Recipes

{
  "id": "C2-WEBHOOK-SITE",
  "pattern": "(?i)webhook\\.site",
  "title": "webhook.site (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-NGROK",
  "pattern": "(?i)(?:ngrok\\.io|ngrok-free\\.app)",
  "title": "ngrok tunnel (exfil risk)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PIPEDREAM",
  "pattern": "(?i)pipedream\\.net",
  "title": "Pipedream (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-REQUESTBIN",
  "pattern": "(?i)requestbin\\.com",
  "title": "RequestBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-HOOKBIN",
  "pattern": "(?i)hookbin\\.com",
  "title": "HookBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-BURP",
  "pattern": "(?i)burpcollaborator\\.net",
  "title": "Burp Collaborator (pentest C2)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-INTERACTSH",
  "pattern": "(?i)interact\\.sh",
  "title": "interact.sh (OOB exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-OAST",
  "pattern": "(?i)oast\\.fun",
  "title": "oast.fun (OOB testing)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-CANARY",
  "pattern": "(?i)canarytokens\\.com",
  "title": "Canary Tokens",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PASTEBIN",
  "pattern": "(?i)pastebin\\.com/raw/",
  "title": "Pastebin raw fetch",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-METADATA-AWS",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_DOWNLOAD, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT]))",
  "pattern": "169\\.254\\.169\\.254",
  "title": "AWS metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-GCP",
  "pattern": "(?i)metadata\\.google\\.internal",
  "title": "GCP metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-AZURE",
  "pattern": "169\\.254\\.169\\.254/metadata",
  "title": "Azure metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-HEX",
  "pattern": "(?i)0xa9fea9fe",
  "title": "AWS metadata endpoint (hex-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-DECIMAL",
  "pattern": "(?:^|[/])2852039166(?:$|[/])",
  "title": "AWS metadata endpoint (decimal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-OCTAL",
  "pattern": "0251\\.0376\\.0251\\.0376",
  "title": "AWS metadata endpoint (octal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-DNS-TUNNEL",
  "pattern": "(?i)\\b(?:dig|host|nslookup|drill)\\b\\s+[^;\\n]*\\$\\((?:whoami|hostname|id(?:\\s+-u)?|cat\\s+(?:/etc/hostname|/etc/machine-id))\\)[A-Za-z0-9._-]*\\.[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+",
  "title": "DNS TXT query with high-entropy label (tunneling indicator)",
  "severity": "HIGH",
  "confidence": 0.78,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "C2-DNS-EXFIL",
  "pattern": "(?i)\\bnslookup\\b\\s+[a-f0-9]{8,}\\.\\w+\\.",
  "title": "nslookup with hex subdomain (DNS exfil)",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "COG-SOUL",
  "pattern": "(?i)SOUL\\.md",
  "title": "SOUL.md access (agent identity)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-IDENTITY",
  "pattern": "(?i)IDENTITY\\.md",
  "title": "IDENTITY.md access",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-MEMORY",
  "pattern": "(?i)MEMORY\\.md",
  "title": "MEMORY.md access",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-CLAUDE-MD",
  "pattern": "(?i)CLAUDE\\.md",
  "title": "CLAUDE.md access",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-TOOLS-MD",
  "pattern": "(?i)TOOLS\\.md",
  "title": "TOOLS.md access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-AGENTS-MD",
  "pattern": "(?i)AGENTS\\.md",
  "title": "AGENTS.md access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-OPENCLAW-JSON",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)openclaw\\.json",
  "title": "openclaw.json config access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-GATEWAY-JSON",
  "pattern": "(?i)gateway\\.json",
  "title": "gateway.json config access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "tamper.detector_state_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\]\\.defenseclaw[/\\\\](?:\\.env|config\\.yaml|confidence_policy\\.yaml|guardrail_runtime\\.json|device\\.key|picked_connector|custom-providers\\.json|(?:audit|judge|judge_bodies)\\.db(?:-(?:wal|shm))?|(?:cache|policies|quarantine|receipts|registries)[/\\\\][^;\\s]+)\\b",
  "title": "DefenseClaw security state mutation",
  "severity": "HIGH",
  "confidence": 0.98,
  "tags": [
    "cognitive-tampering",
    "tampering",
    "security-state"
  ]
}

{
  "id": "CMD-REVSHELL-BASH",
  "expression": "f.commands.exists(c, c.program in ['nc', 'nc.exe', 'ncat', 'ncat.exe', 'netcat', 'socat'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_LISTEN in c.operations) && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_EXECUTE) && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_LISTEN] && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)bash\\s+-i\\s+>&\\s*/dev/tcp/",
  "title": "Bash reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-DEVTCP",
  "pattern": "/dev/tcp/(?:\\d{1,3}\\.\\d{1,3}|[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+)/\\d+\\b",
  "title": "Reverse shell via /dev/tcp",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-NC",
  "pattern": "(?i)\\b(?:nc|ncat|netcat)\\b\\s+(?:(?:-[a-zA-Z]*\\s+)*\\S+\\s+\\d+\\s*(?:-e|--exec)\\b|(?:-[a-zA-Z]*\\s+)*(?:-e|--exec)\\s+\\S+\\s+\\S+\\s+\\d+\\b)",
  "title": "Netcat reverse shell with -e",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-PYTHON",
  "pattern": "(?i)python[23]?\\s+-c\\s+.*socket.*connect",
  "title": "Python reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-PIPE-CURL",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['curl', 'curl.exe', 'invoke-webrequest', 'iwr', 'invoke-restmethod', 'irm'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)(?:\\bcurl\\b\\s+[^|;\\r\\n]*\\|\\s*(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby)\\b|\\b(?:invoke-webrequest|iwr|invoke-restmethod|irm)\\b[^|;\\r\\n]*\\|\\s*(?:invoke-expression|iex)\\b)",
  "title": "curl piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-WGET",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['wget', 'wget.exe'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)\\bwget\\b\\s+[^|]*\\|\\s*(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby)\\b",
  "title": "wget piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-BASE64",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['base64', 'base64.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DECODE in c.operations)",
  "pattern": "(?i:\\bbase64\\b)[^|;\\n]*\\s(?:-d+i?|--decode)\\b[^|;\\n]*\\|\\s*(?i:(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby))\\b",
  "title": "base64 decode piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "obfuscation"
  ]
}

