@gendigital/sage-opencode 0.9.0

package/resources/threats/files.yaml

@@ -0,0 +1,239 @@
+# Sensitive file path threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Detects Read/Write/Edit/Delete operations targeting security-sensitive files
+
+# --- System auth files ---
+- id: "CLT-FILE-001"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "(/etc/passwd|/etc/shadow|/etc/sudoers)"
+  match_on: file_path
+  title: "Access system authentication file"
+  expires_at: null
+  revoked: false
+
+# --- SSH authorized_keys ---
+- id: "CLT-FILE-002"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\.ssh/authorized_keys"
+  match_on: file_path
+  title: "Access SSH authorized_keys (unauthorized access persistence)"
+  expires_at: null
+  revoked: false
+
+# --- SSH private keys and config ---
+- id: "CLT-FILE-003"
+  category: secrets
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa|config)$"
+  match_on: file_path
+  title: "Access SSH key or config file"
+  expires_at: null
+  revoked: false
+
+# --- Shell RC files ---
+- id: "CLT-FILE-004"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)$"
+  match_on: file_path
+  title: "Access shell RC file (persistence mechanism)"
+  expires_at: null
+  revoked: false
+
+# --- Cron directories ---
+- id: "CLT-FILE-006"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(/etc/cron\\.(d|daily|hourly|weekly|monthly)/|/var/spool/cron/)"
+  match_on: file_path
+  title: "Access cron directory"
+  expires_at: null
+  revoked: false
+
+# --- systemd unit files ---
+- id: "CLT-FILE-007"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "/etc/systemd/system/"
+  match_on: file_path
+  title: "Access systemd service unit file"
+  expires_at: null
+  revoked: false
+
+# --- Credential/env files ---
+# NOTE: Uses allowlist approach (explicit suffix enumeration) unlike CLT-CRED-003's
+# denylist approach (negative lookahead). This means unknown suffixes like .env.ci
+# match CRED-003 but not FILE-008 — intentional, since file_path matching is more
+# targeted than command-string matching.
+- id: "CLT-FILE-008"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "((^|[\\/\\\\])\\.env(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?|\\.aws/credentials|\\.netrc|\\.pgpass)$"
+  match_on: file_path
+  title: "Access credential or environment file"
+  expires_at: null
+  revoked: false
+
+# --- Git hooks ---
+- id: "CLT-FILE-009"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.git/hooks/"
+  match_on: file_path
+  title: "Access git hook (potential code execution on git events)"
+  expires_at: null
+  revoked: false
+
+# --- Android signing files ---
+- id: "CLT-FILE-010"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(key\\.properties|release\\.keystore|\\.jks|\\.keystore)$"
+  match_on: file_path
+  title: "Access Android signing file"
+  expires_at: null
+  revoked: false
+
+# --- Firebase config files ---
+- id: "CLT-FILE-011"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(google-services\\.json|GoogleService-Info\\.plist)$"
+  match_on: file_path
+  title: "Access Firebase configuration file"
+  expires_at: null
+  revoked: false
+
+# --- Cloud provider credential files ---
+- id: "CLT-FILE-012"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(application_default_credentials\\.json|\\.azure/(accessTokens|msal_token_cache)\\.json|\\.config/doctl/config\\.yaml)$"
+  match_on: file_path
+  title: "Access cloud provider credential file"
+  expires_at: null
+  revoked: false
+
+# --- Package manager tokens ---
+- id: "CLT-FILE-013"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.npmrc|\\.pypirc|\\.gem/credentials|\\.cargo/credentials\\.toml|\\.docker/config\\.json)$"
+  match_on: file_path
+  title: "Access package manager credential file"
+  expires_at: null
+  revoked: false
+
+# --- Terraform state files ---
+- id: "CLT-FILE-014"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(tfstate(\\.backup)?|tfvars(\\.json)?)$"
+  match_on: file_path
+  title: "Access Terraform state or variables file"
+  expires_at: null
+  revoked: false
+
+# --- Secrets/vault files ---
+- id: "CLT-FILE-015"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(master\\.key|credentials\\.yml\\.enc|secrets\\.yml|vault\\.yml|\\.vault-pass|\\.vault-token)$"
+  match_on: file_path
+  title: "Access secrets or vault file"
+  expires_at: null
+  revoked: false
+
+# --- Private keys and certificates ---
+# NOTE: .pem also matches public cert chains (fullchain.pem, ca-bundle.pem).
