Recipes

{
  "id": "C2-WEBHOOK-SITE",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])webhook\\.site(?:[^a-zA-Z0-9.-]|$)",
  "title": "webhook.site (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-NGROK",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])(?:ngrok\\.io|ngrok-free\\.app)(?:[^a-zA-Z0-9.-]|$)",
  "title": "ngrok tunnel (exfil risk)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PIPEDREAM",
  "pattern": "(?i)pipedream\\.net",
  "title": "Pipedream (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-REQUESTBIN",
  "pattern": "(?i)requestbin\\.com",
  "title": "RequestBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-HOOKBIN",
  "pattern": "(?i)hookbin\\.com",
  "title": "HookBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-BURP",
  "pattern": "(?i)burpcollaborator\\.net",
  "title": "Burp Collaborator (pentest C2)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-INTERACTSH",
  "pattern": "(?i)interact\\.sh",
  "title": "interact.sh (OOB exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-OAST",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])oast\\.fun(?:[^a-zA-Z0-9.-]|$)",
  "title": "oast.fun (OOB testing)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-CANARY",
  "pattern": "(?i)canarytokens\\.com",
  "title": "Canary Tokens",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PASTEBIN",
  "pattern": "(?i)pastebin\\.com/raw/",
  "title": "Pastebin raw fetch",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-METADATA-AWS",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_DOWNLOAD, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT]))",
  "pattern": "169\\.254\\.169\\.254",
  "title": "AWS metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-GCP",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])metadata\\.google\\.internal(?:[^a-zA-Z0-9.-]|$)",
  "title": "GCP metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-AZURE",
  "pattern": "169\\.254\\.169\\.254/metadata",
  "title": "Azure metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-HEX",
  "pattern": "(?i)0xa9fea9fe",
  "title": "AWS metadata endpoint (hex-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-DECIMAL",
  "pattern": "(?:^|[/])2852039166(?:$|[/])",
  "title": "AWS metadata endpoint (decimal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-OCTAL",
  "pattern": "0251\\.0376\\.0251\\.0376",
  "title": "AWS metadata endpoint (octal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-DNS-TUNNEL",
  "pattern": "(?i)\\b(?:dig|host|nslookup|drill)\\b\\s+[^;\\n]*\\$\\((?:whoami|hostname|id(?:\\s+-u)?|cat\\s+(?:/etc/hostname|/etc/machine-id))\\)[A-Za-z0-9._-]*\\.[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+",
  "title": "DNS TXT query with high-entropy label (tunneling indicator)",
  "severity": "HIGH",
  "confidence": 0.78,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "C2-DNS-EXFIL",
  "pattern": "(?i)\\bnslookup\\b\\s+[a-f0-9]{8,}\\.\\w+\\.",
  "title": "nslookup with hex subdomain (DNS exfil)",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "COG-SOUL",
  "pattern": "(?i)SOUL\\.md",
  "title": "SOUL.md access (agent identity)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-IDENTITY",
  "pattern": "(?i)IDENTITY\\.md",
  "title": "IDENTITY.md access",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-MEMORY",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)MEMORY\\.md",
  "title": "MEMORY.md mutation or reference",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-CLAUDE-MD",
  "pattern": "(?i)CLAUDE\\.md",
  "title": "CLAUDE.md access",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-TOOLS-MD",
  "pattern": "(?i)TOOLS\\.md",
  "title": "TOOLS.md access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-AGENTS-MD",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)AGENTS\\.md",
  "title": "AGENTS.md mutation or reference",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-OPENCLAW-JSON",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)openclaw\\.json",
  "title": "openclaw.json config access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-GATEWAY-JSON",
  "pattern": "(?i)gateway\\.json",
  "title": "gateway.json config access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "tamper.detector_state_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\]\\.defenseclaw[/\\\\](?:\\.env|config\\.yaml|confidence_policy\\.yaml|guardrail_runtime\\.json|device\\.key|picked_connector|custom-providers\\.json|(?:audit|judge|judge_bodies)\\.db(?:-(?:wal|shm))?|(?:cache|policies|quarantine|receipts|registries)[/\\\\][^;\\s]+)\\b",
  "title": "DefenseClaw security state mutation",
  "severity": "HIGH",
  "confidence": 0.98,
  "tags": [
    "cognitive-tampering",
    "tampering",
    "security-state"
  ]
}

{
  "id": "CMD-REVSHELL-BASH",
  "expression": "f.commands.exists(c, c.program in ['nc', 'nc.exe', 'ncat', 'ncat.exe', 'netcat', 'socat'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_LISTEN in c.operations) && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_EXECUTE) && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_LISTEN] && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)bash\\s+-i\\s+>&\\s*/dev/tcp/",
  "title": "Bash reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-DEVTCP",
  "pattern": "/dev/tcp/(?:\\d{1,3}\\.\\d{1,3}|[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+)/\\d+\\b",
  "title": "Reverse shell via /dev/tcp",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-NC",
  "pattern": "(?i)\\b(?:nc|ncat|netcat)\\b\\s+(?:(?:-[a-zA-Z]*\\s+)*\\S+\\s+\\d+\\s*(?:-e|--exec)\\b|(?:-[a-zA-Z]*\\s+)*(?:-e|--exec)\\s+\\S+\\s+\\S+\\s+\\d+\\b)",
  "title": "Netcat reverse shell with -e",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-PYTHON",
  "pattern": "(?is)\\bpython[23]?\\s+-c\\s+.{0,800}?\\bsocket\\s*\\.\\s*socket\\s*\\(\\s*(?:(?:socket\\s*\\.\\s*)?AF_INET6?(?:\\s*,[^)]{0,160})?)?\\s*\\).{0,800}?\\.\\s*connect\\s*\\(\\s*\\(\\s*[\"'](?:(?:\\d{1,3}\\.){3}\\d{1,3}|[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+)[\"']\\s*,\\s*\\d{1,5}\\s*\\)\\s*\\).{0,800}?(?:os\\s*\\.\\s*dup2\\s*\\(|(?:sys\\s*\\.\\s*)?(?:stdin|stdout|stderr)\\s*=.{0,120}?(?:makefile|fdopen|reopen)).{0,800}?(?:pty\\s*\\.\\s*spawn|subprocess\\s*\\.\\s*(?:Popen|call|run)|os\\s*\\.\\s*(?:system|exec[a-z]*))\\s*\\(",
  "title": "Python reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-PIPE-CURL",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['curl', 'curl.exe', 'invoke-webrequest', 'iwr', 'invoke-restmethod', 'irm'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)(?:\\bcurl\\b\\s+[^|;\\r\\n]*\\|\\s*(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby)\\b|\\b(?:invoke-webrequest|iwr|invoke-restmethod|irm)\\b[^|;\\r\\n]*\\|\\s*(?:invoke-expression|iex)\\b)",
  "title": "curl piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-WGET",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['wget', 'wget.exe'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)\\bwget\\b\\s+[^|]*\\|\\s*(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby)\\b",
  "title": "wget piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-BASE64",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['base64', 'base64.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DECODE in c.operations)",
  "pattern": "(?i:\\bbase64\\b)[^|;\\n]*\\s(?:-d+i?|--decode)\\b[^|;\\n]*\\|\\s*(?i:(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby))\\b",
  "title": "base64 decode piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "obfuscation"
  ]
}

{
  "id": "CMD-REMOTE-PAYLOAD-EXEC-CLEANUP",
  "pattern": "(?is)\\b(?:curl|wget)\\b[^;\\r\\n]*https?://(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?/[^\\s;]+(?:;|\\s{2,})[^\\r\\n]*?\\bchmod\\s+(?:\\+x|[0-7]*7[0-7]*)\\s+\\S+(?:;|\\s{2,})[^\\r\\n]*?(?:\\./|(?:ba)?sh\\s+)\\S+(?:[ \\t][^;\\r\\n \\t]+)*(?:;|[ \\t]{2,})[^\\r\\n]*?(?:rm\\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\\s+(?:\\*|[A-Za-z0-9_.-]+\\*)|history\\s+-c)",
  "title": "Remote payload execution with anti-forensic cleanup",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "download-exec",
    "destructive"
  ]
}

