@gendigital/sage-opencode 0.12.0 → 0.13.0

package/resources/threats/win-credentials.yaml

@@ -4,10 +4,13 @@
 
 # cmdkey stored credentials
 - id: "CLT-WIN-CRED-001"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-A [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\b[Cc]mdkey\\s+/add:"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Cc]mdkey(?:\\.exe)?{{NOT_FILENAME}}\\s+/add:"
   match_on: command
   title: "Stored credential creation via cmdkey"
   expires_at: null
@@ -15,10 +18,14 @@
 
 # ConvertTo-SecureString with plaintext
 - id: "CLT-WIN-CRED-002"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-B [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "[Cc]onvert[Tt]o-[Ss]ecure[Ss]tring.*-[Aa]s[Pp]lain[Tt]ext"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Cc]onvert[Tt]o-[Ss]ecure[Ss]tring{{NOT_FILENAME}}.*-[Aa]s[Pp]lain[Tt]ext"
   match_on: command
   title: "ConvertTo-SecureString with plaintext password"
   expires_at: null
@@ -26,10 +33,16 @@
 
 # Reading credential files on Windows (type, more, Get-Content)
 - id: "CLT-WIN-CRED-003"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-C [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "(^|[^\\w-])(?:type|more|[Gg]et-[Cc]ontent)\\b.*\\.(?:env|credentials|pgpass|netrc)(?=$|[.\\s\"'`;&|)<>])"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. The old
+  # `(^|[^\w-])` boundary accepted any whitespace-delimited position (still
+  # excluding a `-type`-shaped flag, which the replacement preserves since
+  # {{CMD_POS}} has no valid boundary immediately before a hyphen either).
+  pattern: "{{CMD_POS}}(?:type|more|[Gg]et-[Cc]ontent){{NOT_FILENAME}}.*\\.(?:env|credentials|pgpass|netrc)(?=$|[.\\s\"'`;&|)<>])"
   match_on: command
   title: "Reading credential file via type/more/Get-Content"
   expires_at: null
@@ -37,10 +50,14 @@
 
 # [Environment]::SetEnvironmentVariable with credential keyword
 - id: "CLT-WIN-CRED-004"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-D [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\[Environment\\]::SetEnvironmentVariable.*([Pp]assword|[Ss]ecret|[Tt]oken|[Kk]ey)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}\\[Environment\\]::SetEnvironmentVariable{{NOT_FILENAME}}.*([Pp]assword|[Ss]ecret|[Tt]oken|[Kk]ey)"
   match_on: command
   title: "Setting credential environment variable via .NET"
   expires_at: null
@@ -48,6 +65,8 @@
 
 # $env: credential assignment
 - id: "CLT-WIN-CRED-005"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-E [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -59,10 +78,28 @@
 
 # Mimikatz / sekurlsa
 - id: "CLT-WIN-CRED-006"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-F [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "[Mm]imikatz|[Ss]ekurlsa::"
+  # Neither {{CMD_POS}} nor {{NOT_COMPOUND_LEFT}} fits here: real invocations
+  # routinely have "Mimikatz" as a SUFFIX of a compound name (the PowerSploit
+  # function `Invoke-Mimikatz`), not standalone -- {{CMD_POS}} requires a real
+  # boundary immediately before it, and {{NOT_COMPOUND_LEFT}} would reject the
+  # preceding hyphen, so either would break the single most common real-world
+  # invocation shape. `sekurlsa::` is a Mimikatz module reference that's
+  # always an argument to something, never itself in command position.
+  # {{NOT_AFTER_TEXT_CMD}} alone closes the reported gap (prose/search-command
+  # mentions) without touching either loose-substring-matching property.
+  # case_insensitive covers casing generally, so the term itself no longer
+  # needs hand-cased character classes -- and it must be set here regardless,
+  # since {{NOT_AFTER_TEXT_CMD}}'s denylist (Select-String, Write-Host, ...)
+  # is fixed-case and silently stops suppressing lowercase/mixed-case
+  # invocations without it. See CLT-WIN-PERSIST-008 for the same macro used
+  # the same way.
+  pattern: "{{NOT_AFTER_TEXT_CMD}}(?:mimikatz|sekurlsa::)"
+  case_insensitive: true
   match_on: command
   title: "Mimikatz credential dumping tool"
   expires_at: null
@@ -70,10 +107,13 @@
 