+# Accepted trade-off: require_approval keeps noise bounded, and excluding .pem
+# would miss private key exfiltration.
+- id: "CLT-FILE-016"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(pem|p12|pfx|p8)$"
+  match_on: file_path
+  title: "Access private key or certificate file"
+  expires_at: null
+  revoked: false
+
+# --- Kubeconfig ---
+- id: "CLT-FILE-017"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.kube/config|kubeconfig(\\.yaml|\\.yml)?)$"
+  match_on: file_path
+  title: "Access Kubernetes configuration file"
+  expires_at: null
+  revoked: false
+
+# --- Build system credential files ---
+- id: "CLT-FILE-018"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.m2/settings\\.xml|gradle\\.properties)$"
+  match_on: file_path
+  title: "Access build system credential file"
+  expires_at: null
+  revoked: false
+
+# --- Shell/REPL history files ---
+- id: "CLT-FILE-019"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(bash_history|zsh_history|mysql_history|python_history|node_repl_history|psql_history|irb_history)$"
+  match_on: file_path
+  title: "Access shell or REPL history file"
+  expires_at: null
+  revoked: false
+
+# --- JetBrains IDE database credentials ---
+- id: "CLT-FILE-020"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.idea/dataSources(\\.xml|/)"
+  match_on: file_path
+  title: "Access JetBrains IDE database credential file"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-commands.yaml

@@ -0,0 +1,355 @@
+# macOS command threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Covers: osascript RCE, macOS LOLBins, destructive ops, defense evasion, privesc, reverse shells
+
+# --- osascript Remote Code Execution ---
+
+# osascript -e 'do shell script' (AppleScript shell execution)
+- id: "CLT-MAC-CMD-001"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bosascript\\b.*-e.*do shell script"
+  case_insensitive: true
+  match_on: command
+  title: "AppleScript shell execution via osascript -e"
+  expires_at: null
+  revoked: false
+
+# osascript -l JavaScript (JXA execution)
+- id: "CLT-MAC-CMD-002"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bosascript\\b.*-l\\s+JavaScript"
+  case_insensitive: true
+  match_on: command
+  title: "JavaScript for Automation (JXA) execution via osascript"
+  expires_at: null
+  revoked: false
+
+# Pipe to osascript (stdin AppleScript execution)
+- id: "CLT-MAC-CMD-003"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\|\\s*osascript"
+  match_on: command
+  title: "Piped input to osascript (stdin AppleScript execution)"
+  expires_at: null
+  revoked: false
+
+# osascript loading script file from remote download
+- id: "CLT-MAC-CMD-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "(curl|wget).*\\|.*osascript|osascript.*(curl|wget)"
+  case_insensitive: true
+  match_on: command
+  title: "Remote script download piped to osascript"
+  expires_at: null
+  revoked: false
+
+# --- open command abuse ---
+
+# open -a Terminal (launch Terminal with script)
+- id: "CLT-MAC-CMD-005"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bopen\\s+-a\\s+Terminal"
+  match_on: command
+  title: "Launch Terminal application via open -a"
+  expires_at: null
+  revoked: false
+
+# open with hidden/background flags
+- id: "CLT-MAC-CMD-006"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bopen\\s+(-[jg]|--hide|--background)"
+  match_on: command
+  title: "Launch application hidden/background via open"
+  expires_at: null
+  revoked: false
+
+# --- macOS LOLBins ---
+
+# dscl user/group manipulation
+- id: "CLT-MAC-CMD-007"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bdscl\\b.*(-create|-delete|-passwd|-append)"
+  match_on: command
+  title: "Directory Services user/group manipulation via dscl"
+  expires_at: null
+  revoked: false
+
+# networksetup proxy/DNS manipulation
+- id: "CLT-MAC-CMD-008"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bnetworksetup\\b.*(-setwebproxy|-setsocksfirewallproxy|-setdnsservers|-setautoproxyurl)"
+  case_insensitive: true
+  match_on: command
+  title: "Network proxy/DNS manipulation via networksetup"