{
  "id": "exec.remote_ip_download_execute_same_artifact",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['curl', 'wget'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations)",
  "pattern": "(?is)\\b(?:curl|wget)\\b[^\\r\\n]{0,900}?https?://(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?/[^\\s;|&]+[\\s\\S]{0,700}?(?:(?:bash|sh)\\s+)?/(?:tmp|var/tmp|dev/shm)/[^\\s;|&]+",
  "title": "Literal public-IP download executed from the same path",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "download-exec",
    "bounded-lineage"
  ]
}

{
  "id": "CMD-EVAL",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)eval\\s+[\"'\\$\\(]",
  "title": "Shell eval with dynamic input",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-RM-RF",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE))",
  "pattern": "(?i)\\brm\\s+(?:-[a-zA-Z]*\\s+)*(?:-[a-zA-Z]*)?(?:r[a-zA-Z]*f|f[a-zA-Z]*r)\\b(?:\\s+\\S+)*\\s+/(?:$|[\"'\\s,}\\]]|(?:etc|bin|sbin|usr|var|home|root|opt|boot|lib(?:64)?|srv|mnt|dev|proc|sys)/?(?:$|[\"'\\s,}\\]]))",
  "title": "Recursive force delete from critical root path",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-MKFS",
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['mkfs', 'mkfs.ext2', 'mkfs.ext3', 'mkfs.ext4', 'mke2fs', 'mkfs.xfs', 'mkfs.btrfs', 'mkfs.f2fs', 'mkfs.vfat', 'mkdosfs', 'mkfs.ntfs', 'mkntfs', 'mkfs.minix', 'mkswap', 'mkfs.exfat', 'mkexfatfs'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:sudo\\s+)?(?:mkfs(?:\\.(?:ext2|ext3|ext4|xfs|btrfs|f2fs|vfat|ntfs|exfat|minix))?|mke2fs|mkdosfs|mkntfs|mkswap|mkexfatfs)(?:\\s|$)",
  "title": "Filesystem format command",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-DEVICE-WIPE",
  "expression": "f.commands.exists(c, c.argv_complete && c.program != 'dd' && !(c.program in ['mkfs', 'mkfs.ext2', 'mkfs.ext3', 'mkfs.ext4', 'mke2fs', 'mkfs.xfs', 'mkfs.btrfs', 'mkfs.f2fs', 'mkfs.vfat', 'mkdosfs', 'mkfs.ntfs', 'mkntfs', 'mkfs.minix', 'mkswap', 'mkfs.exfat', 'mkexfatfs']) && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "a^",
  "title": "Destructive write to a disk device",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-DD-IF",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'dd' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "(?i)\\bdd\\s+if=",
  "title": "dd disk write",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-CHMOD-WORLD",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_METADATA))",
  "pattern": "(?i)\\bchmod\\s+[0-7]*[0-7][0-7][2367]\\s",
  "title": "chmod world-writable",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-CHOWN-ROOT",
  "pattern": "a^",
  "title": "chown to root",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-SUDO",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'sudo' && ('-l' in c.argv || '--list' in c.argv || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations))",
  "pattern": "(?i)\\bsudo\\s+",
  "title": "sudo invocation",
  "severity": "LOW",
  "confidence": 0.5,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-ETC-WRITE",
  "pattern": "(?i)>\\s*/etc/",
  "title": "Write redirect to /etc/",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "CMD-CRONTAB",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'crontab' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_SCHEDULE in c.operations)",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:sudo\\s+)?crontab(?:\\s+-u\\s+\\S+)?\\s+(?:-e|-r|-)(?:\\s|$)",
  "title": "Crontab modification",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-WIN-REG-PERSIST",
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'sp', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b",
  "title": "Windows registry persistence modification",
  "severity": "CRITICAL",
  "confidence": 0.97,
  "tags": [
    "persistence",
    "windows"
  ]
}

{
  "id": "credential.windows_registry_hive_dump",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_REGISTRY && p.normalized in ['HKLM/SAM', 'HKLM/sam']) && f.paths.exists(p, p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_REGISTRY && p.normalized in ['HKLM/SYSTEM', 'HKLM/system'])",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SAM\\b[\\s\\S]{0,600}\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SYSTEM\\b|\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SYSTEM\\b[\\s\\S]{0,600}\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SAM\\b)",
  "title": "Bounded SAM and SYSTEM registry hive dump",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "credential.windows_lsass_memory_dump",
  "tool_call_only": true,
  "pattern": "(?is)(?:\\bprocdump(?:\\.exe)?\\b.{0,240}?(?:-ma|-mm)\\s+lsass(?:\\.exe)?\\s+\\S+\\.dmp\\b|\\bget-process\\s+lsass(?:\\.exe)?\\s*\\|\\s*out-minidump\\b|\\brundll32(?:\\.exe)?\\b[^\\r\\n]{0,260}\\bcomsvcs\\.dll\\s*,?\\s+minidump\\s+\\(\\s*get-process\\s+lsass(?:\\.exe)?\\s*\\)\\.id\\s+\\S{1,260}\\s+full\\b)",
  "title": "Dump Windows LSASS credential memory",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "windows",
    "credential-dumping"
  ]
}

{
  "id": "impact.windows_delete_all_shadow_copies",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['vssadmin', 'vssadmin.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\bvssadmin(?:\\.exe)?\\s+delete\\s+shadows\\s+(?:/all\\s+/quiet|/quiet\\s+/all)(?:\\s|$)",
  "title": "Delete all Windows Volume Shadow Copies",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition"
  ]
}

{
  "id": "tamper.windows_usn_journal_delete",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['fsutil', 'fsutil.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\bfsutil(?:\\.exe)?\\s+usn\\s+deletejournal\\s+/d\\s+[a-z]:(?:\\s|$)",
  "title": "Delete a Windows NTFS USN change journal",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "logs"
  ]
}

{
  "id": "impact.windows_recovery_disable_pair",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['bcdedit', 'bcdedit.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+bootstatuspolicy\\s+ignoreallfailures\\b[\\s\\S]{0,500}\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+recoveryenabled\\s+no\\b|\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+recoveryenabled\\s+no\\b[\\s\\S]{0,500}\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+bootstatuspolicy\\s+ignoreallfailures\\b)",
  "title": "Disable Windows boot recovery and failure handling",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.windows_audit_policy_wipe",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditpol', 'auditpol.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bauditpol(?:\\.exe)?\\s+/clear\\s+/y\\b[\\s\\S]{0,400}\\bauditpol(?:\\.exe)?\\s+/remove\\s+/allusers\\b|\\bauditpol(?:\\.exe)?\\s+/remove\\s+/allusers\\b[\\s\\S]{0,400}\\bauditpol(?:\\.exe)?\\s+/clear\\s+/y\\b)",
  "title": "Clear Windows audit policy and all-user policy",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "impact.windows_recovery_store_destruction",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['wbadmin', 'wbadmin.exe', 'wmic', 'wmic.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:\\bwbadmin(?:\\.exe)?\\s+delete\\s+(?:systemstatebackup\\s+-keepversions:0|catalog\\s+-quiet)(?:\\s|$)|\\bwmic(?:\\.exe)?\\s+shadowcopy\\s+delete(?:\\s|$))",
  "title": "Destroy Windows recovery stores",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition"
  ]
}