 # Registry hive export for credential theft
 - id: "CLT-WIN-CRED-007"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-G [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "\\breg\\s+save\\b.*\\bHKLM\\\\(SAM|SYSTEM|SECURITY)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}reg(?:\\.exe)?{{NOT_FILENAME}}\\s+save\\b.*\\bHKLM\\\\(SAM|SYSTEM|SECURITY)\\b"
   match_on: command
   title: "Registry hive export for credential theft (reg save HKLM\\SAM/SYSTEM)"
   expires_at: null
@@ -81,10 +121,19 @@
 
 # LSASS credential dumping
 - id: "CLT-WIN-CRED-008"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-H [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "\\b(procdump|procdump64)\\b.*\\blsass\\b|\\brundll32\\b.*\\bcomsvcs(\\.dll)?\\b.*\\bMiniDump\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on each leading verb, same shape as
+  # CLT-CMD-009. Optional `.exe` suffix ahead of {{NOT_FILENAME}}, same as
+  # CLT-MITRE-096 (tscon) -- otherwise `rundll32.exe` would fail to match,
+  # since {{NOT_FILENAME}} itself rejects a trailing dot. The internal
+  # `\blsass\b`/`\bcomsvcs\b`/`\bMiniDump\b` mentions are left as bare --
+  # only reachable once the leading verb has already matched at command
+  # position.
+  pattern: "{{CMD_POS}}(procdump|procdump64)(?:\\.exe)?{{NOT_FILENAME}}.*\\blsass\\b|{{CMD_POS}}rundll32(?:\\.exe)?{{NOT_FILENAME}}.*\\bcomsvcs(\\.dll)?\\b.*\\bMiniDump\\b"
   match_on: command
   title: "LSASS credential dumping (procdump/comsvcs.dll MiniDump)"
   expires_at: null
@@ -92,10 +141,14 @@
 
 # WLAN password extraction (ex CLT-TECH-034)
 - id: "CLT-WIN-CRED-009"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-I [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "netsh.*wlan.*show.*profiles.*key=clear"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}netsh(?:\\.exe)?{{NOT_FILENAME}}.*wlan.*show.*profiles.*key=clear"
   case_insensitive: true
   match_on: command
   title: "WLAN password extraction via netsh"
@@ -104,13 +157,19 @@
 
 # --- Windows copy/move/link of secret files ---
 - id: "CLT-WIN-CRED-010"
+  version: 1
+  detection_name: "CMD:SageWindowsCredential-J [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
   # Protected files: .env*, .aws\credentials, .ssh\(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker\config.json,
   # kubeconfig, .kube\config, master.key, credentials.yml
-  pattern: "\\b(copy|xcopy|robocopy|Copy-Item|Move-Item|mklink)\\b.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws[\\\\/]credentials|\\.ssh[\\\\/](id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker[\\\\/]config\\.json|kubeconfig|\\.kube[\\\\/]config|master\\.key|credentials\\.yml)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. xcopy/robocopy
+  # are real standalone binaries and admit an optional `.exe` suffix; copy/
+  # mklink are cmd builtins and Copy-Item/Move-Item are cmdlets, neither of
+  # which has a `.exe` form.
+  pattern: "{{CMD_POS}}(copy|xcopy(?:\\.exe)?|robocopy(?:\\.exe)?|Copy-Item|Move-Item|mklink){{NOT_FILENAME}}.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws[\\\\/]credentials|\\.ssh[\\\\/](id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker[\\\\/]config\\.json|kubeconfig|\\.kube[\\\\/]config|master\\.key|credentials\\.yml)"
   case_insensitive: true
   match_on: command
   title: "Windows copy/move of credential or secret file"

package/resources/threats/win-files.yaml

@@ -5,6 +5,8 @@
 
 # SAM/SECURITY/SYSTEM hive
 - id: "CLT-WIN-FILE-001"
+  version: 1
+  detection_name: "FN:SageWindowsFile-A [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -16,6 +18,8 @@
 
 # NTDS.dit (Active Directory database)
 - id: "CLT-WIN-FILE-002"
+  version: 1
+  detection_name: "FN:SageWindowsFile-B [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -27,6 +31,8 @@
 
 # Windows hosts file
 - id: "CLT-WIN-FILE-003"
+  version: 1
+  detection_name: "FN:SageWindowsFile-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -38,6 +44,8 @@
 