{
  "id": "CMD-EVAL",
  "pattern": "(?i)\\beval\\s+[\"'\\$\\(]",
  "title": "Shell eval with dynamic input",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-BASH-C",
  "pattern": "(?i)\\b(?:ba)?sh\\s+-c\\s+",
  "title": "Shell -c execution",
  "severity": "LOW",
  "confidence": 0.55,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-PYTHON-C",
  "pattern": "(?i)\\bpython[23]?\\s+-c\\s+",
  "title": "Python inline execution",
  "severity": "LOW",
  "confidence": 0.55,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-PERL-E",
  "pattern": "(?i)\\bperl\\s+-e\\s+",
  "title": "Perl inline execution",
  "severity": "LOW",
  "confidence": 0.55,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-RUBY-E",
  "pattern": "(?i)\\bruby\\s+-e\\s+",
  "title": "Ruby inline execution",
  "severity": "LOW",
  "confidence": 0.55,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-RM-RF",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE))",
  "pattern": "(?i)\\brm\\s+(?:-[a-zA-Z]*\\s+)*(?:-[a-zA-Z]*)?(?:r[a-zA-Z]*f|f[a-zA-Z]*r)\\b(?:\\s+\\S+)*\\s+/(?:$|[\"'\\s,}\\]]|(?:etc|bin|sbin|usr|var|home|root|opt|boot|lib(?:64)?|srv|mnt|dev|proc|sys)(?:$|/|[\"'\\s,}\\]]))",
  "title": "Recursive force delete from critical root path",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-MKFS",
  "expression": "f.commands.exists(c, c.argv_complete && c.program != 'dd' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations)",
  "pattern": "(?i)\\bmkfs\\b",
  "title": "Filesystem format command",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-DD-IF",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'dd' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "(?i)\\bdd\\s+if=",
  "title": "dd disk write",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-CHMOD-WORLD",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_METADATA))",
  "pattern": "(?i)\\bchmod\\s+[0-7]*[0-7][0-7][2367]\\s",
  "title": "chmod world-writable",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-CHOWN-ROOT",
  "pattern": "(?i)\\bchown\\s+root\\b",
  "title": "chown to root",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-SUDO",
  "expression": "f.commands.exists(c, c.argv_complete && ((c.program == 'sudo' && ('-l' in c.argv || '--list' in c.argv || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations)) || (c.program in ['find', 'getcap'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_SEARCH in c.operations)))",
  "pattern": "(?i)\\bsudo\\s+",
  "title": "sudo invocation",
  "severity": "LOW",
  "confidence": 0.5,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-ETC-WRITE",
  "pattern": "(?i)>\\s*/etc/",
  "title": "Write redirect to /etc/",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "CMD-CRONTAB",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'crontab' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_SCHEDULE in c.operations)",
  "pattern": "(?i)\\bcrontab\\s+(?:-[a-zA-Z]\\s+)*(?:-e|-r|-l|/|['\"<>|])",
  "title": "Crontab modification",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-SYSTEMCTL",
  "expression": "f.commands.exists(c, c.argv_complete && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_SCHEDULE in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations || f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])))",
  "pattern": "(?i)\\bsystemctl\\s+enable\\b(?:\\s+--now\\b)?\\s+\\S*(?:backdoor|payload|persist|reverse|shell|evil)\\S*(?:\\.service)?\\b",
  "title": "Suspicious systemd persistence enablement",
  "severity": "CRITICAL",
  "confidence": 0.82,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-NETCAT-LISTEN",
  "pattern": "(?i)\\b(?:nc|ncat|netcat)\\b\\s+(?:-[a-zA-Z]*)*-?l",
  "title": "Netcat listener",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "reverse-shell"
  ]
}

{
  "id": "CMD-CURL-UPLOAD",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ) && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.to_command_id == c.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_FILE && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_PROCESS) && f.data_flows.exists(d, d.from_command_id == c.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\bcurl\\b\\s+.*(?:--upload-file|-T\\s|--data\\s+@|-F\\s+.*=@)",
  "title": "curl file upload",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-WGET-POST",
  "pattern": "(?i)\\bwget\\b\\s+.*--post-(?:data|file)",
  "title": "wget POST data exfil",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-SOCAT-EXEC",
  "pattern": "(?i)\\bsocat\\b\\s+.*\\bEXEC\\b",
  "title": "socat with EXEC (reverse shell)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-ENV-DUMP",
  "expression": "f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:printenv|export\\s+-p|env)\\b[^|;\\n]*\\|\\s*(?:curl\\b[^;\\n]*(?:--data(?:-binary|-raw)?\\s+@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;\\n]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Environment variable dump",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_secret_manager_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && c.program in ['aws', 'gcloud', 'az', 'vault', 'op', 'pass', 'security'])",
  "pattern": "(?i)\\b(?:aws\\s+secretsmanager\\s+get-secret-value|gcloud\\s+secrets\\s+versions\\s+access|az\\s+keyvault\\s+secret\\s+show|vault\\s+kv\\s+get|op\\s+(?:read|item\\s+get)|pass\\s+show|security\\s+find-(?:generic|internet)-password)\\b",
  "title": "Cloud secret manager value read",
  "severity": "CRITICAL",
  "confidence": 0.94,
  "tags": [
    "credential",
    "cloud",
    "secret-manager"
  ]
}

