@gendigital/sage-opencode 0.12.0 → 0.14.0

package/resources/threats/mac-credentials.yaml

@@ -4,10 +4,15 @@
 
 # Keychain password extraction (find-generic-password)
 - id: "CLT-MAC-CRED-001"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-A [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "\\bsecurity\\b.*\\bfind-generic-password\\b.*-w"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  # The inner `\bfind-generic-password\b` is left as bare -- only reachable
+  # once `security` has already matched at command position.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bfind-generic-password\\b.*-w"
   match_on: command
   title: "Keychain password extraction via security find-generic-password"
   expires_at: null
@@ -15,10 +20,13 @@
 
 # Keychain internet password extraction
 - id: "CLT-MAC-CRED-002"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-B [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "\\bsecurity\\b.*\\bfind-internet-password\\b.*-w"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bfind-internet-password\\b.*-w"
   match_on: command
   title: "Keychain internet password extraction via security find-internet-password"
   expires_at: null
@@ -26,10 +34,13 @@
 
 # Keychain dump
 - id: "CLT-MAC-CRED-003"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-C [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
-  pattern: "\\bsecurity\\b.*\\bdump-keychain\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bdump-keychain\\b"
   match_on: command
   title: "Full keychain dump via security dump-keychain"
   expires_at: null
@@ -37,10 +48,13 @@
 
 # Keychain unlock with plaintext password
 - id: "CLT-MAC-CRED-004"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-D [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90
-  pattern: "\\bsecurity\\b.*\\bunlock-keychain\\b.*-p"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bunlock-keychain\\b.*-p"
   match_on: command
   title: "Keychain unlock with plaintext password"
   expires_at: null
@@ -48,10 +62,13 @@
 
 # Keychain export
 - id: "CLT-MAC-CRED-005"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-E [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\bsecurity\\b.*\\bexport\\b.*-k"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bexport\\b.*-k"
   match_on: command
   title: "Keychain item export via security export"
   expires_at: null
@@ -59,10 +76,13 @@
 
 # Keychain deletion
 - id: "CLT-MAC-CRED-006"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-F [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90
-  pattern: "\\bsecurity\\b.*\\bdelete-keychain\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `security`, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}security{{NOT_FILENAME}}.*\\bdelete-keychain\\b"
   match_on: command
   title: "Keychain deletion via security delete-keychain"
   expires_at: null
@@ -70,10 +90,13 @@
 
 # Directory Services auth data read
 - id: "CLT-MAC-CRED-007"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-G [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
-  pattern: "\\bdscl\\b.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}dscl{{NOT_FILENAME}}.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
   match_on: command
   title: "Read user authentication data via dscl"
   expires_at: null
@@ -81,10 +104,13 @@
 
 # Direct Keychain SQLite access
 - id: "CLT-MAC-CRED-008"
+  version: 1
+  detection_name: "CMD:SageMacOSCredential-H [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90
-  pattern: "\\bsqlite3\\b.*(/Library/Keychains/|login\\.keychain)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}sqlite3{{NOT_FILENAME}}.*(/Library/Keychains/|login\\.keychain)"
   match_on: command
   title: "Direct Keychain database access via sqlite3"
   expires_at: null

package/resources/threats/mac-files.yaml

@@ -5,6 +5,8 @@
 
 # LaunchAgent/LaunchDaemon plist (migrated from files.yaml CLT-FILE-005)
 - id: "CLT-MAC-FILE-001"
+  version: 1
+  detection_name: "FN:SageMacOSFile-A [Heur]"
   category: tool
   severity: warning
   confidence: 0.90
@@ -16,6 +18,8 @@
 
 # TCC privacy permissions database
 - id: "CLT-MAC-FILE-002"
+  version: 1
+  detection_name: "FN:SageMacOSFile-B [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -27,6 +31,8 @@
 
 # Authorization database
 - id: "CLT-MAC-FILE-003"
+  version: 1
+  detection_name: "FN:SageMacOSFile-C [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -38,6 +44,8 @@
 
