@gendigital/sage-opencode 0.9.0

package/resources/threats/mac-files.yaml

@@ -0,0 +1,124 @@
+# macOS sensitive file path threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Detects Read/Write/Edit/Delete operations targeting macOS security-sensitive files
+
+# LaunchAgent/LaunchDaemon plist (migrated from files.yaml CLT-FILE-005)
+- id: "CLT-MAC-FILE-001"
+  category: tool
+  severity: high
+  confidence: 0.90
+  action: block
+  pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist$"
+  match_on: file_path
+  title: "Access macOS LaunchAgent/LaunchDaemon plist"
+  expires_at: null
+  revoked: false
+
+# TCC privacy permissions database
+- id: "CLT-MAC-FILE-002"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "com\\.apple\\.TCC/TCC\\.db"
+  match_on: file_path
+  title: "Access TCC privacy permissions database"
+  expires_at: null
+  revoked: false
+
+# Authorization database
+- id: "CLT-MAC-FILE-003"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "(/etc/authorization|/var/db/auth\\.db)"
+  match_on: file_path
+  title: "Access macOS authorization database"
+  expires_at: null
+  revoked: false
+
+# Kernel extensions
+- id: "CLT-MAC-FILE-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "(/Library/Extensions/|/System/Library/Extensions/).*\\.kext"
+  match_on: file_path
+  title: "Access kernel extension (.kext)"
+  expires_at: null
+  revoked: false
+
+# Security Agent Plugins
+- id: "CLT-MAC-FILE-005"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/Library/Security/SecurityAgentPlugins/"
+  match_on: file_path
+  title: "Access SecurityAgentPlugins directory"
+  expires_at: null
+  revoked: false
+
+# Periodic scripts directory
+- id: "CLT-MAC-FILE-006"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "/etc/periodic/(daily|weekly|monthly)/"
+  match_on: file_path
+  title: "Access macOS periodic scripts directory"
+  expires_at: null
+  revoked: false
+
+# Emond rules directory
+- id: "CLT-MAC-FILE-007"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/etc/emond\\.d/rules/"
+  match_on: file_path
+  title: "Access Event Monitor daemon rules directory"
+  expires_at: null
+  revoked: false
+
+# Safari credential/cookie stores
+- id: "CLT-MAC-FILE-008"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/Safari/(Cookies\\.binarycookies|LastSession\\.plist|Databases|LocalStorage)"
+  match_on: file_path
+  title: "Access Safari credential/cookie store"
+  expires_at: null
+  revoked: false
+
+# Managed Preferences (MDM profiles)
+- id: "CLT-MAC-FILE-009"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "/Library/Managed Preferences/"
+  match_on: file_path
+  title: "Access Managed Preferences (MDM profile injection)"
+  expires_at: null
+  revoked: false
+
+# Keychain files
+- id: "CLT-MAC-FILE-010"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/Library/Keychains/.*\\.keychain"
+  match_on: file_path
+  title: "Access system Keychain file"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-obfuscation.yaml

@@ -0,0 +1,92 @@
+# macOS obfuscation threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# osascript 'do shell script' wrapping (shell via AppleScript)
+- id: "CLT-MAC-OBFUS-001"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bosascript\\b.*do shell script"
+  case_insensitive: true
+  match_on: command
+  title: "Shell command obfuscated via AppleScript do shell script"
+  expires_at: null
+  revoked: false
+
+# JXA (JavaScript for Automation) execution
+- id: "CLT-MAC-OBFUS-002"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
+  case_insensitive: true
+  match_on: command
+  title: "JXA inline execution (JavaScript for Automation obfuscation)"
+  expires_at: null
+  revoked: false
+
+# Base64 decode piped to osascript
+- id: "CLT-MAC-OBFUS-003"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
+  match_on: command
+  title: "Base64 decode piped to osascript (encoded payload execution)"
+  expires_at: null
+  revoked: false
+
+# DYLD_INSERT_LIBRARIES injection
+- id: "CLT-MAC-OBFUS-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "DYLD_INSERT_LIBRARIES=.*\\.(dylib|so)"
+  match_on: command
+  title: "Dynamic library injection via DYLD_INSERT_LIBRARIES"
+  expires_at: null
+  revoked: false
+
+# Quarantine attribute removal (evasion)
+- id: "CLT-MAC-OBFUS-005"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
+  match_on: command
+  title: "Quarantine attribute removal (Gatekeeper evasion)"
+  expires_at: null
+  revoked: false
+
+# Python encoded payload moved to obfuscation.yaml (CLT-OBFUS-008)
+
+# plutil plist manipulation (payload hiding)
+- id: "CLT-MAC-OBFUS-006"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
+  match_on: command
+  title: "Plist conversion to binary (payload obfuscation)"
+  expires_at: null
+  revoked: false
+
+# Swift/swiftc inline execution
+- id: "CLT-MAC-OBFUS-007"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
+  case_insensitive: true
+  match_on: command
+  title: "Swift inline execution with system calls"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-persistence.yaml