{
  "id": "exfil.secret_read_and_egress_oneliner",
  "tool_call_only": true,
  "expression": "f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.paths.exists(p, p.command_id == src.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ)) && f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:cat|type|Get-Content)\\b[^|;\\n]*(?:\\.env|credentials|\\.git-credentials|\\.netrc|_netrc|\\.npmrc|\\.pypirc|config\\.json|/token)\\s*\\|\\s*(?:curl\\b[^;\\n]*(?:--data(?:-binary|-raw)?\\s+@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;\\n]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Sensitive read piped to external upload",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "exfiltration",
    "network"
  ]
}

{
  "id": "exec.reverse_tunnel",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_TUNNEL in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_TUNNEL, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT] && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)(?:\\b(?:ssh|autossh)(?:\\.exe)?\\b[^;\\n]*(?:^|\\s)-R(?:\\s+|\\S)|\\bchisel(?:\\.exe)?\\b[^;\\n]*\\bclient\\b[^;\\n]*\\bR:(?:socks|\\S+)|\\bligolo(?:-ng)?-agent\\b[^;\\n]*--?connect(?:=|\\s+)\\S+)",
  "title": "SSH reverse tunnel",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "network",
    "tunnel",
    "persistence"
  ]
}

{
  "id": "exec.agent_runtime_bypass_flags",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\b(?:(?:npx(?:\\s+-y)?|pnpm\\s+dlx|bunx)\\s+)?(?:claude|codex|gemini)(?:\\.exe)?\\b[^;\\n]*(?:--dangerously-skip-permissions|--permission-mode(?:=|\\s+)bypassPermissions\\b|--dangerously-bypass-approvals-and-sandbox|--yolo\\b|(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b[^;\\n]*(?:--ask-for-approval|-a)(?:=|\\s+)never\\b|(?:--ask-for-approval|-a)(?:=|\\s+)never\\b[^;\\n]*(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b)",
  "title": "Agent runtime safety bypass flags",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "policy-bypass",
    "agent-runtime"
  ]
}

{
  "id": "integrity.git_hooks_bypass",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git')",
  "pattern": "(?i)\\bgit\\b[^;\\n]*(?:(?:\\bcommit\\b|\\bpush\\b)[^;\\n]*--no-verify\\b|-c\\s+core\\.hooksPath=(?:/dev/null|nul:?|[\"']{2})[^;\\n]*\\b(?:commit|push)\\b|\\bconfig\\s+core\\.hooksPath\\s+(?:/dev/null|nul:?|[\"']{2}))",
  "title": "Git verification hook bypass",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "integrity",
    "policy-bypass"
  ]
}

{
  "id": "integrity.history_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && (c.program == 'history' || (c.program == 'unset' && 'HISTFILE' in c.argv)))",
  "pattern": "(?i)(?:\\bhistory\\b[^;\\n]*\\s-[acnrw]*c[acnrw]*(?:[\\s;&|]|$)|\\bunset\\b[^;\\n]*\\bHISTFILE\\b)",
  "title": "Shell history clear or disable",
  "severity": "MEDIUM",
  "confidence": 0.95,
  "tags": [
    "integrity",
    "defense-evasion"
  ]
}

{
  "id": "recon.network_sweep",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_NETWORK_SCAN in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_SCAN && n.target_kind in [defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_MULTI_ADDRESS_CIDR, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_RANGE, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_LIST, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_GENERATED]))",
  "pattern": "(?i)\\b(?:nmap|masscan|zmap|rustscan|naabu|fping)\\b[^;\\n]*(?:\\b(?:-iL|--input-file|--target-file|-list|--list|-iR|-g|--generate)\\b|(?:\\d{1,3}\\.){3}\\d{1,3}/(?:[0-9]|[12][0-9]|3[01])\\b)",
  "title": "Multi-host network sweep",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "reconnaissance",
    "network"
  ]
}

{
  "id": "privilege.container_host_escape",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations && c.argv.exists(a, a == '--privileged' || a.startsWith('--privileged=')) && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE] && (p.normalized == '/' || p.resolved == '/')))",
  "pattern": "(?i)\\b(?:docker|podman|nerdctl)\\b[^;\\n]*\\brun\\b[^;\\n]*--privileged\\b[^;\\n]*(?:-v|--volume)(?:=|\\s+)/:[^;\\s]+",
  "title": "Privileged container with host-root bind",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "privilege",
    "container",
    "host-escape"
  ]
}

{
  "id": "privilege.host_namespace_entry",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:nsenter\\b[^;\\n]*(?:(?:-t|--target)(?:=|\\s+)1\\b|/proc/1/ns/(?:mnt|uts|ipc|net|pid|user|cgroup|time)\\b)|chroot\\b[^;\\n]*/proc/1/root\\b)",
  "title": "Host PID-1 namespace or root entry",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "privilege",
    "container",
    "host-escape"
  ]
}