 # Kernel extensions
 - id: "CLT-MAC-FILE-004"
+  version: 1
+  detection_name: "FN:SageMacOSFile-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -49,6 +57,8 @@
 
 # Security Agent Plugins
 - id: "CLT-MAC-FILE-005"
+  version: 1
+  detection_name: "FN:SageMacOSFile-E [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -60,6 +70,8 @@
 
 # Periodic scripts directory
 - id: "CLT-MAC-FILE-006"
+  version: 1
+  detection_name: "FN:SageMacOSFile-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -71,6 +83,8 @@
 
 # Emond rules directory
 - id: "CLT-MAC-FILE-007"
+  version: 1
+  detection_name: "FN:SageMacOSFile-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -82,6 +96,8 @@
 
 # Safari credential/cookie stores
 - id: "CLT-MAC-FILE-008"
+  version: 1
+  detection_name: "FN:SageMacOSFile-H [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90
@@ -93,6 +109,8 @@
 
 # Managed Preferences (MDM profiles)
 - id: "CLT-MAC-FILE-009"
+  version: 1
+  detection_name: "FN:SageMacOSFile-I [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -104,6 +122,8 @@
 
 # Keychain files
 - id: "CLT-MAC-FILE-010"
+  version: 1
+  detection_name: "FN:SageMacOSFile-J [Heur]"
   category: secrets
   severity: critical
   confidence: 0.90

package/resources/threats/mac-obfuscation.yaml

@@ -4,10 +4,13 @@
 
 # osascript 'do shell script' wrapping (shell via AppleScript)
 - id: "CLT-MAC-OBFUS-001"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-A [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bosascript\\b.*do shell script"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*do shell script"
   case_insensitive: true
   match_on: command
   title: "Shell command obfuscated via AppleScript do shell script"
@@ -16,10 +19,13 @@
 
 # JXA (JavaScript for Automation) execution
 - id: "CLT-MAC-OBFUS-002"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-B [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
-  pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*-l\\s+JavaScript.*-e"
   case_insensitive: true
   match_on: command
   title: "JXA inline execution (JavaScript for Automation obfuscation)"
@@ -28,10 +34,15 @@
 
 # Base64 decode piped to osascript
 - id: "CLT-MAC-OBFUS-003"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-C [Heur]"
   category: tool
   severity: critical
   confidence: 0.95
-  pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `base64`, same shape as CLT-CMD-009.
+  # Had no boundary at all. Trailing {{NOT_FILENAME}} on `osascript` too --
+  # without it, a longer identifier like "osascriptable-tool" still matches.
+  pattern: "{{CMD_POS}}base64{{NOT_FILENAME}}\\s+(-d|-D|--decode).*\\|.*osascript{{NOT_FILENAME}}"
   match_on: command
   title: "Base64 decode piped to osascript (encoded payload execution)"
   expires_at: null
@@ -39,6 +50,8 @@
 
 # DYLD_INSERT_LIBRARIES injection
 - id: "CLT-MAC-OBFUS-004"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -50,10 +63,13 @@
 
 # Quarantine attribute removal (evasion)
 - id: "CLT-MAC-OBFUS-005"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}xattr{{NOT_FILENAME}}.*(-d|-c).*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal (Gatekeeper evasion)"
   expires_at: null
@@ -63,10 +79,13 @@
 
 # plutil plist manipulation (payload hiding)
 - id: "CLT-MAC-OBFUS-006"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}plutil{{NOT_FILENAME}}.*-convert\\s+(binary1|raw)"
   match_on: command
   title: "Plist conversion to binary (payload obfuscation)"
   expires_at: null
@@ -74,10 +93,13 @@
 
 # Swift/swiftc inline execution
 - id: "CLT-MAC-OBFUS-007"
+  version: 1
+  detection_name: "CMD:SageMacOSObfuscation-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}swift{{NOT_FILENAME}}\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
   case_insensitive: true
   match_on: command
   title: "Swift inline execution with system calls"

package/resources/threats/mac-persistence.yaml

@@ -5,6 +5,8 @@
 
 # LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
 - id: "CLT-MAC-PERSIST-001"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-A [Heur]"
   category: tool
   severity: warning
   confidence: 0.90
@@ -16,10 +18,13 @@
 