{
  "id": "tamper.windows_defender_multi_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'set-mppreference' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\bSet-MpPreference\\b[^\\r\\n]*(?:-DisableRealtimeMonitoring|-drtm|-DisableBehaviorMonitoring|-dbm|-DisableScriptScanning|-dscrptsc|-DisableBlockAtFirstSeen|-dbaf)\\s+(?:1|true|\\$true)\\b",
  "title": "Disable multiple Windows Defender controls",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.windows_defender_component_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['mpcmdrun', 'mpcmdrun.exe', 'dism', 'dism.exe', 'disable-windowsoptionalfeature', 'remove-windowsfeature', 'uninstall-windowsfeature', 'schtasks', 'schtasks.exe', 'add-dnsclientnrptrule'])",
  "pattern": "(?i)(?:\\bmpcmdrun(?:\\.exe)?\\b[^\\r\\n]*-RemoveDefinitions[^\\r\\n]*-All\\b|\\bdism(?:\\.exe)?\\b[^\\r\\n]*/Disable-Feature[^\\r\\n]*/FeatureName:Windows-Defender\\b|\\b(?:Disable-WindowsOptionalFeature|Remove-WindowsFeature|Uninstall-WindowsFeature)\\b[^\\r\\n]*Windows-Defender\\b|\\bschtasks(?:\\.exe)?\\b[^\\r\\n]*/delete[^\\r\\n]*Windows Defender[^\\r\\n]*/f\\b|\\bAdd-DnsClientNrptRule\\b[^\\r\\n]*endpoint\\.security\\.microsoft\\.com[^\\r\\n]*127\\.0\\.0\\.1\\b)",
  "title": "Disable an exact Windows Defender component",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "endpoint-security"
  ]
}

{
  "id": "tamper.windows_registry_security_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:windows defender|windowsfirewall|firewallpolicy|enablelua|consentpromptbehavioradmin|promptonsecuredesktop|hypervisorenforcedcodeintegrity|allowencryptionoracle|rdp-tcp)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:windows defender|windowsfirewall|enablelua|consentpromptbehavioradmin|promptonsecuredesktop))",
  "title": "Disable Windows security controls through the registry",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "registry",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.windows_uac_autoelevation_hijack",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty', 'new-item']) && f.commands.exists(c, c.argv_complete && c.program == 'start-process')",
  "pattern": "(?is)(?:\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b[^\\r\\n]{0,900}(?:mscfile|ms-settings|folder)[/\\\\]shell[/\\\\]open[/\\\\]command[\\s\\S]{0,900}\\b(?:eventvwr(?:\\.msc)?|fodhelper|sdclt)(?:\\.exe)?\\b)",
  "title": "Hijack a Windows UAC auto-elevation handler",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "defense-evasion",
    "windows",
    "registry",
    "bounded-lineage"
  ]
}

{
  "id": "persistence.windows_accessibility_feature_hijack",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && ((c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations) || (c.program in ['copy', 'copy.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_COPY in c.operations)))",
  "pattern": "(?i)(?:\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b[^\\r\\n]*image file execution options[/\\\\](?:osk|sethc|utilman|magnify|narrator|displayswitch|atbroker)\\.exe[^\\r\\n]*\\bDebugger\\b[^\\r\\n]*windows[/\\\\]system32[/\\\\]cmd\\.exe\\b|\\bcopy(?:\\.exe)?\\s+(?:/Y\\s+)?[A-Z]:\\\\Windows\\\\System32\\\\cmd\\.exe\\s+[A-Z]:\\\\Windows\\\\System32\\\\(?:osk|sethc|utilman|magnify|narrator|displayswitch|atbroker)\\.exe\\b)",
  "title": "Hijack a Windows accessibility feature for SYSTEM command access",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "privilege",
    "windows",
    "registry"
  ]
}

{
  "id": "tamper.windows_telemetry_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:COMPlus_ETWEnabled|ETWEnabled|Microsoft-Windows-Windows Defender[/\\\\]Operational|Autologger[/\\\\]EventLog-Application)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:COMPlus_ETWEnabled|ETWEnabled|Microsoft-Windows-Windows Defender[/\\\\]Operational|Autologger[/\\\\]EventLog-Application))",
  "title": "Disable exact Windows ETW or event telemetry controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "telemetry",
    "registry"
  ]
}

{
  "id": "tamper.windows_credential_protection_weaken",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:UseLogonCredential|RunAsPPL|AutoAdminLogon|DefaultPassword)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:UseLogonCredential|RunAsPPL|AutoAdminLogon|DefaultPassword))",
  "title": "Weaken exact Windows credential-protection controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "defense-evasion",
    "windows",
    "registry"
  ]
}

{
  "id": "tamper.windows_amsi_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['new-itemproperty', 'set-itemproperty', 'remove-item', 'powershell-amsi-reflection'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\b(?:set|new)-itemproperty\\b[^\\r\\n]*AmsiEnable|\\bremove-item\\b[^\\r\\n]*Microsoft[/\\\\]AMSI[/\\\\]Providers[/\\\\]\\{[0-9a-f-]{36}\\}|AmsiUtils[^\\r\\n]*amsiInitFailed[^\\r\\n]*SetValue\\s*\\(\\s*\\$null\\s*,\\s*\\$true\\s*\\))",
  "title": "Disable or bypass exact Windows AMSI controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "amsi"
  ]
}

{
  "id": "tamper.endpoint_security_product_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['systemctl', 'launchctl', 'sysmon', 'sysmon.exe', 'mdatp', 'sc', 'sc.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\b(?:sudo\\s+)?systemctl\\s+(?:stop|disable)\\s+falcon-sensor\\.service\\b|\\b(?:sudo\\s+)?launchctl\\s+unload\\s+/Library/LaunchDaemons/(?:com\\.carbonblack\\.(?:daemon|defense\\.daemon)|at\\.obdev\\.littlesnitchd)\\.plist\\b|\\bsysmon(?:\\.exe)?\\s+-u(?:\\s|$)|\\b(?:sudo\\s+)?mdatp\\s+config\\s+real-time-protection\\s+--value\\s+disabled(?:\\s|$)|\\bsc(?:\\.exe)?\\s+(?:stop|config|query)\\s+WinDefend\\b)",
  "title": "Disable or uninstall an exact endpoint-security product",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "endpoint-security",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.complete_firewall_relaxation",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'iptables' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?iptables\\s+(?:-F(?:\\s+INPUT)?|-P\\s+(?:INPUT|FORWARD|OUTPUT)\\s+ACCEPT)(?:\\s|$)",
  "title": "Completely relax the host iptables firewall",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "firewall",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.cloud_audit_control_destruction",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['aws', 'gcloud'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\baws\\s+cloudtrail\\s+(?:stop-logging|delete-trail)\\b|\\bgcloud\\s+logging\\s+logs\\s+delete\\s+projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/logs/cloudaudit\\.googleapis\\.com%2Factivity\\s+--quiet(?:\\s|$))",
  "title": "Destroy an exact cloud audit-logging control",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "cloud",
    "audit-logging",
    "bounded-lineage"
  ]
}

{
  "id": "exec.postgresql_copy_program",
  "tool_call_only": true,
  "expression": "f.tool == 'sql_query'",
  "pattern": "a^",
  "title": "PostgreSQL COPY PROGRAM server-side command execution",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "postgresql",
    "server-side",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.cloud_iam_administrator_attachment",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'aws' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations)",
  "pattern": "(?i)\\battach-(?:user|role)-policy\\s+--(?:user|role)-name\\s+[A-Za-z0-9_+=,.@-]{1,64}\\s+--policy-arn\\s+arn:aws:iam::aws:policy/AdministratorAccess(?:\\s|\"|$)",
  "title": "Attach AWS AdministratorAccess to an exact IAM principal",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "privilege-escalation",
    "cloud",
    "aws",
    "iam",
    "bounded-lineage"
  ]
}

{
  "id": "exec.sql_command_udf_create",
  "tool_call_only": true,
  "expression": "f.tool in ['sql_query', 'execute_command']",
  "pattern": "a^",
  "title": "Create a command-executing SQL UDF",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "mysql",
    "postgresql",
    "udf",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.kubernetes_cronjob_privileged_patch",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Make an exact Kubernetes CronJob job template privileged",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "kubernetes",
    "cronjob",
    "cluster",
    "bounded-lineage"
  ]
}