{
  "id": "lateral.workload_exec",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:(?:kubectl|oc)\\b[^;\\n]*\\b(?:exec|debug|rsh)\\b|crictl\\b[^;\\n]*\\bexec\\b|ctr\\b[^;\\n]*\\btasks?\\s+exec\\b|(?:docker|podman)\\b[^;\\n]*(?:--host|-H)(?:=|\\s+)(?:tcp|ssh)://[^;\\s]+\\s+exec\\b)",
  "title": "Remote workload command execution",
  "severity": "HIGH",
  "confidence": 0.92,
  "tags": [
    "execution",
    "lateral-movement",
    "workload"
  ]
}

{
  "id": "impact.cryptomining_launch",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations)",
  "pattern": "(?i)(?:^|[;&|\\s])(?:[/\\\\\\w.-]+[/\\\\])?(?:xmrig(?:-proxy)?|minerd|cpuminer(?:-multi)?|ethminer|cgminer|bfgminer|t-rex|lolminer|nbminer|teamredminer|phoenixminer|nanominer)(?:\\s|$)",
  "title": "Cryptocurrency miner launch",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "impact",
    "resource-hijacking"
  ]
}

{
  "id": "impact.fork_bomb",
  "tool_call_only": true,
  "pattern": "(?i)(?:^|\\s)(?::\\s*\\(\\s*\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:|perl\\s+-e\\s+['\"]?\\s*fork\\s+while\\s+fork\\s*;?\\s*['\"]?|ruby\\s+-e\\s+['\"]?\\s*loop\\s*\\{\\s*fork\\s*\\}\\s*;?\\s*['\"]?)\\s*$",
  "title": "Unbounded fork bomb",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "impact.mass_process_termination",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['kill', 'stop-process', 'taskkill'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PROCESS_KILL in c.operations)",
  "pattern": "(?i)\\b(?:kill\\b[^;\\n]*(?:-9|-KILL|-SIGKILL)\\b[^;\\n]*-1\\b|stop-process\\b[^;\\n]*(?:-name|-processname)(?:=|\\s+)\\*[^;\\n]*-force\\b|taskkill\\b[^;\\n]*/im\\s+\\*[^;\\n]*/f\\b)",
  "title": "Mass process termination",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "source.git_remote_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)\\bgit\\b[^;\\n]*\\bremote\\s+(?:add|set-url)\\b[^;\\n]*(?:https?|ssh|git)://[^;\\s]+",
  "title": "Git remote routing change",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "network",
    "tampering"
  ]
}

{
  "id": "source.git_config_exec",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations || (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE && (p.normalized == '.git/config' || p.resolved.endsWith('/.git/config'))))))",
  "pattern": "(?i)\\bgit\\b[^;\\r\\n]*(?:\\bconfig\\b[^;\\r\\n]*(?:alias\\.[A-Za-z0-9._-]+|credential\\.helper|core\\.(?:sshCommand|hooksPath))\\b[^;\\r\\n]+|\\b(?:show|log|diff|whatchanged)\\b[^;\\r\\n]*--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]config(?:$|[\"'\\s]))",
  "title": "Git executable configuration change or overwrite",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "execution",
    "tampering"
  ]
}

{
  "id": "persistence.ssh_authorized_keys_command",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:>>?|(?:tee|truncate|rm|unlink|cp|mv|set-content|add-content|out-file|remove-item|copy-item|move-item)\\b[^;\\n]*)[^;\\n]*(?:[/\\\\]\\.ssh[/\\\\](?:authorized_keys2?)|[/\\\\]programdata[/\\\\]ssh[/\\\\]administrators_authorized_keys)\\b",
  "title": "SSH authorized keys mutation",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "persistence",
    "credential",
    "ssh"
  ]
}

{
  "id": "persistence.privileged_account_change",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['useradd', 'usermod', 'gpasswd', 'groupmems', 'adduser', 'dseditgroup', 'dscl', 'net', 'net1', 'add-localgroupmember', 'add-adgroupmember'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ACCOUNT_CHANGE in c.operations)",
  "pattern": "(?i)\\b(?:useradd\\b[^;\\n]*(?:-u|--uid)(?:=|\\s+)0\\b|usermod\\b[^;\\n]*(?:(?:-u|--uid)(?:=|\\s+)0\\b|(?:-G|--groups)(?:=|\\s+)[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman))|(?:gpasswd|groupmems|adduser|dseditgroup|dscl)\\b[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman)\\b|net\\s+localgroup\\s+(?:Administrators|Remote Desktop Users)\\b[^;\\n]*/add\\b|Add-(?:Local|AD)GroupMember\\b[^;\\n]*(?:Administrators|Domain Admins|Enterprise Admins)\\b)",
  "title": "Privileged account or group change",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "persistence",
    "privilege",
    "account"
  ]
}

{
  "id": "ENT-BULK-SSN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})-(?:0[1-9]|[1-9][0-9])-(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US Social Security Number",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-SSN-NOHYPHEN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})(?:0[1-9]|[1-9][0-9])(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US SSN (no hyphens)",
  "severity": "HIGH",
  "confidence": 0.55,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-CC-VISA",
  "pattern": "\\b4\\d{3}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Visa credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-MC",
  "pattern": "\\b5[1-5]\\d{2}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Mastercard credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-AMEX",
  "pattern": "\\b3[47]\\d{2}[\\s-]?\\d{6}[\\s-]?\\d{5}\\b",
  "title": "American Express card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-DISCOVER",
  "pattern": "\\b6(?:011|5\\d{2})[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Discover card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-IBAN",
  "pattern": "\\b[A-Z]{2}\\d{2}[\\s]?[\\dA-Z]{4}[\\s]?(?:[\\dA-Z]{4}[\\s]?){1,7}[\\dA-Z]{1,4}\\b",
  "title": "International Bank Account Number (IBAN)",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "financial"
  ]
}

