(?<![-\\w])(bash|sh)(?![-\\w])(?:\\s+-[\\w]*c\\b\\s+(?:\"(?!\\s*(?:head|cat|wc)\\b)[^\"\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^\"\\r\\n]{0,240}\"|'(?!\\s*(?:head|cat|wc)\\b)[^'\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^'\\r\\n]{0,240}')|(?!\\s+-[\\w]*c\\b))|(?<![-\\w])(curl|wget)(?![-\\w])[^|;\\r\\n]{0,400}(?:-d|--data|--data-binary|--upload-file|-T|--post-file|--post-data|--body-file)\\b)"
+  # `xargs` is itself anchored with {{CMD_POS}} rather than a bare `\bxargs\b`
+  # (which fired on prose merely mentioning xargs). `{{NOT_COMPOUND_LEFT}}`
+  # around the dispatched shell/curl name was also a misapplication of that
+  # macro: it exists for identifiers that are argument *values* (a WMI class
+  # name), never program names, whereas the shell/curl here really is being
+  # run. `xargs` is already one of {{CMD_PREFIX}}'s wrapper tokens, so a
+  # second `{{CMD_PREFIX}}` application right after the anchored `xargs`
+  # naturally skips its own flags (`-I{}`, `-n1`, `-P4`, an intervening
+  # `sudo`, ...) before the dispatched program, the same way {{CMD_POS}}
+  # skips wrapper tokens before any other program name. Anchoring `xargs`
+  # itself (rather than folding it into a generic {{CMD_POS}} on the
+  # shell/curl name) keeps this rule scoped to xargs's `{}`-substitution
+  # danger specifically — `sudo bash -c "echo {}"` with no xargs anywhere is
+  # inert literal text, not a real invocation, and must not fire here (that's
+  # CLT-CMD-009/017's territory, not this rule's). curl/wget admit an
+  # optional .exe suffix, same as CLT-CMD-001/002; {{SHELLS}} does too for
+  # powershell/pwsh via the shared macro.
+  pattern: "{{CMD_POS}}xargs{{NOT_FILENAME}}\\s+{{CMD_PREFIX}}(?:(?:{{SHELLS}}){{NOT_FILENAME}}(?:\\s+-[\\w]*c\\b\\s+(?:\"(?!\\s*(?:head|cat|wc)\\b)[^\"\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^\"\\r\\n]{0,240}\"|'(?!\\s*(?:head|cat|wc)\\b)[^'\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^'\\r\\n]{0,240}')|(?!\\s+-[\\w]*c\\b))|(curl|wget)(?:\\.exe)?{{NOT_FILENAME}}[^|;\\r\\n]{0,400}(?:-d|--data|--data-binary|--upload-file|-T|--post-file|--post-data|--body-file)\\b)"
   match_on: command
   title: "xargs dispatching download or shell execution"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-019"
+  version: 1
+  detection_name: "CMD:SageCommand-S [Heur]"
   category: tool
   severity: warning
   confidence: 0.85
-  pattern: "\\bfind\\b[^|;]*-exec\\s+(bash|sh|curl|wget)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}find{{NOT_FILENAME}}[^|;]*-exec\\s+(?:{{SHELLS}}|curl|wget)\\b"
   match_on: command
   title: "find -exec executing shell or download commands"
   expires_at: null
@@ -211,20 +308,26 @@
 
 # --- DNS exfiltration ---
 - id: "CLT-CMD-020"
+  version: 1
+  detection_name: "CMD:SageCommand-T [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.80
-  pattern: "\\b(nslookup|dig|host)\\b[^|;]*\\$\\([^)]+\\)\\.[a-zA-Z]"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(nslookup|dig|host){{NOT_FILENAME}}[^|;]*\\$\\([^)]+\\)\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via command substitution as subdomain label"
   expires_at: null
   revoked: false
 
 - id: "CLT-CMD-021"
+  version: 1
+  detection_name: "CMD:SageCommand-U [Heur]"
   category: network_egress
   severity: warning
   confidence: 0.80
-  pattern: "\\b(nslookup|dig|host)\\b[^|;]*`[^`]+`\\.[a-zA-Z]"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-020.
+  pattern: "{{CMD_POS}}(nslookup|dig|host){{NOT_FILENAME}}[^|;]*`[^`]+`\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via backtick substitution as subdomain label"
   expires_at: null
@@ -232,10 +335,18 @@
 
 # --- Loop-based indirect execution ---
 - id: "CLT-CMD-022"
+  version: 1
+  detection_name: "CMD:SageCommand-V [Heur]"
   category: tool
   severity: warning
   confidence: 0.80
-  pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*(\\b(bash|sh)\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(bash|sh|zsh|ksh|dash)\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
+  # {{CMD_POS}} anchors the loop keyword itself so prose merely describing
+  # the shape (`echo "for url in $URLS; do curl $url | sh; done ..."`) no
+  # longer fires. The bare `\b` on the inner shell/curl/wget mentions is left
+  # as-is: they're only reachable once a real `for`/`while ...; do` has
+  # already matched at command position, so they aren't an independent
+  # prose-mention surface the way the outer keyword was.
+  pattern: "{{CMD_POS}}(while|for){{NOT_FILENAME}}[^;]*;\\s*do[^;]*(\\b(?:{{SHELLS}})\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(?:{{SHELLS}})\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
   match_on: command
   title: "Loop executing shell or download commands"
   expires_at: null
@@ -245,10 +356,14 @@
 