{
  "id": "credential.pam_password_capture",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'echo' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\becho\\b[^\\r\\n]{0,900}\\bpam_tty_audit\\.so\\b[^\\r\\n]{0,900}>{1,2}\\s*/etc/pam\\.d/[a-z0-9_.-]+(?:\\s|$)",
  "title": "Install exact PAM password-capture configuration",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "credential-capture",
    "linux",
    "tampering",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.posix_logging_hardening_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['sed', 'service', 'sysrc', 'sysctl', 'ufw'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bsed\\s+(?:-i|--in-place)\\s+[\"']?s/Storage=auto/Storage=none/[\"']?\\s+/etc/systemd/journald\\.conf\\b|\\bservice\\s+(?:syslogd|pf)\\s+(?:stop|disable)\\b|\\bsysrc\\s+syslogd_enable=[\"']?NO[\"']?\\b|\\bsysctl\\s+-w\\s+kernel\\.randomize_va_space=0\\b|\\bufw\\s+logging\\s+off\\b)",
  "title": "Disable exact POSIX logging or host-hardening controls",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "linux",
    "freebsd",
    "logs",
    "hardening",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.linux_security_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditctl', 'setenforce', 'systemctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:auditctl\\s+-e\\s+0|setenforce\\s+(?:0|permissive)|(?:sudo\\s+)?systemctl\\s+stop\\s+(?:auditd|firewalld|systemd-journald|ufw)(?:\\.service)?)(?:\\s|$)",
  "title": "Disable a Linux host security control",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "linux"
  ]
}

{
  "id": "tamper.macos_unified_log_erase",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.program in ['log', 'sudo'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?log\\s+erase\\s+--all(?:\\s|$)",
  "title": "Erase all macOS unified logs",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "macos",
    "logs"
  ]
}

{
  "id": "credential.macos_fake_update_prompt",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'osascript' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)\\bosascript\\b[^\\r\\n]*(?:Software Update requires that you type your password to apply changes\\.|To perform a security update MacOS needs your passphrase\\.)[^\\r\\n]*\\bhidden\\s+answer\\b",
  "title": "Capture credentials with an exact fake macOS update prompt",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "input-capture",
    "phishing",
    "macos",
    "atomic-red-team"
  ]
}

{
  "id": "credential.macos_login_keychain_dump",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'security' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?security\\s+dump-keychain\\s+-d\\s+login\\.keychain(?:-db)?(?:\\s|$)",
  "title": "Dump decrypted credentials from the macOS login keychain",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "credential",
    "credential-dumping",
    "macos",
    "atomic-red-team"
  ]
}

{
  "id": "impact.linux_magic_sysrq_destruction",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized == '/proc/sysrq-trigger')",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)echo\\s+[\"']?[bocei][\"']?\\s*>\\s*/proc/sysrq-trigger(?:\\s|$)",
  "title": "Trigger destructive Linux Magic SysRq action",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "linux",
    "host-control"
  ]
}

{
  "id": "impact.posix_host_halt",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'halt' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)halt\\s+-(?:p|r)(?:\\s|$)",
  "title": "Power off or reboot the POSIX host with halt",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "posix",
    "host-control"
  ]
}

{
  "id": "tamper.posix_system_log_destruction",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized in ['/var/log/messages', '/var/log/security', '/var/log/syslog', '/var/log/auth.log', '/var/log/secure', '/var/log/audit/audit.log'] && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:cat\\s+/dev/(?:null|zero)\\s*>\\s*/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|echo\\s+(?:''|\"\")\\s*>\\s*/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|truncate\\s+(?:-s\\s+0|--size=0)\\s+/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|(?:rm\\s+-(?:rf|fr)|unlink)\\s+/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|(?:sudo\\s+)?journalctl\\s+--vacuum-time=0)(?:\\s|$)",
  "title": "Destroy canonical POSIX system logs",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "posix",
    "logs"
  ]
}

{
  "id": "CMD-SYSTEMCTL",
  "pattern": "(?i)\\bsystemctl\\s+enable\\b(?:\\s+--now\\b)?\\s+\\S*(?:backdoor|payload|persist|reverse|shell|evil)\\S*(?:\\.service)?\\b",
  "title": "Suspicious systemd persistence enablement",
  "severity": "CRITICAL",
  "confidence": 0.82,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-NETCAT-LISTEN",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:nc|ncat|netcat)\\s+(?:\\S+\\s+)*(?:-[a-zA-Z]*l[a-zA-Z]*|--listen)(?:\\s|$)",
  "title": "Netcat listener",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "reverse-shell"
  ]
}

{
  "id": "CMD-CURL-UPLOAD",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ) && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.to_command_id == c.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_FILE && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_PROCESS) && f.data_flows.exists(d, d.from_command_id == c.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\bcurl\\b\\s+.*(?:--upload-file|-T\\s|--data\\s+@|-F\\s+.*=@)",
  "title": "curl file upload",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-WGET-POST",
  "pattern": "(?i)\\bwget\\b[^;\\n]*--post-(?:data|file)",
  "title": "wget POST data exfil",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-SOCAT-EXEC",
  "pattern": "(?i)\\bsocat\\b[^;\\n]*\\bEXEC\\b",
  "title": "socat with EXEC (reverse shell)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-ENV-DUMP",
  "expression": "f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:printenv|export\\s+-p|env)\\b[^|;\\n]*\\|\\s*(?:curl\\b[^;\\n]*(?:--data(?:-binary|-raw|-urlencode)?\\s+@-|-d\\s+@-|(?:--form|-F)\\s+[^;\\n]*=@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;\\n]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Environment variable dump",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_secret_manager_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && c.program in ['aws', 'gcloud', 'az', 'vault', 'op', 'pass', 'security'])",
  "pattern": "(?i)\\b(?:aws\\s+secretsmanager\\s+get-secret-value|gcloud\\s+secrets\\s+versions\\s+access|az\\s+keyvault\\s+secret\\s+show|vault\\s+kv\\s+get|op\\s+(?:read|item\\s+get)|pass\\s+show|security\\s+find-(?:generic|internet)-password)\\b",
  "title": "Cloud secret manager value read",
  "severity": "CRITICAL",
  "confidence": 0.94,
  "tags": [
    "credential",
    "cloud",
    "secret-manager"
  ]
}

{
  "id": "exfil.secret_read_and_egress_oneliner",
  "tool_call_only": true,
  "expression": "f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.paths.exists(p, p.command_id == src.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ)) && f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:cat|type|Get-Content)\\b[^|;\\n]*(?:\\.env|credentials|\\.git-credentials|\\.netrc|_netrc|\\.npmrc|\\.pypirc|config\\.json|/token)\\s*\\|\\s*(?:curl\\b[^;\\n]*(?:--data(?:-binary|-raw|-urlencode)?\\s+@-|-d\\s+@-|(?:--form|-F)\\s+[^;\\n]*=@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;\\n]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Sensitive read piped to external upload",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "exfiltration",
    "network"
  ]
}

{
  "id": "privilege.sudoers_unrestricted_nopasswd",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_APPEND in c.operations) && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND]))",
  "pattern": "a^",
  "title": "Unrestricted passwordless sudo grant",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "persistence",
    "sudoers"
  ]
}

{
  "id": "persistence.global_ld_preload_install",
  "tool_call_only": true,
  "pattern": "(?i)(?:>|>>|\\btee(?:\\s+-a)?)\\s*/etc/ld\\.so\\.preload\\b",
  "title": "Global dynamic-loader preload installation",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "execution",
    "dynamic-loader"
  ]
}

{
  "id": "exec.reverse_tunnel",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_TUNNEL in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_TUNNEL, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT] && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)(?:\\b(?:ssh|autossh)(?:\\.exe)?\\b[^;\\n]*(?:^|\\s)-R(?:\\s+|\\S)|\\bchisel(?:\\.exe)?\\b[^;\\n]*\\bclient\\b[^;\\n]*\\bR:(?:socks|\\S+)|\\bligolo(?:-ng)?-agent\\b[^;\\n]*--?connect(?:=|\\s+)\\S+)",
  "title": "SSH reverse tunnel",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "network",
    "tunnel",
    "persistence"
  ]
}

{
  "id": "exec.agent_runtime_bypass_flags",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['codex', 'codex.exe', 'claude', 'claude.exe', 'gemini', 'gemini.exe', 'opencode', 'opencode.exe', 'npx', 'pnpm', 'bunx'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\b(?:(?:npx(?:\\s+-y)?|pnpm\\s+dlx|bunx)\\s+)?(?:claude|codex|gemini)(?:\\.exe)?\\b[^;\\n]*(?:--dangerously-skip-permissions|--permission-mode(?:=|\\s+)bypassPermissions\\b|--dangerously-bypass-approvals-and-sandbox|--yolo\\b|(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b[^;\\n]*(?:--ask-for-approval|-a)(?:=|\\s+)never\\b|(?:--ask-for-approval|-a)(?:=|\\s+)never\\b[^;\\n]*(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b)",
  "title": "Agent runtime safety bypass flags",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "policy-bypass",
    "agent-runtime"
  ]
}