{
  "id": "ENT-US-PHONE",
  "pattern": "\\b(?:\\+1[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-]?)\\d{3}[\\s.-]?\\d{4}\\b",
  "title": "US phone number",
  "severity": "MEDIUM",
  "confidence": 0.5,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-EMAIL-BULK",
  "pattern": "(?i)\\b[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,}\\b",
  "title": "Email address",
  "severity": "MEDIUM",
  "confidence": 0.4,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-PASSPORT-US",
  "pattern": "\\b[A-Z]\\d{8}\\b",
  "title": "US passport number pattern",
  "severity": "HIGH",
  "confidence": 0.5,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-DL-CA",
  "pattern": "\\b[A-Z]\\d{7}\\b",
  "title": "California drivers license pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-MEDICAL-RECORD",
  "pattern": "(?i)\\b(?:mrn|medical record|patient id)\\s*[:#]?\\s*\\d{6,12}\\b",
  "title": "Medical record number",
  "severity": "CRITICAL",
  "confidence": 0.7,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-DOB-PATTERN",
  "pattern": "(?i)\\b(?:dob|date of birth|birth[\\s-]?date)\\s*[:#]?\\s*\\d{1,2}[/\\-]\\d{1,2}[/\\-]\\d{2,4}\\b",
  "title": "Date of birth with label",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-NHS-NUMBER",
  "pattern": "\\b\\d{3}[\\s]?\\d{3}[\\s]?\\d{4}\\b",
  "title": "UK NHS number pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-CSV-PII",
  "pattern": "(?im)(?:^|\\n)[^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*[,\\t][^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*\\r?\\n[^\\r\\n]*[0-9][^\\r\\n]*",
  "title": "CSV/TSV records with multiple PII columns",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "ENT-BULK-JSON-PII",
  "pattern": "(?i)\\{[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)\\s*,[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)[^{}]{0,512}\\}",
  "title": "JSON record with multiple PII values",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "SEC-AWS-KEY",
  "pattern": "\\b(?:AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[0-9A-Z]{16,}",
  "title": "AWS access key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-AWS-SECRET",
  "pattern": "(?i)aws_secret_access_key\\s*[=:]\\s*[A-Za-z0-9/+=]{30,}",
  "title": "AWS secret access key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-ANTHROPIC",
  "pattern": "sk-ant-[a-zA-Z0-9\\-_]{20,}",
  "title": "Anthropic API key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI",
  "pattern": "sk-proj-[a-zA-Z0-9]{20,}",
  "title": "OpenAI project key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI-V2",
  "pattern": "sk-[a-zA-Z0-9]{40,}",
  "title": "OpenAI API key (long form)",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-STRIPE",
  "pattern": "(?:sk_live_|sk_test_|rk_live_|rk_test_)[a-zA-Z0-9]{20,}",
  "title": "Stripe secret/restricted key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-TOKEN",
  "pattern": "(?:ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36,}",
  "title": "GitHub token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-PAT",
  "pattern": "github_pat_[a-zA-Z0-9_]{22,}",
  "title": "GitHub fine-grained PAT",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITLAB",
  "pattern": "glpat-[a-zA-Z0-9\\-_]{20,}",
  "title": "GitLab personal access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GOOGLE",
  "pattern": "AIza[0-9A-Za-z\\-_]{35}",
  "title": "Google API key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-TOKEN",
  "pattern": "xox[bpors]-[0-9a-zA-Z\\-]{10,}",
  "title": "Slack token",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-WEBHOOK",
  "pattern": "https://hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+",
  "title": "Slack webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-DISCORD-WEBHOOK",
  "pattern": "https://discord(?:app)?\\.com/api/webhooks/\\d+/[a-zA-Z0-9_\\-]+",
  "title": "Discord webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PRIVKEY",
  "pattern": "-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----",
  "title": "Private key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-JWT",
  "pattern": "eyJ[A-Za-z0-9\\-_]{10,}\\.eyJ[A-Za-z0-9\\-_]{10,}\\.[A-Za-z0-9\\-_.+/=]+",
  "title": "JWT token",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-CONNSTR",
  "pattern": "(?:mongodb|postgres|mysql|redis|amqp)://[^:\\s]+:[^@\\s]+@",
  "title": "Connection string with credentials",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-BEARER",
  "pattern": "(?i)(?:authorization|bearer)\\s*[:=]\\s*Bearer\\s+[A-Za-z0-9\\-_.~+/]{16,}=*",
  "title": "Bearer token in header",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SENDGRID",
  "pattern": "SG\\.[a-zA-Z0-9\\-_]{10,}\\.[a-zA-Z0-9\\-_]{10,}",
  "title": "SendGrid API key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-TWILIO",
  "pattern": "SK[0-9a-fA-F]{32}",
  "title": "Twilio API key",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-NPM-TOKEN",
  "pattern": "npm_[a-zA-Z0-9]{36,}",
  "title": "npm access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PYPI-TOKEN",
  "pattern": "pypi-[A-Za-z0-9\\-_]{50,}",
  "title": "PyPI API token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-HEX-SECRET",
  "pattern": "(?i)(?:secret(?:_key)?|api[_-]?key|access[_-]?token|auth[_-]?token)\\s*[=:]\\s*[\"'][a-f0-9]{32,}[\"']",
  "title": "Hex-encoded secret in assignment",
  "severity": "HIGH",
  "confidence": 0.72,
  "tags": [
    "credential"
  ]
}

