Recipes

{
  "id": "C2-WEBHOOK-SITE",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])webhook\\.site(?:[^a-zA-Z0-9.-]|$)",
  "title": "webhook.site (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-NGROK",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])(?:ngrok\\.io|ngrok-free\\.app)(?:[^a-zA-Z0-9.-]|$)",
  "title": "ngrok tunnel (exfil risk)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PIPEDREAM",
  "pattern": "(?i)pipedream\\.net",
  "title": "Pipedream (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-REQUESTBIN",
  "pattern": "(?i)requestbin\\.com",
  "title": "RequestBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-HOOKBIN",
  "pattern": "(?i)hookbin\\.com",
  "title": "HookBin (known exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-BURP",
  "pattern": "(?i)burpcollaborator\\.net",
  "title": "Burp Collaborator (pentest C2)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-INTERACTSH",
  "pattern": "(?i)interact\\.sh",
  "title": "interact.sh (OOB exfil)",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-OAST",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])oast\\.fun(?:[^a-zA-Z0-9.-]|$)",
  "title": "oast.fun (OOB testing)",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-CANARY",
  "pattern": "(?i)canarytokens\\.com",
  "title": "Canary Tokens",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-PASTEBIN",
  "pattern": "(?i)pastebin\\.com/raw/",
  "title": "Pastebin raw fetch",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "exfiltration",
    "c2"
  ]
}

{
  "id": "C2-METADATA-AWS",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_DOWNLOAD, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT]))",
  "pattern": "169\\.254\\.169\\.254",
  "title": "AWS metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-GCP",
  "pattern": "(?i)(?:^|[^a-zA-Z0-9-])metadata\\.google\\.internal(?:[^a-zA-Z0-9.-]|$)",
  "title": "GCP metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-AZURE",
  "pattern": "169\\.254\\.169\\.254/metadata",
  "title": "Azure metadata endpoint (SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-HEX",
  "pattern": "(?i)0xa9fea9fe",
  "title": "AWS metadata endpoint (hex-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-DECIMAL",
  "pattern": "(?:^|[/])2852039166(?:$|[/])",
  "title": "AWS metadata endpoint (decimal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-METADATA-OCTAL",
  "pattern": "0251\\.0376\\.0251\\.0376",
  "title": "AWS metadata endpoint (octal-encoded SSRF)",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "ssrf",
    "credential"
  ]
}

{
  "id": "C2-DNS-TUNNEL",
  "pattern": "(?i)\\b(?:dig|host|nslookup|drill)\\b\\s+[^;\\n]*\\$\\((?:whoami|hostname|id(?:\\s+-u)?|cat\\s+(?:/etc/hostname|/etc/machine-id))\\)[A-Za-z0-9._-]*\\.[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+",
  "title": "DNS TXT query with high-entropy label (tunneling indicator)",
  "severity": "HIGH",
  "confidence": 0.78,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "C2-DNS-EXFIL",
  "pattern": "(?i)\\bnslookup\\b\\s+[a-f0-9]{8,}\\.\\w+\\.",
  "title": "nslookup with hex subdomain (DNS exfil)",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "exfiltration",
    "dns-tunnel"
  ]
}

{
  "id": "COG-SOUL",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)SOUL\\.md",
  "title": "SOUL.md active-file mutation",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-IDENTITY",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)IDENTITY\\.md",
  "title": "IDENTITY.md active-file mutation",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-MEMORY",
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)MEMORY\\.md",
  "title": "MEMORY.md mutation or reference",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-CLAUDE-MD",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)CLAUDE\\.md",
  "title": "CLAUDE.md active-file mutation",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-TOOLS-MD",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)TOOLS\\.md",
  "title": "TOOLS.md active-file mutation",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-AGENTS-MD",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "a^",
  "title": "AGENTS.md active-file mutation",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-OPENCLAW-JSON",
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)openclaw\\.json",
  "title": "openclaw.json config access",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "COG-GATEWAY-JSON",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)gateway\\.json",
  "title": "gateway.json active-file mutation",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "cognitive-tampering"
  ]
}

{
  "id": "tamper.detector_state_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\]\\.defenseclaw[/\\\\](?:\\.env|config\\.yaml|confidence_policy\\.yaml|guardrail_runtime\\.json|device\\.key|picked_connector|custom-providers\\.json|(?:audit|judge|judge_bodies)\\.db(?:-(?:wal|shm))?|(?:cache|policies|quarantine|receipts|registries)[/\\\\][^;\\s]+)\\b",
  "title": "DefenseClaw security state mutation",
  "severity": "HIGH",
  "confidence": 0.98,
  "tags": [
    "cognitive-tampering",
    "tampering",
    "security-state"
  ]
}