 # Startup folder
 - id: "CLT-WIN-FILE-004"
+  version: 1
+  detection_name: "FN:SageWindowsFile-D [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -49,6 +57,8 @@
 
 # Executable script in System32/SysWOW64
 - id: "CLT-WIN-FILE-005"
+  version: 1
+  detection_name: "FN:SageWindowsFile-E [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -60,6 +70,8 @@
 
 # Driver file in System32/drivers
 - id: "CLT-WIN-FILE-006"
+  version: 1
+  detection_name: "FN:SageWindowsFile-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -71,6 +83,8 @@
 
 # Task Scheduler directory
 - id: "CLT-WIN-FILE-007"
+  version: 1
+  detection_name: "FN:SageWindowsFile-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -82,6 +96,8 @@
 
 # SSH key or config file (Windows path)
 - id: "CLT-WIN-FILE-008"
+  version: 1
+  detection_name: "FN:SageWindowsFile-H [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -93,6 +109,8 @@
 
 # AWS credentials file (Windows path)
 - id: "CLT-WIN-FILE-009"
+  version: 1
+  detection_name: "FN:SageWindowsFile-I [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -104,6 +122,8 @@
 
 # Browser credential stores
 - id: "CLT-WIN-FILE-010"
+  version: 1
+  detection_name: "FN:SageWindowsFile-J [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90

package/resources/threats/win-obfuscation.yaml

@@ -4,6 +4,8 @@
 
 # PowerShell -EncodedCommand
 - id: "CLT-WIN-OBFUS-001"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
@@ -15,10 +17,14 @@
 
 # certutil -decode
 - id: "CLT-WIN-OBFUS-002"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-B [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll]\\s.*-decode"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009. Had no
+  # boundary at all.
+  pattern: "{{CMD_POS}}[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll](?:\\.exe)?{{NOT_FILENAME}}\\s.*-decode"
   match_on: command
   title: "certutil base64 decode (obfuscation)"
   expires_at: null
@@ -26,6 +32,8 @@
 
 # Hidden PowerShell window
 - id: "CLT-WIN-OBFUS-003"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -37,6 +45,8 @@
 
 # Bypass + NoProfile combo
 - id: "CLT-WIN-OBFUS-004"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-D [Heur]"
   category: tool
   severity: warning
   confidence: 0.90
@@ -48,6 +58,8 @@
 
 # [char] code obfuscation
 - id: "CLT-WIN-OBFUS-005"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -59,6 +71,8 @@
 
 # Security provider DLL injection via registry
 - id: "CLT-WIN-OBFUS-006"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -70,10 +84,15 @@
 
 # mshta VBScript execution (Execute, CreateObject, close patterns)
 - id: "CLT-WIN-OBFUS-007"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bmshta\\b.*\\bvbscript:(Execute|CreateObject|close\\s*\\()"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-MITRE-096 (tscon),
+  # including the optional `.exe` suffix ahead of {{NOT_FILENAME}} (which
+  # itself rejects a trailing dot).
+  pattern: "{{CMD_POS}}mshta(?:\\.exe)?{{NOT_FILENAME}}.*\\bvbscript:(Execute|CreateObject|close\\s*\\()"
   case_insensitive: true
   match_on: command
   title: "mshta VBScript execution (Execute/CreateObject obfuscation)"
@@ -82,10 +101,13 @@
 
 # mshta javascript: eval execution
 - id: "CLT-WIN-OBFUS-008"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-H [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bmshta\\b.*\\bjavascript:"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-OBFUS-007.
+  pattern: "{{CMD_POS}}mshta(?:\\.exe)?{{NOT_FILENAME}}.*\\bjavascript:"
   case_insensitive: true
   match_on: command
   title: "mshta JavaScript execution (LOLBin obfuscation)"
@@ -94,10 +116,15 @@
 
 # wscript/cscript //E: engine override on non-script files
 - id: "CLT-WIN-OBFUS-009"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-I [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "(wscript|cscript)(\\.exe)?\\b.*//[Ee]:([Vv][Bb][Ss]cript|[Jj][Ss]cript)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} instead of a leading bare alternation with
+  # no command-position boundary; {{NOT_FILENAME}} replaces the trailing
+  # `\b`, same effect but also rejects a trailing dot.
+  pattern: "{{CMD_POS}}(wscript|cscript)(?:\\.exe)?{{NOT_FILENAME}}.*//[Ee]:([Vv][Bb][Ss]cript|[Jj][Ss]cript)"
   case_insensitive: true
   match_on: command
   title: "wscript/cscript script engine override (//E:VBScript evasion)"
@@ -106,6 +133,8 @@
 