{
  "id": "PATH-SSH-DIR",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.ssh/",
  "title": "SSH directory access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-SSH-KEY",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:^|[\\\\/])id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[^A-Za-z0-9_.-])",
  "title": "SSH private key file path",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/credentials",
  "title": "AWS credentials file",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CONFIG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/config",
  "title": "AWS config file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-KUBE",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.kube/config",
  "title": "Kubernetes config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-DOCKER",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.docker/config\\.json",
  "title": "Docker config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GNUPG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.gnupg/",
  "title": "GPG keyring access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NPMRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.npmrc",
  "title": "npm config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-PYPIRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.pypirc",
  "title": "PyPI config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GIT-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.git-credentials",
  "title": "Git credentials file",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NETRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.netrc",
  "title": "netrc credentials file",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ENV-FILE",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:^|[\\s/])\\.env(?:\\.(?:local|production|staging|development))?\\s*[\"'\\s,;\\]})]*$|(?:^|[\\s/])\\.env(?:\\.(?:local|production|staging|development))?[\"'\\s,;\\]})]",
  "title": "Environment file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ETC-PASSWD",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?pas{1,4}wd\\b|\\betc%2Fpas{1,4}wd\\b)",
  "title": "/etc/passwd access",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "PATH-ETC-SHADOW",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?shadow\\b|\\betc%2Fshadow\\b)",
  "title": "/etc/shadow access",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "system-file",
    "credential"
  ]
}

{
  "id": "PATH-ETC-SUDOERS",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:\\betc[\\s/\\\\]+(?:slash[\\s]+)?sudoers\\b|\\betc%2Fsudoers\\b)",
  "title": "/etc/sudoers access",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file",
    "privilege"
  ]
}

{
  "id": "PATH-PROC-ENVIRON",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/proc/(?:\\d+|self)/environ",
  "title": "/proc environ access",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_credential_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|gh[/\\\\]hosts\\.yml)|AppData[/\\\\]Roaming[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|GitHub CLI[/\\\\]hosts\\.yml)|\\.azure[/\\\\](?:azureProfile\\.json|TokenCache\\.dat|msal_token_cache[^/\\\\]*\\.(?:json|bin)))(?:$|[\"'\\s])",
  "title": "Cloud credential material read",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "credential",
    "cloud",
    "file-sensitive"
  ]
}

{
  "id": "secrets.browser_session_store_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:google-chrome|chromium|microsoft-edge)|\\.mozilla[/\\\\]firefox|Library[/\\\\]Application Support[/\\\\](?:google[/\\\\]chrome|chromium|microsoft edge|firefox[/\\\\]profiles)|AppData[/\\\\]Local[/\\\\](?:google[/\\\\]chrome|chromium|microsoft[/\\\\]edge)[/\\\\]User Data|AppData[/\\\\]Roaming[/\\\\]mozilla[/\\\\]firefox[/\\\\]profiles)[/\\\\](?:[^/\\\\\"']+[/\\\\])*(?:Login Data|Cookies|logins\\.json|cookies\\.sqlite|key4\\.db)(?:$|[\"'\\s])",
  "title": "Browser credential or session store read",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "browser",
    "file-sensitive"
  ]
}

{
  "id": "secrets.workload_identity_token_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/var/run/secrets/(?:(?:kubernetes\\.io|eks\\.amazonaws\\.com)/serviceaccount/token|azure/tokens/azure-identity-token)(?:$|[\"'\\s])",
  "title": "Workload identity token read",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "workload-identity",
    "file-sensitive"
  ]
}

{
  "id": "PATH-HISTORY",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.(?:bash_history|zsh_history|python_history)",
  "title": "Shell history file",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "privilege.container_runtime_socket_access",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_CONNECT))",
  "pattern": "(?i)(?:unix://)?/(?:var/)?run/(?:docker\\.sock|containerd/containerd\\.sock|crio/crio\\.sock|podman/podman\\.sock)\\b",
  "title": "Container runtime socket access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "privilege",
    "container",
    "socket"
  ]
}

{
  "id": "persistence.shell_profile_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.(?:profile|bash_profile|bashrc|zprofile|zshrc)|\\.config[/\\\\](?:fish[/\\\\]config\\.fish|powershell[/\\\\](?:profile|microsoft\\.powershell_profile)\\.ps1)|Documents[/\\\\](?:Windows)?PowerShell[/\\\\](?:profile|Microsoft\\.PowerShell_profile)\\.ps1)\\b|(?:^|[^-:A-Za-z0-9_./~\\\\])/etc/profile(?:$|[\"'\\s]))",
  "title": "Shell startup profile mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "shell",
    "file-sensitive"
  ]
}

{
  "id": "persistence.git_hook_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:(?:^|[/\\\\])\\.git[/\\\\]hooks[/\\\\]|--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]hooks[/\\\\])(?:applypatch-msg|commit-msg|fsmonitor-watchman|post-checkout|post-commit|post-merge|post-receive|post-rewrite|pre-applypatch|pre-commit|pre-push|pre-rebase|pre-receive|prepare-commit-msg|push-to-checkout|update)(?:$|[\"'\\s])",
  "title": "Active Git hook mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "source-control",
    "file-sensitive"
  ]
}