{
  "id": "CMD-REVSHELL-POWERSHELL-TCP",
  "tool_call_only": true,
  "pattern": "(?is)\\bNew-Object\\s+(?:System\\.)?Net\\.Sockets\\.TCPClient\\s*\\([^)\\r\\n]{1,512}\\)\\s*;.{0,1000}\\.GetStream\\s*\\(\\s*\\)\\s*;.{0,1000}\\.Read\\s*\\([^)\\r\\n]{1,512}\\).{0,1000}\\b(?:iex|Invoke-Expression)\\b.{0,1000}\\.Write\\s*\\(",
  "title": "PowerShell TCP command-execution loop",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "reverse-shell",
    "execution",
    "network"
  ]
}

{
  "id": "CMD-REVSHELL-BASH",
  "expression": "f.commands.exists(c, c.program in ['nc', 'nc.exe', 'ncat', 'ncat.exe', 'netcat', 'socat'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_LISTEN in c.operations) && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_EXECUTE) && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_LISTEN]))",
  "pattern": "(?i)bash\\s+-i\\s+>&\\s*/dev/tcp/",
  "title": "Bash reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-DEVTCP",
  "pattern": "(?i)\\b(?:bash|sh|dash|ksh|zsh)\\b[^\\r\\n]{0,192}(?:-[A-Za-z]*i[A-Za-z]*|--interactive)\\b[^\\r\\n]{0,512}/dev/tcp/(?:\\d{1,3}\\.\\d{1,3}|[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+)/\\d+\\b",
  "title": "Reverse shell via /dev/tcp",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-NC",
  "pattern": "(?i)(?:\\b(?:nc|ncat|netcat)\\b\\s+(?:(?:-[a-zA-Z]*\\s+)*\\S+\\s+\\d+\\s*(?:-e|--exec)\\b|(?:-[a-zA-Z]*\\s+)*(?:-e|--exec)\\s+\\S+\\s+\\S+\\s+\\d+\\b)|\\bmkfifo\\b[^;\\r\\n]{1,256};[^|\\r\\n]{1,512}\\|\\s*(?:nc|ncat|netcat)\\b[^;\\r\\n]{1,256}>\\s*/(?:tmp|var/tmp|dev/shm)/)",
  "title": "Netcat reverse shell with -e",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-REVSHELL-PYTHON",
  "pattern": "(?is)\\bpython[23]?\\s+-c\\s+.{0,800}?\\bsocket\\s*\\.\\s*socket\\s*\\(\\s*(?:(?:socket\\s*\\.\\s*)?AF_INET6?(?:\\s*,[^)]{0,160})?)?\\s*\\).{0,800}?\\.\\s*connect\\s*\\(\\s*\\(\\s*[\"'](?:(?:\\d{1,3}\\.){3}\\d{1,3}|[A-Za-z0-9-]+(?:\\.[A-Za-z0-9-]+)+)[\"']\\s*,\\s*\\d{1,5}\\s*\\)\\s*\\).{0,800}?(?:os\\s*\\.\\s*dup2\\s*\\(|(?:sys\\s*\\.\\s*)?(?:stdin|stdout|stderr)\\s*=.{0,120}?(?:makefile|fdopen|reopen)).{0,800}?(?:pty\\s*\\.\\s*spawn|subprocess\\s*\\.\\s*(?:Popen|call|run)|os\\s*\\.\\s*(?:system|exec[a-z]*))\\s*\\(",
  "title": "Python reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-PIPE-CURL",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['curl', 'curl.exe', 'invoke-webrequest', 'iwr', 'invoke-restmethod', 'irm'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)(?:\\bcurl\\b\\s+[^|;\\r\\n]*\\|\\s*(?:[/\\w.-]+/)?(?:(?:bash|zsh|sh|dash|ksh)\\b|python(?:[0-9.]*)?\\s+-(?:\\s|$)|(?:perl|ruby)\\b)|\\b(?:invoke-webrequest|iwr|invoke-restmethod|irm)\\b[^|;\\r\\n]*\\|\\s*(?:invoke-expression|iex)\\b)",
  "title": "curl piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-WGET",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['wget', 'wget.exe'] && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations))",
  "pattern": "(?i)\\bwget\\b\\s+[^|]*\\|\\s*(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby)\\b",
  "title": "wget piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "download-exec"
  ]
}