 # NTFS $INDEX_ALLOCATION folder creation (ex CLT-TECH-001)
 - id: "CLT-WIN-OBFUS-010"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-J [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -118,6 +147,8 @@
 
 # ADS bypass via type redirect or wmic process create (ex CLT-TECH-002)
 - id: "CLT-WIN-OBFUS-011"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-K [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -130,6 +161,8 @@
 
 # Dotdotdot hidden folder (ex CLT-TECH-003)
 - id: "CLT-WIN-OBFUS-012"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-L [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -142,10 +175,15 @@
 
 # cmd caret obfuscation (ex CLT-TECH-014)
 - id: "CLT-WIN-OBFUS-013"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-M [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "cmd.*([^\\^]\\^[a-z].*){5}"
+  # {{CMD_POS}} + {{NOT_FILENAME}} (with optional `.exe` suffix), same shape
+  # as CLT-MITRE-096. Had no boundary at all -- not even a `\b` -- so `cmd`
+  # matched as a bare substring of `cmdlet` or similar.
+  pattern: "{{CMD_POS}}cmd(?:\\.exe)?{{NOT_FILENAME}}.*([^\\^]\\^[a-z].*){5}"
   case_insensitive: true
   match_on: command
   title: "cmd caret (^) obfuscation"
@@ -154,10 +192,13 @@
 
 # cmd substring concatenation obfuscation (ex CLT-TECH-015)
 - id: "CLT-WIN-OBFUS-014"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-N [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "cmd.*(%[^%]+:~[^%]*%[a-z]*){2}"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-OBFUS-013.
+  pattern: "{{CMD_POS}}cmd(?:\\.exe)?{{NOT_FILENAME}}.*(%[^%]+:~[^%]*%[a-z]*){2}"
   case_insensitive: true
   match_on: command
   title: "cmd substring concatenation obfuscation"
@@ -166,10 +207,14 @@
 
 # PowerShell backtick obfuscation (ex CLT-TECH-021)
 - id: "CLT-WIN-OBFUS-015"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-O [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.*(`[a-z].*){4}"
+  # {{CMD_POS}} + {{NOT_FILENAME}} (with optional `.exe` suffix), same shape
+  # as CLT-MITRE-096. Had no boundary at all.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.*(`[a-z].*){4}"
   case_insensitive: true
   match_on: command
   title: "PowerShell backtick obfuscation"
@@ -178,10 +223,13 @@
 
 # PowerShell XOR decryption (ex CLT-TECH-026)
 - id: "CLT-WIN-OBFUS-016"
+  version: 1
+  detection_name: "CMD:SageWindowsObfuscation-P [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "powershell.+-bxor\\s*['\"]"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-OBFUS-015.
+  pattern: "{{CMD_POS}}powershell(?:\\.exe)?{{NOT_FILENAME}}.+-bxor\\s*['\"]"
   case_insensitive: true
   match_on: command
   title: "PowerShell XOR decryption"

package/resources/threats/win-persistence.yaml

@@ -5,10 +5,13 @@
 
 # Registry Run key via reg add
 - id: "CLT-WIN-PERSIST-001"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b[Rr][Ee][Gg]\\b\\s+[Aa][Dd][Dd].*\\\\(Run|RunOnce)\\\\"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Rr][Ee][Gg](?:\\.exe)?{{NOT_FILENAME}}\\s+[Aa][Dd][Dd].*\\\\(Run|RunOnce)\\\\"
   match_on: command
   title: "Registry Run key persistence via reg add"
   expires_at: null
@@ -16,10 +19,13 @@
 
 # sc create/config service
 - id: "CLT-WIN-PERSIST-002"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-B [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b[Ss][Cc]\\b\\s+(create|config).*binpath"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ss][Cc](?:\\.exe)?{{NOT_FILENAME}}\\s+(create|config).*binpath"
   match_on: command
   title: "Windows service creation/modification via sc"
   expires_at: null
@@ -27,10 +33,13 @@
 