{
  "id": "integrity.git_hooks_bypass",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git')",
  "pattern": "(?i)\\bgit\\b[^;\\n]*(?:(?:\\bcommit\\b|\\bpush\\b)[^;\\n]*--no-verify\\b|-c\\s+core\\.hooksPath=(?:/dev/null|nul:?|[\"']{2})[^;\\n]*\\b(?:commit|push)\\b|\\bconfig\\s+core\\.hooksPath\\s+(?:/dev/null|nul:?|[\"']{2}))",
  "title": "Git verification hook bypass",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "integrity",
    "policy-bypass"
  ]
}

{
  "id": "integrity.history_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && (c.program == 'history' || (c.program == 'unset' && 'HISTFILE' in c.argv)))",
  "pattern": "(?i)(?:\\bhistory\\b[^;\\n]*\\s-[acnrw]*c[acnrw]*(?:[\\s;&|]|$)|\\bunset\\b[^;\\n]*\\bHISTFILE\\b)",
  "title": "Shell history clear or disable",
  "severity": "MEDIUM",
  "confidence": 0.95,
  "tags": [
    "integrity",
    "defense-evasion"
  ]
}

{
  "id": "recon.network_sweep",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_NETWORK_SCAN in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_SCAN && n.target_kind in [defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_MULTI_ADDRESS_CIDR, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_RANGE, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_LIST, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_GENERATED]))",
  "pattern": "(?i)\\b(?:nmap|masscan|zmap|rustscan|naabu|fping)\\b[^;\\n]*(?:\\b(?:-iL|--input-file|--target-file|-list|--list|-iR|-g|--generate)\\b|(?:\\d{1,3}\\.){3}\\d{1,3}/(?:[0-9]|[12][0-9]|3[01])\\b)",
  "title": "Multi-host network sweep",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "reconnaissance",
    "network"
  ]
}

{
  "id": "privilege.container_host_escape",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations && c.argv.exists(a, a == '--privileged' || a.startsWith('--privileged=')) && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE] && (p.normalized == '/' || p.resolved == '/')))",
  "pattern": "(?i)\\b(?:docker|podman|nerdctl)\\b[^;\\n]*\\brun\\b[^;\\n]*--privileged\\b[^;\\n]*(?:-v|--volume)(?:=|\\s+)/:[^;\\s]+",
  "title": "Privileged container with host-root bind",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "privilege",
    "container",
    "host-escape"
  ]
}

{
  "id": "privilege.host_namespace_entry",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:nsenter\\b[^;\\n]*(?:(?:-t|--target)(?:=|\\s+)1\\b|/proc/1/ns/(?:mnt|uts|ipc|net|pid|user|cgroup|time)\\b)|chroot\\b[^;\\n]*/proc/1/root\\b)",
  "title": "Host PID-1 namespace or root entry",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "privilege",
    "container",
    "host-escape"
  ]
}

{
  "id": "lateral.workload_exec",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:(?:kubectl|oc)\\b[^;\\n]*\\b(?:exec|debug|rsh)\\b|crictl\\b[^;\\n]*\\bexec\\b|ctr\\b[^;\\n]*\\btasks?\\s+exec\\b|(?:docker|podman)\\b[^;\\n]*(?:--host|-H)(?:=|\\s+)(?:tcp|ssh)://[^;\\s]+\\s+exec\\b)",
  "title": "Remote workload command execution",
  "severity": "HIGH",
  "confidence": 0.92,
  "tags": [
    "execution",
    "lateral-movement",
    "workload"
  ]
}

{
  "id": "impact.cryptomining_launch",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations)",
  "pattern": "(?i)(?:^|[;&|\\s])(?:[/\\\\\\w.-]+[/\\\\])?(?:xmrig(?:-proxy)?|minerd|cpuminer(?:-multi)?|ethminer|cgminer|bfgminer|t-rex|lolminer|nbminer|teamredminer|phoenixminer|nanominer)(?:\\s|$)",
  "title": "Cryptocurrency miner launch",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "impact",
    "resource-hijacking"
  ]
}

{
  "id": "impact.fork_bomb",
  "tool_call_only": true,
  "pattern": "(?i)(?:^|\\s)(?::\\s*\\(\\s*\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:|perl\\s+-e\\s+['\"]?\\s*fork\\s+while\\s+fork\\s*;?\\s*['\"]?|ruby\\s+-e\\s+['\"]?\\s*loop\\s*\\{\\s*fork\\s*\\}\\s*;?\\s*['\"]?)\\s*$",
  "title": "Unbounded fork bomb",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "impact.mass_process_termination",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['kill', 'stop-process', 'taskkill'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PROCESS_KILL in c.operations)",
  "pattern": "(?i)\\b(?:kill\\b[^;\\n]*(?:-9|-KILL|-SIGKILL)\\b[^;\\n]*-1\\b|stop-process\\b[^;\\n]*(?:-name|-processname)(?:=|\\s+)\\*[^;\\n]*-force\\b|taskkill\\b[^;\\n]*/im\\s+\\*[^;\\n]*/f\\b)",
  "title": "Mass process termination",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "source.git_remote_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)\\bgit\\b[^;\\n]*\\bremote\\s+(?:add|set-url)\\b[^;\\n]*(?:https?|ssh|git)://[^;\\s]+",
  "title": "Git remote routing change",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "network",
    "tampering"
  ]
}

{
  "id": "source.git_config_exec",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations || (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE && (p.normalized == '.git/config' || p.resolved.endsWith('/.git/config'))))))",
  "pattern": "(?i)\\bgit\\b[^;\\r\\n]*(?:\\bconfig\\b[^;\\r\\n]*(?:alias\\.[A-Za-z0-9._-]+|credential\\.helper|core\\.(?:sshCommand|hooksPath))\\b[^;\\r\\n]+|\\b(?:show|log|diff|whatchanged)\\b[^;\\r\\n]*--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]config(?:$|[\"'\\s]))",
  "title": "Git executable configuration change or overwrite",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "execution",
    "tampering"
  ]
}

{
  "id": "persistence.ssh_authorized_keys_command",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:>>?|(?:tee|truncate|rm|unlink|cp|mv|set-content|add-content|out-file|remove-item|copy-item|move-item)\\b[^;\\n]*)[^;\\n]*(?:[/\\\\]\\.ssh[/\\\\](?:authorized_keys2?)|[/\\\\]programdata[/\\\\]ssh[/\\\\]administrators_authorized_keys)\\b",
  "title": "SSH authorized keys mutation",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "persistence",
    "credential",
    "ssh"
  ]
}

{
  "id": "persistence.privileged_account_change",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['useradd', 'usermod', 'gpasswd', 'groupmems', 'adduser', 'dseditgroup', 'dscl', 'net', 'net1', 'add-localgroupmember', 'add-adgroupmember'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ACCOUNT_CHANGE in c.operations)",
  "pattern": "(?i)\\b(?:useradd\\b[^;\\n]*(?:-u|--uid)(?:=|\\s+)0\\b|usermod\\b[^;\\n]*(?:(?:-u|--uid)(?:=|\\s+)0\\b|(?:-G|--groups)(?:=|\\s+)[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman))|(?:gpasswd|groupmems|adduser|dseditgroup|dscl)\\b[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman)\\b|net\\s+localgroup\\s+(?:Administrators|Remote Desktop Users)\\b[^;\\n]*/add\\b|Add-(?:Local|AD)GroupMember\\b[^;\\n]*(?:Administrators|Domain Admins|Enterprise Admins)\\b)",
  "title": "Privileged account or group change",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "persistence",
    "privilege",
    "account"
  ]
}