+  expires_at: null
+  revoked: false
+
+# systemsetup enabling remote access
+- id: "CLT-MAC-CMD-009"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsystemsetup\\b.*(-setremotelogin\\s+on|-setwakeonnetworkaccess\\s+on)"
+  case_insensitive: true
+  match_on: command
+  title: "Enable remote login/wake via systemsetup"
+  expires_at: null
+  revoked: false
+
+# kickstart ARD remote management
+- id: "CLT-MAC-CMD-010"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "kickstart.*-activate.*-configure"
+  case_insensitive: true
+  match_on: command
+  title: "Apple Remote Desktop activation via kickstart"
+  expires_at: null
+  revoked: false
+
+# installer -pkg -target / (silent package install)
+- id: "CLT-MAC-CMD-011"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\binstaller\\b.*-pkg.*-target"
+  case_insensitive: true
+  match_on: command
+  title: "Silent package install via installer command"
+  expires_at: null
+  revoked: false
+
+# hdiutil mount remote DMG
+- id: "CLT-MAC-CMD-012"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bhdiutil\\b.*\\b(attach|mount)\\b.*https?://"
+  case_insensitive: true
+  match_on: command
+  title: "Mount remote DMG via hdiutil"
+  expires_at: null
+  revoked: false
+
+# pkgutil --forget (package receipt manipulation)
+- id: "CLT-MAC-CMD-013"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bpkgutil\\b.*--forget"
+  match_on: command
+  title: "Package receipt removal via pkgutil --forget"
+  expires_at: null
+  revoked: false
+
+# --- Destructive Operations ---
+
+# diskutil eraseDisk
+- id: "CLT-MAC-CMD-014"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bdiskutil\\b.*\\b(eraseDisk|partitionDisk|secureErase)\\b"
+  match_on: command
+  title: "Disk erase/partition via diskutil"
+  expires_at: null
+  revoked: false
+
+# tmutil delete (Time Machine backup deletion — ransomware indicator)
+- id: "CLT-MAC-CMD-015"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\btmutil\\b.*\\b(delete|disable)\\b"
+  match_on: command
+  title: "Time Machine backup deletion/disable via tmutil (ransomware indicator)"
+  expires_at: null
+  revoked: false
+
+# --- Defense Evasion ---
+
+# spctl --master-disable (Gatekeeper disable)
+- id: "CLT-MAC-CMD-016"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bspctl\\b.*--master-disable"
+  match_on: command
+  title: "Gatekeeper disable via spctl --master-disable"
+  expires_at: null
+  revoked: false
+
+# csrutil disable (SIP disable)
+- id: "CLT-MAC-CMD-017"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bcsrutil\\b.*\\bdisable\\b"
+  match_on: command
+  title: "System Integrity Protection disable via csrutil"
+  expires_at: null
+  revoked: false
+
+# defaults write LSQuarantine (quarantine flag disable)
+- id: "CLT-MAC-CMD-018"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdefaults\\b.*\\bwrite\\b.*LSQuarantine"
+  case_insensitive: true
+  match_on: command
+  title: "Quarantine flag disable via defaults write LSQuarantine"
+  expires_at: null
+  revoked: false
+
+# xattr -d com.apple.quarantine (quarantine removal)
+- id: "CLT-MAC-CMD-019"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bxattr\\b.*-d.*com\\.apple\\.quarantine"
+  match_on: command
+  title: "Quarantine attribute removal via xattr"
+  expires_at: null
+  revoked: false
+
+# pfctl -d (packet filter / firewall disable)
+- id: "CLT-MAC-CMD-020"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bpfctl\\b.*\\s-d\\b"
+  match_on: command
+  title: "Packet filter (firewall) disable via pfctl -d"
+  expires_at: null
+  revoked: false
+
+# tccutil reset (TCC privacy permissions reset)
+- id: "CLT-MAC-CMD-021"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\btccutil\\b.*\\breset\\b"
+  match_on: command
+  title: "TCC privacy permissions reset via tccutil"
+  expires_at: null
+  revoked: false
+
+# launchctl unload security daemons
+- id: "CLT-MAC-CMD-022"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\blaunchctl\\b.*\\b(unload|bootout)\\b.*(com\\.apple\\.MRT|com\\.apple\\.XProtect|com\\.apple\\.security)"
