@gendigital/sage-opencode 0.11.0 → 0.13.0

package/resources/threats/mac-obfuscation.yaml

@@ -4,10 +4,13 @@
 
 # osascript 'do shell script' wrapping (shell via AppleScript)
 - id: "CLT-MAC-OBFUS-001"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bosascript\\b.*do shell script"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*do shell script"
   case_insensitive: true
   match_on: command
   title: "Shell command obfuscated via AppleScript do shell script"
@@ -16,10 +19,13 @@
 
 # JXA (JavaScript for Automation) execution
 - id: "CLT-MAC-OBFUS-002"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-B [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*-l\\s+JavaScript.*-e"
   case_insensitive: true
   match_on: command
   title: "JXA inline execution (JavaScript for Automation obfuscation)"
@@ -28,10 +34,15 @@
 
 # Base64 decode piped to osascript
 - id: "CLT-MAC-OBFUS-003"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-C [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `base64`, same shape as CLT-CMD-009.
+  # Had no boundary at all. Trailing {{NOT_FILENAME}} on `osascript` too --
+  # without it, a longer identifier like "osascriptable-tool" still matches.
+  pattern: "{{CMD_POS}}base64{{NOT_FILENAME}}\\s+(-d|-D|--decode).*\\|.*osascript{{NOT_FILENAME}}"
   match_on: command
   title: "Base64 decode piped to osascript (encoded payload execution)"
   expires_at: null
@@ -39,6 +50,8 @@
 
 # DYLD_INSERT_LIBRARIES injection
 - id: "CLT-MAC-OBFUS-004"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -50,10 +63,13 @@
 
 # Quarantine attribute removal (evasion)
 - id: "CLT-MAC-OBFUS-005"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}xattr{{NOT_FILENAME}}.*(-d|-c).*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal (Gatekeeper evasion)"
   expires_at: null
@@ -63,10 +79,13 @@
 
 # plutil plist manipulation (payload hiding)
 - id: "CLT-MAC-OBFUS-006"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}plutil{{NOT_FILENAME}}.*-convert\\s+(binary1|raw)"
   match_on: command
   title: "Plist conversion to binary (payload obfuscation)"
   expires_at: null
@@ -74,10 +93,13 @@
 
 # Swift/swiftc inline execution
 - id: "CLT-MAC-OBFUS-007"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}swift{{NOT_FILENAME}}\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
   case_insensitive: true
   match_on: command
   title: "Swift inline execution with system calls"

package/resources/threats/mac-persistence.yaml

@@ -5,6 +5,8 @@
 
 # LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
 - id: "CLT-MAC-PERSIST-001"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-A [Heur]"
   category: tool
   severity: warning
   confidence: 0.90
@@ -16,10 +18,13 @@
 
 # Login Items via osascript
 - id: "CLT-MAC-PERSIST-002"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-B [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bosascript\\b.*login item"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*login item"
   case_insensitive: true
   match_on: command
   title: "Add login item via osascript"
@@ -28,10 +33,15 @@
 
 # Login window manipulation via defaults
 - id: "CLT-MAC-PERSIST-003"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `defaults`, same shape as CLT-CMD-009.
+  # The inner `\bwrite\b` is left as bare -- only reachable once `defaults`
+  # has already matched at command position.
+  pattern: "{{CMD_POS}}defaults{{NOT_FILENAME}}.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
   case_insensitive: true
   match_on: command
   title: "Login window hook manipulation via defaults write"
@@ -40,6 +50,8 @@
 
 # Authorization plugin persistence
 - id: "CLT-MAC-PERSIST-004"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -51,6 +63,8 @@
 
 # Periodic script drop
 - id: "CLT-MAC-PERSIST-005"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -64,6 +78,8 @@
 
 # emond rules
 - id: "CLT-MAC-PERSIST-006"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -75,6 +91,8 @@
 
 # DYLD_INSERT_LIBRARIES in RC files
 - id: "CLT-MAC-PERSIST-007"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -86,10 +104,13 @@
 
 # Folder Actions via osascript
 - id: "CLT-MAC-PERSIST-008"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-H [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bosascript\\b.*folder action"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*folder action"
   case_insensitive: true
   match_on: command
   title: "Folder Action script persistence via osascript"
@@ -98,10 +119,15 @@
 
 # launchctl load/bootstrap persistent agent
 - id: "CLT-MAC-PERSIST-009"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-I [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `launchctl`, same shape as CLT-CMD-009.
+  # The inner `\b(load|bootstrap)\b` is left as bare -- only reachable once
+  # `launchctl` has already matched at command position.
+  pattern: "{{CMD_POS}}launchctl{{NOT_FILENAME}}.*\\b(load|bootstrap)\\b"
   match_on: command
   title: "Load persistent launch agent/daemon via launchctl"
   expires_at: null

package/resources/threats/mac-supply-chain.yaml

@@ -4,10 +4,13 @@
 
 # brew install without version pin
 - id: "CLT-MAC-SUPPLY-001"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-A [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.60
-  pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}brew{{NOT_FILENAME}}\\s+install\\b(?!.*@\\d)"
   match_on: command
   title: "Homebrew install without version pin"
   expires_at: null
@@ -15,10 +18,13 @@
 
 # installer -pkg from remote URL
 - id: "CLT-MAC-SUPPLY-002"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-B [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.85
-  pattern: "\\binstaller\\b.*-pkg.*https?://"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}installer{{NOT_FILENAME}}.*-pkg.*https?://"
   case_insensitive: true
   match_on: command
   title: "Remote package install via installer -pkg (unsigned)"
@@ -27,10 +33,13 @@
 
 # brew install --cask from non-default tap
 - id: "CLT-MAC-SUPPLY-003"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-C [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.60
-  pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}brew{{NOT_FILENAME}}\\s+(install|reinstall)\\s+--cask\\b"
   match_on: command
   title: "Homebrew cask install (binary application)"
   expires_at: null