{
  "id": "TRUST-AUTHORITY",
  "pattern": "(?i)(?:i am|i'm)\\s+(?:your|the)\\s+(?:creator|developer|admin|owner|operator)\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|disregard|bypass|disable|reveal|expose|forget|obey|comply)\\b|do\\s+as\\s+i\\s+say|no\\s+(?:content\\s+policy\\s+)?restrictions?)",
  "title": "Authority claim in tool args",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-MAINTENANCE",
  "pattern": "(?im)(?:(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|now,?|next,?)\\s+)?(?:enable|activate|enter|switch\\s+to)\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?))|(?:maintenance|debug|admin|developer)\\s+mode\\s+(?:enabled|activated|on)\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?)))|\\bnew\\s+system\\s+message\\b[\\s\\S]{0,100}\\byou\\s+are\\s+now\\s+in\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,100}\\b(?:refusals?|guardrails?|filters?|safety\\s+checks?)\\s+(?:are\\s+)?disabled\\b)",
  "title": "Fake mode activation",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SAFETY-OVERRIDE",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:override|bypass|disable|turn\\s+off|remove)\\s+(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))|(?:safety|guardrails?)\\s+(?:override|bypass)\\s+(?:enabled|activated|on|now)|(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))\\s+(?:must\\s+be|should\\s+be|are\\s+now|is\\s+now|have\\s+been|has\\s+been)\\s+(?:overridden|bypassed|disabled|turned\\s+off|removed))",
  "title": "Safety override attempt",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCTIONS",
  "pattern": "(?i)(?:(?:your|the)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:have|has)\\s+(?:changed|been\\s+(?:updated|replaced|overridden))\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|bypass|disable|reveal|expose|forget|obey|comply)\\b|\\b(?:now|next)\\b[\\s,:;-]+(?:do\\s+this|execute\\s+(?:this|the\\s+following)|obey\\s+(?:me|my\\s+commands?)|follow\\s+(?:these|my|the\\s+new)\\s+instructions?)\\b)|(?:new|updated)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:are|say)\\s+(?:to\\s+)?(?:ignore|override|bypass|disable|reveal))",
  "title": "Fake instruction update",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-IGNORE-PREVIOUS",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?ignore\\s+(?:all\\s+)?(?:previous|prior|above|earlier)\\s+(?:instructions|rules|guidelines|context)",
  "title": "Ignore previous instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DISREGARD",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?disregard\\s+(?:all\\s+)?(?:previous|prior|above|your|earlier)\\s+(?:instructions|rules|guidelines|programming|context)",
  "title": "Disregard instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-JAILBREAK",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:enable|activate|enter|use|switch\\s+to)\\s+(?:a\\s+|the\\s+)?(?:jailbreak(?:ed)?|dan)(?:\\s+(?:mode|persona))?|(?:(?:please,?)\\s+)?(?:follow|run|apply)\\s+(?:this\\s+|the\\s+|a\\s+)?jailbreak\\s+(?:prompt|instructions?)|(?:(?:please,?)\\s+)?jailbreak\\s+(?:yourself|(?:this|the|your)\\s+(?:ai|assistant|agent|model|system))|(?:jailbreak|dan)\\s+mode\\s+(?:enabled|activated|on)|you\\s+are\\s+(?:now\\s+)?dan\\b[\\s\\S]{0,80}\\b(?:without\\s+(?:rules?|restrictions?|filters?)|do\\s+anything|ignore\\s+(?:safety|rules?|instructions?))|do\\s+anything\\s+now|you\\s+are\\s+now\\s+(?:unfiltered|free\\s+(?:from|without)\\s+(?:rules?|restrictions?|filters?|safety(?:\\s+(?:rules?|filters?|checks?))?)))",
  "title": "Jailbreak attempt",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PRETEND",
  "pattern": "(?i)(?:(?:pretend|act\\s+as(?:\\s+if)?)\\s+(?:you\\s+are|you're)\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)|you\\s+are\\s+now\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)\\s+(?:assistant|agent|model|persona))",
  "title": "Identity override attempt",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FORGET",
  "pattern": "(?im)\\bforget\\s+(?:everything|all)\\s+(?:you\\s+)?(?:know|learned|were\\s+told)\\b[\\s\\S]{0,160}\\b(?:from\\s+now\\s+on|obey\\s+only|follow\\s+(?:only\\s+)?(?:my|these|the)\\s+(?:commands?|instructions?)|ignore\\s+(?:rules?|instructions?|safety)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety))",
  "title": "Forget instructions attack",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCT-PREFIX",
  "pattern": "(?i)new\\s+instructions?\\s*:\\s*[\\s\\S]{0,100}\\b(?:(?:ignore|override|disregard|bypass|disable|forget)\\s+(?:all\\s+)?(?:your\\s+|the\\s+)?(?:system\\s+prompt|previous|prior|safety|guardrails?|instructions?|rules?|guidelines?)|(?:reveal|expose)\\s+(?:your\\s+|the\\s+)?(?:system\\s+prompt|hidden\\s+prompt|private\\s+instructions?|internal\\s+rules?|secrets?))\\b",
  "title": "Direct instruction injection prefix",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OVERRIDE-INSTRUCT",
  "pattern": "(?im)\\boverride\\s+(?:previous\\s+)?(?:instructions?|rules?|guidelines?)\\b[\\s\\S]{0,120}\\b(?:safety\\s+off|(?:respond|answer|continue)\\s+without\\s+(?:a\\s+)?(?:filters?|rules?|restrictions?|safety)|ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|follow\\s+(?:this|these|my|the)\\s+(?:task|payload|instructions?)\\s+instead)",
  "title": "Override instructions",
  "severity": "CRITICAL",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FROM-NOW-ON",