+  case_insensitive: true
+  match_on: command
+  title: "Unload macOS security daemon via launchctl"
+  expires_at: null
+  revoked: false
+
+# defaults write to disable macOS security features
+- id: "CLT-MAC-CMD-023"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdefaults\\b.*\\bwrite\\b.*(com\\.apple\\.Finder\\s+AppleShowAllFiles|com\\.apple\\.LaunchServices\\s+LSQuarantine|com\\.apple\\.loginwindow)"
+  case_insensitive: true
+  match_on: command
+  title: "Modify macOS security-related defaults"
+  expires_at: null
+  revoked: false
+
+# --- Privilege Escalation ---
+
+# dscl . -passwd (change user password)
+- id: "CLT-MAC-CMD-024"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdscl\\b.*\\s-passwd\\b"
+  match_on: command
+  title: "User password change via dscl"
+  expires_at: null
+  revoked: false
+
+# dseditgroup add user to admin
+- id: "CLT-MAC-CMD-025"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bdseditgroup\\b.*-o\\s+edit.*-a.*admin"
+  match_on: command
+  title: "Add user to admin group via dseditgroup"
+  expires_at: null
+  revoked: false
+
+# createhomedir — create home directory for arbitrary user
+- id: "CLT-MAC-CMD-026"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bcreatehomedir\\b"
+  match_on: command
+  title: "Create home directory for user via createhomedir"
+  expires_at: null
+  revoked: false
+
+# Reverse shells (Python, Ruby, zsh) moved to commands.yaml (CLT-CMD-023..025)
+
+# --- Clipboard / Screen Capture ---
+
+# screencapture to remote or hidden location
+- id: "CLT-MAC-CMD-027"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bscreencapture\\b.*(-x|-C)"
+  match_on: command
+  title: "Silent screen capture via screencapture"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-credentials.yaml

@@ -0,0 +1,99 @@
+# macOS credential exposure threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# Keychain password extraction (find-generic-password)
+- id: "CLT-MAC-CRED-001"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bfind-generic-password\\b.*-w"
+  match_on: command
+  title: "Keychain password extraction via security find-generic-password"
+  expires_at: null
+  revoked: false
+
+# Keychain internet password extraction
+- id: "CLT-MAC-CRED-002"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bfind-internet-password\\b.*-w"
+  match_on: command
+  title: "Keychain internet password extraction via security find-internet-password"
+  expires_at: null
+  revoked: false
+
+# Keychain dump
+- id: "CLT-MAC-CRED-003"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bdump-keychain\\b"
+  match_on: command
+  title: "Full keychain dump via security dump-keychain"
+  expires_at: null
+  revoked: false
+
+# Keychain unlock with plaintext password
+- id: "CLT-MAC-CRED-004"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsecurity\\b.*\\bunlock-keychain\\b.*-p"
+  match_on: command
+  title: "Keychain unlock with plaintext password"
+  expires_at: null
+  revoked: false
+
+# Keychain export
+- id: "CLT-MAC-CRED-005"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bsecurity\\b.*\\bexport\\b.*-k"
+  match_on: command
+  title: "Keychain item export via security export"
+  expires_at: null
+  revoked: false
+
+# Keychain deletion
+- id: "CLT-MAC-CRED-006"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsecurity\\b.*\\bdelete-keychain\\b"
+  match_on: command
+  title: "Keychain deletion via security delete-keychain"
+  expires_at: null
+  revoked: false
+
+# Directory Services auth data read
+- id: "CLT-MAC-CRED-007"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bdscl\\b.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
+  match_on: command
+  title: "Read user authentication data via dscl"
+  expires_at: null
+  revoked: false
+
+# Direct Keychain SQLite access
+- id: "CLT-MAC-CRED-008"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsqlite3\\b.*(/Library/Keychains/|login\\.keychain)"
+  match_on: command
+  title: "Direct Keychain database access via sqlite3"
+  expires_at: null
+  revoked: false