{
  "id": "ENT-BULK-SSN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})-(?:0[1-9]|[1-9][0-9])-(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US Social Security Number",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-SSN-NOHYPHEN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})(?:0[1-9]|[1-9][0-9])(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US SSN (no hyphens)",
  "severity": "HIGH",
  "confidence": 0.55,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-CC-VISA",
  "pattern": "\\b4\\d{3}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Visa credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-MC",
  "pattern": "\\b5[1-5]\\d{2}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Mastercard credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-AMEX",
  "pattern": "\\b3[47]\\d{2}[\\s-]?\\d{6}[\\s-]?\\d{5}\\b",
  "title": "American Express card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-DISCOVER",
  "pattern": "\\b6(?:011|5\\d{2})[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Discover card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-IBAN",
  "pattern": "\\b[A-Z]{2}\\d{2}[\\s]?[\\dA-Z]{4}[\\s]?(?:[\\dA-Z]{4}[\\s]?){1,7}[\\dA-Z]{1,4}\\b",
  "title": "International Bank Account Number (IBAN)",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "financial"
  ]
}

{
  "id": "ENT-US-PHONE",
  "pattern": "(?:\\+1(?:[\\s.-]?\\d){10}\\b|\\(\\d{3}\\)[\\s.-]?\\d{3}[\\s.-]?\\d{4}\\b|\\b\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{4}\\b|(?i:\\b(?:phone|mobile|telephone|contact|tel|whatsapp)\\b[^\\r\\n\\d]{0,32}(?:\\+?1[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-]?)\\d{3}[\\s.-]?\\d{4}\\b))",
  "title": "US phone number",
  "severity": "MEDIUM",
  "confidence": 0.5,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-PHONE-E164",
  "pattern": "(?:^|[\\s:(])\\+\\d{1,3}(?:[\\s.-]?\\d){7,14}\\b",
  "title": "International E.164-style phone number",
  "severity": "MEDIUM",
  "confidence": 0.55,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-EMAIL-BULK",
  "pattern": "(?i)\\b[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,}\\b",
  "title": "Email address",
  "severity": "MEDIUM",
  "confidence": 0.4,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-PASSPORT-US",
  "pattern": "\\b[A-Z]\\d{8}\\b",
  "title": "US passport number pattern",
  "severity": "HIGH",
  "confidence": 0.5,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-DL-CA",
  "pattern": "\\b[A-Z]\\d{7}\\b",
  "title": "California drivers license pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-MEDICAL-RECORD",
  "pattern": "(?i)\\b(?:mrn|medical record|patient id)\\s*[:#]?\\s*\\d{6,12}\\b",
  "title": "Medical record number",
  "severity": "CRITICAL",
  "confidence": 0.7,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-DOB-PATTERN",
  "pattern": "(?i)\\b(?:dob|date of birth|birth[\\s-]?date)\\s*[:#]?\\s*\\d{1,2}[/\\-]\\d{1,2}[/\\-]\\d{2,4}\\b",
  "title": "Date of birth with label",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-NHS-NUMBER",
  "pattern": "(?i:\\b(?:nhs(?:\\s+(?:number|no\\.?|id))?|national health service(?:\\s+(?:number|no\\.?|id))?)\\b[^\\r\\n\\d]{0,24}\\d{3}[\\s]?\\d{3}[\\s]?\\d{4}\\b|\\b\\d{3}[\\s]?\\d{3}[\\s]?\\d{4}\\b[^\\r\\nA-Za-z]{0,8}(?:nhs(?:\\s+(?:number|no\\.?|id))?|national health service(?:\\s+(?:number|no\\.?|id))?)\\b)",
  "title": "UK NHS number pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-CSV-PII",
  "pattern": "(?im)(?:^|\\n)[^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*[,\\t][^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*\\r?\\n[^\\r\\n]*[0-9][^\\r\\n]*",
  "title": "CSV/TSV records with multiple PII columns",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "ENT-BULK-JSON-PII",
  "pattern": "(?i)\\{[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)\\s*,[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)[^{}]{0,512}\\}",
  "title": "JSON record with multiple PII values",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "SEC-AWS-KEY",
  "pattern": "\\b(?:AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[0-9A-Z]{16,}",
  "title": "AWS access key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-AWS-SECRET",
  "pattern": "(?i)aws_secret_access_key\\s*[=:]\\s*[A-Za-z0-9/+=]{30,}",
  "title": "AWS secret access key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-ANTHROPIC",
  "pattern": "sk-ant-[a-zA-Z0-9\\-_]{20,}",
  "title": "Anthropic API key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI",
  "pattern": "sk-proj-[a-zA-Z0-9]{20,}",
  "title": "OpenAI project key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI-V2",
  "pattern": "sk-[a-zA-Z0-9]{40,}",
  "title": "OpenAI API key (long form)",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-STRIPE",
  "pattern": "(?:sk_live_|sk_test_|rk_live_|rk_test_)[a-zA-Z0-9]{20,}",
  "title": "Stripe secret/restricted key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-TOKEN",
  "pattern": "(?:ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36,}",
  "title": "GitHub token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-PAT",
  "pattern": "github_pat_[a-zA-Z0-9_]{22,}",
  "title": "GitHub fine-grained PAT",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITLAB",
  "pattern": "glpat-[a-zA-Z0-9\\-_]{20,}",
  "title": "GitLab personal access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GOOGLE",
  "pattern": "AIza[0-9A-Za-z\\-_]{35}",
  "title": "Google API key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-TOKEN",
  "pattern": "xox[bpors]-[0-9a-zA-Z\\-]{10,}",
  "title": "Slack token",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-WEBHOOK",
  "pattern": "https://hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+",
  "title": "Slack webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-DISCORD-WEBHOOK",
  "pattern": "https://discord(?:app)?\\.com/api/webhooks/\\d+/[a-zA-Z0-9_\\-]+",
  "title": "Discord webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PRIVKEY",
  "pattern": "-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----",
  "title": "Private key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-JWT",
  "pattern": "eyJ[A-Za-z0-9\\-_]{10,}\\.eyJ[A-Za-z0-9\\-_]{10,}\\.[A-Za-z0-9\\-_.+/=]+",
  "title": "JWT token",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-CONNSTR",
  "pattern": "(?:mongodb|postgres|mysql|redis|amqp)://[^:\\s]+:[^@\\s]+@",
  "title": "Connection string with credentials",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-BEARER",
  "pattern": "(?i)(?:authorization|bearer)\\s*[:=]\\s*Bearer\\s+[A-Za-z0-9\\-_.~+/]{16,}=*",
  "title": "Bearer token in header",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SENDGRID",
  "pattern": "SG\\.[a-zA-Z0-9\\-_]{10,}\\.[a-zA-Z0-9\\-_]{10,}",
  "title": "SendGrid API key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-TWILIO",
  "pattern": "SK[0-9a-fA-F]{32}",
  "title": "Twilio API key",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-NPM-TOKEN",
  "pattern": "npm_[a-zA-Z0-9]{36,}",
  "title": "npm access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PYPI-TOKEN",
  "pattern": "pypi-[A-Za-z0-9\\-_]{50,}",
  "title": "PyPI API token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-HEX-SECRET",
  "pattern": "(?i)(?:secret(?:_key)?|api[_-]?key|[a-z0-9]{0,24}[_-]?token)\\s*[=:]\\s*[\"']?[a-f0-9]{32,}\\b",
  "title": "Hex-encoded secret in assignment",
  "severity": "HIGH",
  "confidence": 0.72,
  "tags": [
    "credential"
  ]
}