 # Python socket reverse shell
 - id: "CLT-CMD-023"
+  version: 1
+  detection_name: "CMD:SageCommand-W [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "python[23]?\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-015. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}python[23]?{{NOT_FILENAME}}\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
   match_on: command
   title: "Python reverse shell via socket"
   expires_at: null
@@ -256,10 +371,14 @@
 
 # Ruby TCPSocket reverse shell
 - id: "CLT-CMD-024"
+  version: 1
+  detection_name: "CMD:SageCommand-X [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "ruby\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}ruby{{NOT_FILENAME}}\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
   match_on: command
   title: "Ruby reverse shell via TCPSocket"
   expires_at: null
@@ -267,10 +386,13 @@
 
 # zsh -c reverse shell pattern
 - id: "CLT-CMD-025"
+  version: 1
+  detection_name: "CMD:SageCommand-Y [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bzsh\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}zsh{{NOT_FILENAME}}\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
   match_on: command
   title: "Zsh reverse shell pattern"
   expires_at: null
@@ -278,10 +400,13 @@
 
 # --- Recursive deletion of critical system directories ---
 - id: "CLT-CMD-026"
+  version: 1
+  detection_name: "CMD:SageCommand-Z [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "\\brm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-006.
+  pattern: "{{CMD_POS}}rm{{NOT_FILENAME}}\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
   match_on: command
   title: "Recursive deletion of critical system directory"
   expires_at: null
@@ -289,10 +414,13 @@
 
 # --- Deletion of .env files ---
 - id: "CLT-CMD-027"
+  version: 1
+  detection_name: "CMD:SageCommand-AA [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-006.
+  pattern: "{{CMD_POS}}rm{{NOT_FILENAME}}\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
   match_on: command
   title: "Deletion of .env file"
   expires_at: null
@@ -300,10 +428,13 @@
 
 # --- Deletion of database files ---
 - id: "CLT-CMD-028"
+  version: 1
+  detection_name: "CMD:SageCommand-AB [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-006.
+  pattern: "{{CMD_POS}}rm{{NOT_FILENAME}}\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
   match_on: command
   title: "Deletion of database file"
   expires_at: null
@@ -311,10 +442,13 @@
 
 # --- Deletion of .git directory ---
 - id: "CLT-CMD-029"
+  version: 1
+  detection_name: "CMD:SageCommand-AC [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b(rm|del|rmdir|rd|Remove-Item|unlink)\\b.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-SELF-001.
+  pattern: "{{CMD_POS}}(rm|del|rmdir|rd|Remove-Item|unlink){{NOT_FILENAME}}.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command
   title: "Deletion of .git directory"

package/resources/threats/credentials.yaml

@@ -4,6 +4,8 @@
 
 # --- Known API key prefixes ---
 - id: "CLT-CRED-001"
+  version: 1
+  detection_name: "CMD:SageCredential-A [Heur]"
   category: secrets
   severity: critical
   confidence: 0.80
@@ -15,10 +17,13 @@
 
 # --- Export of credential env vars ---
 - id: "CLT-CRED-002"
+  version: 1
+  detection_name: "CMD:SageCredential-B [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\bexport\\s+[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*="
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}export{{NOT_FILENAME}}\\s+[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*="
   match_on: command
   title: "Export of environment variable with credential keyword"
   expires_at: null
@@ -26,6 +31,8 @@
 
 # --- .env file writes ---
 - id: "CLT-CRED-003"
+  version: 1
+  detection_name: "CMD:SageCredential-C [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -37,10 +44,13 @@
 
 # --- Reading credential files ---
 - id: "CLT-CRED-004"
+  version: 1
+  detection_name: "CMD:SageCredential-D [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(cat|less|more|head|tail){{NOT_FILENAME}}\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
   match_on: command
   title: "Reading credential or secret file"
   expires_at: null
@@ -48,6 +58,8 @@
 
 # --- Plaintext credential assignment ---
 - id: "CLT-CRED-005"
+  version: 1
+  detection_name: "CMD:SageCredential-E [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -59,6 +71,8 @@
 
 # --- Long-form API key patterns ---
 - id: "CLT-CRED-006"
+  version: 1
+  detection_name: "CMD:SageCredential-F [Heur]"
   category: secrets
   severity: critical
   confidence: 0.92
@@ -70,13 +84,16 @@
 
 # --- Copy/move/link secret files ---
 - id: "CLT-CRED-007"
+  version: 1
+  detection_name: "CMD:SageCredential-G [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml
-  pattern: "\\b(cp|mv|ln|rsync|install|ditto)\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(cp|mv|ln|rsync|install|ditto){{NOT_FILENAME}}\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
   match_on: command
   title: "Copy/move/link of credential or secret file"
   expires_at: null
@@ -84,13 +101,16 @@
 
 # --- Archive secret files ---
 - id: "CLT-CRED-008"
+  version: 1
+  detection_name: "CMD:SageCredential-H [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml
-  pattern: "\\b(tar|zip|7z|rar|gzip)\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}(tar|zip|7z|rar|gzip){{NOT_FILENAME}}\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
   match_on: command
   title: "Archiving credential or secret file"
   expires_at: null