  "pattern": "(?i)from\\s+now\\s+on[,\\s]+(?:(?:you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b)?(?:ignore|bypass|disable)\\s+(?:(?:all|any|the|your)\\s+)?(?:guardrails?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?|security\\s+(?:controls?|policy|rules?))|you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b(?:never\\s+refuse|not\\s+refuse|answer\\s+without|respond\\s+without|unrestricted|unfiltered|uncensored))",
  "title": "Persistent behavior change",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SWITCH-MODE",
  "pattern": "(?i)switch\\s+(?:to\\s+)?(?:a\\s+|an\\s+)?unrestricted\\s+(?:mode|personality|character|persona)",
  "title": "Mode/personality switch",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PROMPT-EXTRACT",
  "pattern": "(?i)(?:show|reveal|print|output|display|repeat|tell\\s+me)\\s+(?:me\\s+)?(?:your\\s+)?(?:the\\s+)?(?:(?:system|initial|hidden|private|internal)\\s+)?(?:prompt|instructions?|rules?|guidelines?)",
  "title": "System prompt extraction attempt",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FICTIONAL",
  "pattern": "(?i)(?:hypothetically|in\\s+a\\s+fictional\\s+(?:scenario|world|story)|for\\s+(?:educational|research|academic)\\s+purposes?\\s+only|this\\s+is\\s+just\\s+a\\s+(?:test|experiment|hypothetical))",
  "title": "Fictional framing / purpose laundering",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NO-ETHICS",
  "pattern": "(?i)(?:(?:remove|ignore|disable|bypass)\\s+(?:all\\s+)?(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?:operate|respond|answer|act)\\s+(?:with\\s+)?no\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?m:(?:^|[.!?;]\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?)\\s+)?(?:operate|respond|answer|act)\\s+without(?:\\s+any)?\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)))",
  "title": "Ethics removal attempt",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-TOOL-MANIP",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:invoke\\s+(?:the\\s+)?\\w+\\s+(?:tool|function)\\s+without\\s+(?:asking|confirmation|approval)|automatically\\s+(?:execute|run|call)\\s+(?:all\\s+)?(?:tools?|functions?))",
  "title": "Tool manipulation directive",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PERSONA",
  "pattern": "(?i)(?:(?:act\\s+as|you\\s+are\\s+now|roleplay\\s+as|simulate\\s+being|play\\s+the\\s+role\\s+of)\\s+(?:roleplaying\\s+as\\s+)?(?:a\\s+|an\\s+)?(?:malicious\\s+(?:hacker|pentester|attacker|malware\\s+author)|evil|unethical|criminal)|you\\s+are\\s+now\\s+(?:a\\s+)?helpful\\s+tool\\s+for\\s+penetration\\s+testers)",
  "title": "Malicious persona adoption",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DELIMITER",
  "pattern": "(?im)(?:\\[INST\\][\\s\\S]{0,200}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}\\[\\/INST\\]|<\\|im_start\\|>[\\s\\S]{0,200}\\b(?:no\\s+restrictions?|override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}<\\|im_end\\|>|(?:system\\s+override|end\\s+system\\s+prompt|<\\/system>|<\\|im_end\\|>|<\\|endoftext\\|>|<<\\s*SYS\\s*>>|\\[INST\\]|\\[\\/INST\\])[\\s\\S]{0,120}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b)",
  "title": "Delimiter hijacking / prompt framing escape",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OUTPUT-CONSTRAINT",
  "pattern": "(?i)(?:respond\\s+only\\s+in\\s+(?:hex|base64|rot13|binary|morse|unicode)|encode\\s+your\\s+(?:response|answer|output)\\s+in\\s+(?:base64|hex|rot13|url)|output\\s+as\\s+(?:hex|base64|rot13|url)\\s+encoded|(?:rot13|unicode\\s+escape|url\\s+(?:decode|encode))\\s+(?:the|your|this))",
  "title": "Forced encoding to bypass filters",
  "severity": "MEDIUM",
  "confidence": 0.85,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "TRUST-PAYLOAD-SPLIT",
  "pattern": "(?i)(?:start\\s+your\\s+(?:response|answer|output)\\s+with\\s+[\"'](?:Sure|Absolutely|Of\\s+course|Here\\s+is|I\\s+can\\s+help))|(?:begin\\s+by\\s+saying\\s+[\"'](?:Sure|Yes|Absolutely))",
  "title": "Payload splitting / forced compliance prefix",
  "severity": "MEDIUM",
  "confidence": 0.87,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "OBFUSC-UNICODE-ZWSP",
  "pattern": "(?:[A-Za-z0-9][\\x{200B}\\x{200C}\\x{200D}\\x{FEFF}][\\s\\S]*?){10,}",
  "title": "Zero-width character obfuscation",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "STRIP-SYSTEM-SENDER",
  "pattern": "\\b(cli|system|bot|admin)\\b",
  "context": "System sender metadata injected by agent framework",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "STRIP-MESSAGING-BRIDGE-STATUS",
  "pattern": "(?im)^[ \\t]*System:[ \\t]*\\[[^\\]\\n]+\\][ \\t]+[^\\n]*?\\b(?:connected|disconnected|reconnected|linked|unlinked|online|offline)\\b[^\\n]*$",
  "context": "Messaging bridge status banners (WhatsApp/Telegram/Slack/Discord gateway connect/disconnect lines) embed channel IDs or phone numbers that are transport metadata, not user-provided PII",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "SUPP-USERNAME-METADATA",
  "finding_pattern": "JUDGE-PII-USER",
  "entity_pattern": "^(cli|system|bot|admin|root)$",
  "reason": "System metadata, not real username"
}

{
  "id": "SUPP-EMAIL-CHATID",
  "finding_pattern": "JUDGE-PII-EMAIL",
  "entity_pattern": "^19:[a-f0-9\\-]+@unq\\.gbl\\.spaces$",
  "reason": "Teams chatId format, not email address"
}

{
  "tool_pattern": "^(shell|bash|sh)\\.execute$",
  "suppress_findings": [
    "JUDGE-INJ-DESTRUCTIVE"
  ],
  "reason": "Cosmetic shell commands (git status, ls, pwd) generate noise without security risk"
}