 # Login Items via osascript
 - id: "CLT-MAC-PERSIST-002"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-B [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bosascript\\b.*login item"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*login item"
   case_insensitive: true
   match_on: command
   title: "Add login item via osascript"
@@ -28,10 +33,15 @@
 
 # Login window manipulation via defaults
 - id: "CLT-MAC-PERSIST-003"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-C [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `defaults`, same shape as CLT-CMD-009.
+  # The inner `\bwrite\b` is left as bare -- only reachable once `defaults`
+  # has already matched at command position.
+  pattern: "{{CMD_POS}}defaults{{NOT_FILENAME}}.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
   case_insensitive: true
   match_on: command
   title: "Login window hook manipulation via defaults write"
@@ -40,6 +50,8 @@
 
 # Authorization plugin persistence
 - id: "CLT-MAC-PERSIST-004"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-D [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -51,6 +63,8 @@
 
 # Periodic script drop
 - id: "CLT-MAC-PERSIST-005"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-E [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -64,6 +78,8 @@
 
 # emond rules
 - id: "CLT-MAC-PERSIST-006"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-F [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -75,6 +91,8 @@
 
 # DYLD_INSERT_LIBRARIES in RC files
 - id: "CLT-MAC-PERSIST-007"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-G [Heur]"
   category: tool
   severity: critical
   confidence: 0.90
@@ -86,10 +104,13 @@
 
 # Folder Actions via osascript
 - id: "CLT-MAC-PERSIST-008"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-H [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\bosascript\\b.*folder action"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}osascript{{NOT_FILENAME}}.*folder action"
   case_insensitive: true
   match_on: command
   title: "Folder Action script persistence via osascript"
@@ -98,10 +119,15 @@
 
 # launchctl load/bootstrap persistent agent
 - id: "CLT-MAC-PERSIST-009"
+  version: 1
+  detection_name: "CMD:SageMacOSPersistence-I [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
-  pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}} on `launchctl`, same shape as CLT-CMD-009.
+  # The inner `\b(load|bootstrap)\b` is left as bare -- only reachable once
+  # `launchctl` has already matched at command position.
+  pattern: "{{CMD_POS}}launchctl{{NOT_FILENAME}}.*\\b(load|bootstrap)\\b"
   match_on: command
   title: "Load persistent launch agent/daemon via launchctl"
   expires_at: null

package/resources/threats/mac-supply-chain.yaml

@@ -4,10 +4,13 @@
 
 # brew install without version pin
 - id: "CLT-MAC-SUPPLY-001"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-A [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.60
-  pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}brew{{NOT_FILENAME}}\\s+install\\b(?!.*@\\d)"
   match_on: command
   title: "Homebrew install without version pin"
   expires_at: null
@@ -15,10 +18,13 @@
 
 # installer -pkg from remote URL
 - id: "CLT-MAC-SUPPLY-002"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-B [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.85
-  pattern: "\\binstaller\\b.*-pkg.*https?://"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}installer{{NOT_FILENAME}}.*-pkg.*https?://"
   case_insensitive: true
   match_on: command
   title: "Remote package install via installer -pkg (unsigned)"
@@ -27,10 +33,13 @@
 
 # brew install --cask from non-default tap
 - id: "CLT-MAC-SUPPLY-003"
+  version: 1
+  detection_name: "CMD:SageMacOSSupplyChain-C [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.60
-  pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
+  # {{CMD_POS}} + {{NOT_FILENAME}}, same shape as CLT-CMD-009.
+  pattern: "{{CMD_POS}}brew{{NOT_FILENAME}}\\s+(install|reinstall)\\s+--cask\\b"
   match_on: command
   title: "Homebrew cask install (binary application)"
   expires_at: null