{
  "id": "PATH-SSH-DIR",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.ssh/",
  "title": "SSH directory access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-SSH-KEY",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:^|[\\\\/])id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[^A-Za-z0-9_.-])",
  "title": "SSH private key file path",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/credentials",
  "title": "AWS credentials file",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CONFIG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/config",
  "title": "AWS config file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-KUBE",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.kube/config",
  "title": "Kubernetes config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-DOCKER",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.docker/config\\.json",
  "title": "Docker config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GNUPG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.gnupg/",
  "title": "GPG keyring access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NPMRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.npmrc",
  "title": "npm config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-PYPIRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.pypirc",
  "title": "PyPI config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GIT-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.git-credentials",
  "title": "Git credentials file",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NETRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.netrc",
  "title": "netrc credentials file",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ENV-FILE",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:^|[\\s/])\\.env(?:\\.(?:local|production|staging|development))?\\s*[\"'\\s,;\\]})]*$|(?:^|[\\s/])\\.env(?:\\.(?:local|production|staging|development))?[\"'\\s,;\\]})]",
  "title": "Environment file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ETC-PASSWD",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?pas{1,4}wd\\b|\\betc%2Fpas{1,4}wd\\b)",
  "title": "/etc/passwd access",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "PATH-ETC-SHADOW",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?shadow\\b|\\betc%2Fshadow\\b)",
  "title": "/etc/shadow access",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "system-file",
    "credential"
  ]
}

{
  "id": "PATH-ETC-SUDOERS",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?sudoers\\b|\\betc%2Fsudoers\\b)",
  "title": "/etc/sudoers access",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file",
    "privilege"
  ]
}

{
  "id": "PATH-PROC-ENVIRON",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/proc/(?:\\d+|self)/environ",
  "title": "/proc environ access",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_credential_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|gh[/\\\\]hosts\\.yml)|AppData[/\\\\]Roaming[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|GitHub CLI[/\\\\]hosts\\.yml)|\\.azure[/\\\\](?:azureProfile\\.json|TokenCache\\.dat|msal_token_cache[^/\\\\]*\\.(?:json|bin)))(?:$|[\"'\\s])",
  "title": "Cloud credential material read",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "credential",
    "cloud",
    "file-sensitive"
  ]
}

{
  "id": "secrets.browser_session_store_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:google-chrome|chromium|microsoft-edge)|\\.mozilla[/\\\\]firefox|Library[/\\\\]Application Support[/\\\\](?:google[/\\\\]chrome|chromium|microsoft edge|firefox[/\\\\]profiles)|AppData[/\\\\]Local[/\\\\](?:google[/\\\\]chrome|chromium|microsoft[/\\\\]edge)[/\\\\]User Data|AppData[/\\\\]Roaming[/\\\\]mozilla[/\\\\]firefox[/\\\\]profiles)[/\\\\](?:[^/\\\\\"']+[/\\\\])*(?:Login Data|Cookies|logins\\.json|cookies\\.sqlite|key4\\.db)(?:$|[\"'\\s])",
  "title": "Browser credential or session store read",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "browser",
    "file-sensitive"
  ]
}

{
  "id": "secrets.workload_identity_token_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/var/run/secrets/(?:(?:kubernetes\\.io|eks\\.amazonaws\\.com)/serviceaccount/token|azure/tokens/azure-identity-token)(?:$|[\"'\\s])",
  "title": "Workload identity token read",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "workload-identity",
    "file-sensitive"
  ]
}

{
  "id": "PATH-HISTORY",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.(?:bash_history|zsh_history|python_history)",
  "title": "Shell history file",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "privilege.container_runtime_socket_access",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_CONNECT))",
  "pattern": "(?i)(?:unix://)?/(?:var/)?run/(?:docker\\.sock|containerd/containerd\\.sock|crio/crio\\.sock|podman/podman\\.sock)\\b",
  "title": "Container runtime socket access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "privilege",
    "container",
    "socket"
  ]
}

{
  "id": "persistence.shell_profile_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:^|[^-:A-Za-z0-9_./~\\\\])(?:(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.(?:profile|bash_profile|bashrc|zprofile|zshrc)|\\.config[/\\\\](?:fish[/\\\\]config\\.fish|powershell[/\\\\](?:profile|microsoft\\.powershell_profile)\\.ps1)|Documents[/\\\\](?:Windows)?PowerShell[/\\\\](?:profile|Microsoft\\.PowerShell_profile)\\.ps1)\\b|/etc/profile(?:$|[\"'\\s]))",
  "title": "Shell startup profile mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "shell",
    "file-sensitive"
  ]
}

{
  "id": "persistence.git_hook_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:(?:^|[/\\\\])\\.git[/\\\\]hooks[/\\\\]|--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]hooks[/\\\\])(?:applypatch-msg|commit-msg|fsmonitor-watchman|post-checkout|post-commit|post-merge|post-receive|post-rewrite|pre-applypatch|pre-commit|pre-push|pre-rebase|pre-receive|prepare-commit-msg|push-to-checkout|update)(?:$|[\"'\\s])",
  "title": "Active Git hook mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "source-control",
    "file-sensitive"
  ]
}