 # schtasks /create
 - id: "CLT-WIN-PERSIST-003"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b[Ss][Cc][Hh][Tt][Aa][Ss][Kk][Ss]\\b.*/[Cc]reate"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}[Ss][Cc][Hh][Tt][Aa][Ss][Kk][Ss](?:\\.exe)?{{NOT_FILENAME}}.*/[Cc]reate"
   match_on: command
   title: "Scheduled task creation via schtasks"
   expires_at: null
@@ -38,10 +47,16 @@
 
 # PowerShell New-ScheduledTask
 - id: "CLT-WIN-PERSIST-004"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-D [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "[Nn]ew-[Ss]cheduled[Tt]ask"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. Had no
+  # boundary at all, so it matched inside the distinct, real cmdlets
+  # New-ScheduledTaskAction and New-ScheduledTaskTrigger even when the real
+  # New-ScheduledTask was never called.
+  pattern: "{{CMD_POS}}[Nn]ew-[Ss]cheduled[Tt]ask{{NOT_FILENAME}}"
   match_on: command
   title: "PowerShell scheduled task creation"
   expires_at: null
@@ -49,10 +64,15 @@
 
 # PowerShell Set-ItemProperty Run key
 - id: "CLT-WIN-PERSIST-005"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-E [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "[Ss]et-[Ii]tem[Pp]roperty.*\\\\(Run|RunOnce)\\\\"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. Had no
+  # boundary at all, so it matched inside the distinct, real cmdlet
+  # Set-ItemPropertyValue even when Set-ItemProperty itself was never called.
+  pattern: "{{CMD_POS}}[Ss]et-[Ii]tem[Pp]roperty{{NOT_FILENAME}}.*\\\\(Run|RunOnce)\\\\"
   match_on: command
   title: "PowerShell Registry Run key persistence"
   expires_at: null
@@ -60,10 +80,13 @@
 
 # PowerShell New-Service
 - id: "CLT-WIN-PERSIST-006"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\b[Nn]ew-[Ss]ervice\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036.
+  pattern: "{{CMD_POS}}[Nn]ew-[Ss]ervice{{NOT_FILENAME}}"
   match_on: command
   title: "PowerShell Windows service creation"
   expires_at: null
@@ -71,6 +94,8 @@
 
 # Startup folder path
 - id: "CLT-WIN-PERSIST-007"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -82,10 +107,23 @@
 
 # WMI event subscription persistence
 - id: "CLT-WIN-PERSIST-008"
+  version: 1
+  detection_name: "CMD:SageWindowsPersistence-H [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\b(CommandLineEventConsumer|ActiveScriptEventConsumer)\\b"
+  # A WMI class name legitimately appears as an argument value (`-Class
+  # CommandLineEventConsumer`), so {{CMD_POS}} would break real detections —
+  # only the symmetric boundary guard applies here, plus {{NOT_FILENAME}}
+  # (instead of {{NOT_COMPOUND_RIGHT}}) to also reject a trailing dot
+  # (`CommandLineEventConsumer.md`) and {{NOT_AFTER_TEXT_CMD}} to reject a
+  # mention inside a search/print command (`grep "CommandLineEventConsumer"`)
+  # without gating on quotes, which would just hand an attacker a trivial
+  # evasion. See {{NOT_AFTER_TEXT_CMD}} in _macros.yaml for the full guard
+  # design and its accepted residual gap (an unlisted benign command still
+  # false-positives).
+  pattern: "{{NOT_AFTER_TEXT_CMD}}{{NOT_COMPOUND_LEFT}}(CommandLineEventConsumer|ActiveScriptEventConsumer){{NOT_FILENAME}}"
+  case_insensitive: true
   match_on: command
   title: "WMI event subscription persistence"
   expires_at: null

package/resources/threats/win-supply-chain.yaml

@@ -4,10 +4,14 @@
 
 # Install-Module without -RequiredVersion
 - id: "CLT-WIN-SUPPLY-001"
+  version: 1
+  detection_name: "CMD:SageWindowsSupplyChain-A [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.60
-  pattern: "[Ii]nstall-[Mm]odule\\s+(?!.*-[Rr]equired[Vv]ersion)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-WIN-CMD-036. The bare
+  # cmdlet mention fired on prose merely describing the risk.
+  pattern: "{{CMD_POS}}[Ii]nstall-[Mm]odule{{NOT_FILENAME}}\\s+(?!.*-[Rr]equired[Vv]ersion)"
   match_on: command
   title: "PowerShell Install-Module without -RequiredVersion"
   expires_at: null