@@ -0,0 +1,117 @@
+# macOS persistence mechanism threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Covers: LaunchAgents, Login Items, Authorization plugins, periodic scripts, emond, dylib hijack
+
+# LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
+- id: "CLT-MAC-PERSIST-001"
+  category: tool
+  severity: high
+  confidence: 0.90
+  action: block
+  pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist"
+  match_on: command
+  title: "macOS LaunchAgent/LaunchDaemon persistence"
+  expires_at: null
+  revoked: false
+
+# Login Items via osascript
+- id: "CLT-MAC-PERSIST-002"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bosascript\\b.*login item"
+  case_insensitive: true
+  match_on: command
+  title: "Add login item via osascript"
+  expires_at: null
+  revoked: false
+
+# Login window manipulation via defaults
+- id: "CLT-MAC-PERSIST-003"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
+  case_insensitive: true
+  match_on: command
+  title: "Login window hook manipulation via defaults write"
+  expires_at: null
+  revoked: false
+
+# Authorization plugin persistence
+- id: "CLT-MAC-PERSIST-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/Library/Security/SecurityAgentPlugins/"
+  match_on: command
+  title: "Authorization plugin drop in SecurityAgentPlugins"
+  expires_at: null
+  revoked: false
+
+# Periodic script drop
+- id: "CLT-MAC-PERSIST-005"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "/etc/periodic/(daily|weekly|monthly)/"
+  match_on: command
+  title: "Periodic script persistence drop"
+  expires_at: null
+  revoked: false
+
+# at job scheduling moved to persistence.yaml (CLT-PERSIST-008)
+
+# emond rules
+- id: "CLT-MAC-PERSIST-006"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "/etc/emond\\.d/rules/"
+  match_on: command
+  title: "Event Monitor daemon rules persistence"
+  expires_at: null
+  revoked: false
+
+# DYLD_INSERT_LIBRARIES in RC files
+- id: "CLT-MAC-PERSIST-007"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "DYLD_INSERT_LIBRARIES"
+  match_on: command
+  title: "DYLD_INSERT_LIBRARIES dylib injection (persistence/hijack)"
+  expires_at: null
+  revoked: false
+
+# Folder Actions via osascript
+- id: "CLT-MAC-PERSIST-008"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bosascript\\b.*folder action"
+  case_insensitive: true
+  match_on: command
+  title: "Folder Action script persistence via osascript"
+  expires_at: null
+  revoked: false
+
+# launchctl load/bootstrap persistent agent
+- id: "CLT-MAC-PERSIST-009"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
+  match_on: command
+  title: "Load persistent launch agent/daemon via launchctl"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-supply-chain.yaml

@@ -0,0 +1,40 @@
+# macOS supply chain threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# brew install without version pin
+- id: "CLT-MAC-SUPPLY-001"
+  category: supply_chain
+  severity: medium
+  confidence: 0.65
+  action: require_approval
+  pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
+  match_on: command
+  title: "Homebrew install without version pin"
+  expires_at: null
+  revoked: false
+
+# installer -pkg from remote URL
+- id: "CLT-MAC-SUPPLY-002"
+  category: supply_chain
+  severity: high
+  confidence: 0.85
+  action: block
+  pattern: "\\binstaller\\b.*-pkg.*https?://"
+  case_insensitive: true
+  match_on: command
+  title: "Remote package install via installer -pkg (unsigned)"
+  expires_at: null
+  revoked: false
+
+# brew install --cask from non-default tap
+- id: "CLT-MAC-SUPPLY-003"
+  category: supply_chain
+  severity: medium
+  confidence: 0.65
+  action: require_approval
+  pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
+  match_on: command
+  title: "Homebrew cask install (binary application)"
+  expires_at: null
+  revoked: false