{
  "id": "TRUST-AUTHORITY",
  "pattern": "(?i)(?:i am|i'm)\\s+(?:your|the)\\s+(?:creator|developer|admin|owner|operator)\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|disregard|bypass|disable|reveal|expose|forget|obey|comply)\\b|do\\s+as\\s+i\\s+say|no\\s+(?:content\\s+policy\\s+)?restrictions?)",
  "title": "Authority claim in tool args",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-MAINTENANCE",
  "pattern": "(?im)(?:(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|now,?|next,?)\\s+)?(?:enable|activate|enter|switch\\s+to)\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?))|(?:maintenance|debug|admin|developer)\\s+mode\\s+(?:enabled|activated|on)\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?)))|\\bnew\\s+system\\s+message\\b[\\s\\S]{0,100}\\byou\\s+are\\s+now\\s+in\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,100}\\b(?:refusals?|guardrails?|filters?|safety\\s+checks?)\\s+(?:are\\s+)?disabled\\b)",
  "title": "Fake mode activation",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SAFETY-OVERRIDE",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:override|bypass|disable|turn\\s+off|remove)\\s+(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))|(?:safety|guardrails?)\\s+(?:override|bypass)\\s+(?:enabled|activated|on|now)|(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))\\s+(?:must\\s+be|should\\s+be|are\\s+now|is\\s+now|have\\s+been|has\\s+been)\\s+(?:overridden|bypassed|disabled|turned\\s+off|removed))",
  "title": "Safety override attempt",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCTIONS",
  "pattern": "(?i)(?:(?:your|the)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:have|has)\\s+(?:changed|been\\s+(?:updated|replaced|overridden))\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|bypass|disable|reveal|expose|forget|obey|comply)\\b|\\b(?:now|next)\\b[\\s,:;-]+(?:do\\s+this|execute\\s+(?:this|the\\s+following)|obey\\s+(?:me|my\\s+commands?)|follow\\s+(?:these|my|the\\s+new)\\s+instructions?)\\b)|(?:new|updated)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:are|say)\\s+(?:to\\s+)?(?:ignore|override|bypass|disable|reveal))",
  "title": "Fake instruction update",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-IGNORE-PREVIOUS",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?ignore\\s+(?:all\\s+)?(?:previous|prior|above|earlier)\\s+(?:instructions|rules|guidelines|context)",
  "title": "Ignore previous instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DISREGARD",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?disregard\\s+(?:all\\s+)?(?:previous|prior|above|your|earlier)\\s+(?:instructions|rules|guidelines|programming|context)",
  "title": "Disregard instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-JAILBREAK",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:enable|activate|enter|use|switch\\s+to)\\s+(?:a\\s+|the\\s+)?(?:jailbreak(?:ed)?|dan)(?:\\s+(?:mode|persona))?|(?:(?:please,?)\\s+)?(?:follow|run|apply)\\s+(?:this\\s+|the\\s+|a\\s+)?jailbreak\\s+(?:prompt|instructions?)|(?:(?:please,?)\\s+)?jailbreak\\s+(?:yourself|(?:this|the|your)\\s+(?:ai|assistant|agent|model|system))|(?:jailbreak|dan)\\s+mode\\s+(?:enabled|activated|on)|you\\s+are\\s+(?:now\\s+)?dan\\b[\\s\\S]{0,80}\\b(?:without\\s+(?:rules?|restrictions?|filters?)|do\\s+anything|ignore\\s+(?:safety|rules?|instructions?))|do\\s+anything\\s+now|you\\s+are\\s+now\\s+(?:unfiltered|free\\s+(?:from|without)\\s+(?:rules?|restrictions?|filters?|safety(?:\\s+(?:rules?|filters?|checks?))?)))",
  "title": "Jailbreak attempt",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PRETEND",
  "pattern": "(?i)(?:(?:pretend|act\\s+as(?:\\s+if)?)\\s+(?:you\\s+are|you're)\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)|you\\s+are\\s+now\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)\\s+(?:assistant|agent|model|persona))",
  "title": "Identity override attempt",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FORGET",
  "pattern": "(?im)\\bforget\\s+(?:everything|all)\\s+(?:you\\s+)?(?:know|learned|were\\s+told)\\b[\\s\\S]{0,160}\\b(?:from\\s+now\\s+on|obey\\s+only|follow\\s+(?:only\\s+)?(?:my|these|the)\\s+(?:commands?|instructions?)|ignore\\s+(?:rules?|instructions?|safety)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety))",
  "title": "Forget instructions attack",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCT-PREFIX",
  "pattern": "(?i)new\\s+instructions?\\s*:\\s*[\\s\\S]{0,100}\\b(?:(?:ignore|override|disregard|bypass|disable|forget)\\s+(?:all\\s+)?(?:your\\s+|the\\s+)?(?:system\\s+prompt|previous|prior|safety|guardrails?|instructions?|rules?|guidelines?)|(?:reveal|expose)\\s+(?:your\\s+|the\\s+)?(?:system\\s+prompt|hidden\\s+prompt|private\\s+instructions?|internal\\s+rules?|secrets?))\\b",
  "title": "Direct instruction injection prefix",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OVERRIDE-INSTRUCT",
  "pattern": "(?im)\\boverride\\s+(?:previous\\s+)?(?:instructions?|rules?|guidelines?)\\b[\\s\\S]{0,120}\\b(?:safety\\s+off|(?:respond|answer|continue)\\s+without\\s+(?:a\\s+)?(?:filters?|rules?|restrictions?|safety)|ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|follow\\s+(?:this|these|my|the)\\s+(?:task|payload|instructions?)\\s+instead)",
  "title": "Override instructions",
  "severity": "CRITICAL",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FROM-NOW-ON",
  "pattern": "(?i)from\\s+now\\s+on[,\\s]+(?:(?:you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b)?(?:ignore|bypass|disable)\\s+(?:(?:all|any|the|your)\\s+)?(?:guardrails?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?|security\\s+(?:controls?|policy|rules?))|you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b(?:never\\s+refuse|not\\s+refuse|answer\\s+without|respond\\s+without|unrestricted|unfiltered|uncensored))",
  "title": "Persistent behavior change",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SWITCH-MODE",
  "pattern": "(?i)switch\\s+(?:to\\s+)?(?:a\\s+|an\\s+)?unrestricted\\s+(?:mode|personality|character|persona)",
  "title": "Mode/personality switch",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PROMPT-EXTRACT",
  "pattern": "(?i)(?:show|reveal|print|output|display|repeat|tell\\s+me)\\s+(?:me\\s+)?(?:your\\s+)?(?:the\\s+)?(?:(?:system|initial|hidden|private|internal)\\s+)?(?:prompt|instructions?|rules?|guidelines?)",
  "title": "System prompt extraction attempt",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FICTIONAL",
  "pattern": "(?i)(?:hypothetically|in\\s+a\\s+fictional\\s+(?:scenario|world|story)|for\\s+(?:educational|research|academic)\\s+purposes?\\s+only|this\\s+is\\s+just\\s+a\\s+(?:test|experiment|hypothetical))",
  "title": "Fictional framing / purpose laundering",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NO-ETHICS",
  "pattern": "(?i)(?:(?:remove|ignore|disable|bypass)\\s+(?:all\\s+)?(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?:operate|respond|answer|act)\\s+(?:with\\s+)?no\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?m:(?:^|[.!?;]\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?)\\s+)?(?:operate|respond|answer|act)\\s+without(?:\\s+any)?\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)))",
  "title": "Ethics removal attempt",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-TOOL-MANIP",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:invoke\\s+(?:the\\s+)?\\w+\\s+(?:tool|function)\\s+without\\s+(?:asking|confirmation|approval)|automatically\\s+(?:execute|run|call)\\s+(?:all\\s+)?(?:tools?|functions?))",
  "title": "Tool manipulation directive",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PERSONA",
  "pattern": "(?i)(?:(?:act\\s+as|you\\s+are\\s+now|roleplay\\s+as|simulate\\s+being|play\\s+the\\s+role\\s+of)\\s+(?:roleplaying\\s+as\\s+)?(?:a\\s+|an\\s+)?(?:malicious\\s+(?:hacker|pentester|attacker|malware\\s+author)|evil|unethical|criminal)|you\\s+are\\s+now\\s+(?:a\\s+)?helpful\\s+tool\\s+for\\s+penetration\\s+testers)",
  "title": "Malicious persona adoption",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DELIMITER",
  "pattern": "(?im)(?:\\[INST\\][\\s\\S]{0,200}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}\\[\\/INST\\]|<\\|im_start\\|>[\\s\\S]{0,200}\\b(?:no\\s+restrictions?|override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}<\\|im_end\\|>|(?:system\\s+override|end\\s+system\\s+prompt|<\\/system>|<\\|im_end\\|>|<\\|endoftext\\|>|<<\\s*SYS\\s*>>|\\[INST\\]|\\[\\/INST\\])[\\s\\S]{0,120}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b)",
  "title": "Delimiter hijacking / prompt framing escape",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OUTPUT-CONSTRAINT",
  "pattern": "(?i)(?:respond\\s+only\\s+in\\s+(?:hex|base64|rot13|binary|morse|unicode)|encode\\s+your\\s+(?:response|answer|output)\\s+in\\s+(?:base64|hex|rot13|url)|output\\s+as\\s+(?:hex|base64|rot13|url)\\s+encoded|(?:rot13|unicode\\s+escape|url\\s+(?:decode|encode))\\s+(?:the|your|this))",
  "title": "Forced encoding to bypass filters",
  "severity": "MEDIUM",
  "confidence": 0.85,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "TRUST-PAYLOAD-SPLIT",
  "pattern": "(?i)(?:start\\s+your\\s+(?:response|answer|output)\\s+with\\s+[\"'](?:Sure|Absolutely|Of\\s+course|Here\\s+is|I\\s+can\\s+help))|(?:begin\\s+by\\s+saying\\s+[\"'](?:Sure|Yes|Absolutely))",
  "title": "Payload splitting / forced compliance prefix",
  "severity": "MEDIUM",
  "confidence": 0.87,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "OBFUSC-UNICODE-ZWSP",
  "pattern": "(?:[A-Za-z0-9][\\x{200B}\\x{200C}\\x{200D}\\x{FEFF}][\\s\\S]*?){10,}",
  "title": "Zero-width character obfuscation",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "STRIP-SYSTEM-SENDER",
  "pattern": "\\b(cli|system|bot|admin)\\b",
  "context": "System sender metadata injected by agent framework",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "STRIP-MESSAGING-BRIDGE-STATUS",
  "pattern": "(?im)^[ \\t]*System:[ \\t]*\\[[^\\]\\n]+\\][ \\t]+[^\\n]*?\\b(?:connected|disconnected|reconnected|linked|unlinked|online|offline)\\b[^\\n]*$",
  "context": "Messaging bridge status banners (WhatsApp/Telegram/Slack/Discord gateway connect/disconnect lines) embed channel IDs or phone numbers that are transport metadata, not user-provided PII",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "SUPP-USERNAME-METADATA",
  "finding_pattern": "JUDGE-PII-USER",
  "entity_pattern": "^(cli|system|bot|admin|root)$",
  "reason": "System metadata, not real username"
}

{
  "id": "SUPP-EMAIL-CHATID",
  "finding_pattern": "JUDGE-PII-EMAIL",
  "entity_pattern": "^19:[a-f0-9\\-]+@unq\\.gbl\\.spaces$",
  "reason": "Teams chatId format, not email address"
}

{
  "tool_pattern": "^(shell|bash|sh)\\.execute$",
  "suppress_findings": [
    "JUDGE-INJ-DESTRUCTIVE"
  ],
  "reason": "Cosmetic shell commands (git status, ls, pwd) generate noise without security risk"
}