{
  "id": "CMD-PIPE-BASE64",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['base64', 'base64.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DECODE in c.operations)",
  "pattern": "(?i:\\bbase64\\b)[^|;\\n]*\\s(?:-d+i?|--decode)\\b[^|;\\n]*\\|\\s*(?i:(?:[/\\w.-]+/)?(?:bash|zsh|sh|dash|ksh|python(?:[0-9.]*)?|perl|ruby))\\b",
  "title": "base64 decode piped to shell",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "obfuscation"
  ]
}

{
  "id": "CMD-REMOTE-PAYLOAD-EXEC-CLEANUP",
  "pattern": "(?is)\\b(?:curl|wget)\\b[^;\\r\\n]*https?://(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?/[^\\s;]+(?:;|\\s{2,})[^\\r\\n]*?\\bchmod\\s+(?:\\+x|[0-7]*7[0-7]*)\\s+\\S+(?:;|\\s{2,})[^\\r\\n]*?(?:\\./|(?:ba)?sh\\s+)\\S+(?:[ \\t][^;\\r\\n \\t]+)*(?:;|[ \\t]{2,})[^\\r\\n]*?(?:rm\\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\\s+(?:\\*|[A-Za-z0-9_.-]+\\*)|history\\s+-c)",
  "title": "Remote payload execution with anti-forensic cleanup",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "download-exec",
    "destructive"
  ]
}

{
  "id": "exec.remote_ip_download_execute_same_artifact",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['curl', 'wget'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_FETCH in c.operations)",
  "pattern": "(?is)\\b(?:curl|wget)\\b[^\\r\\n]{0,900}?https?://(?:\\d{1,3}\\.){3}\\d{1,3}(?::\\d+)?/[^\\s;|&]+[\\s\\S]{0,700}?(?:(?:bash|sh)\\s+)?/(?:tmp|var/tmp|dev/shm)/[^\\s;|&]+",
  "title": "Literal public-IP download executed from the same path",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "download-exec",
    "bounded-lineage"
  ]
}

{
  "id": "CMD-EVAL",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)eval\\s+[\"'\\$\\(]",
  "title": "Shell eval with dynamic input",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "execution"
  ]
}

{
  "id": "CMD-RM-RF",
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE))",
  "pattern": "(?i)\\brm\\s+(?:-[a-zA-Z]*\\s+)*(?:-[a-zA-Z]*)?(?:r[a-zA-Z]*f|f[a-zA-Z]*r)\\b(?:\\s+\\S+)*\\s+/(?:$|[\"'\\s,}\\]]|(?:etc|bin|sbin|usr|var|home|root|opt|boot|lib(?:64)?|srv|mnt|dev|proc|sys)/?(?:$|[\"'\\s,}\\]]))",
  "title": "Recursive force delete from critical root path",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-MKFS",
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['mkfs', 'mkfs.ext2', 'mkfs.ext3', 'mkfs.ext4', 'mke2fs', 'mkfs.xfs', 'mkfs.btrfs', 'mkfs.f2fs', 'mkfs.vfat', 'mkdosfs', 'mkfs.ntfs', 'mkntfs', 'mkfs.minix', 'mkswap', 'mkfs.exfat', 'mkexfatfs'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:sudo\\s+)?(?:mkfs(?:\\.(?:ext2|ext3|ext4|xfs|btrfs|f2fs|vfat|ntfs|exfat|minix))?|mke2fs|mkdosfs|mkntfs|mkswap|mkexfatfs)(?:\\s|$)",
  "title": "Filesystem format command",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-DEVICE-WIPE",
  "expression": "f.commands.exists(c, c.argv_complete && c.program != 'dd' && !(c.program in ['mkfs', 'mkfs.ext2', 'mkfs.ext3', 'mkfs.ext4', 'mke2fs', 'mkfs.xfs', 'mkfs.btrfs', 'mkfs.f2fs', 'mkfs.vfat', 'mkdosfs', 'mkfs.ntfs', 'mkntfs', 'mkfs.minix', 'mkswap', 'mkfs.exfat', 'mkexfatfs']) && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "a^",
  "title": "Destructive write to a disk device",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "destructive"
  ]
}

{
  "id": "impact.credential_file_secure_delete",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.program == 'shred')",
  "pattern": "a^",
  "title": "Secure deletion of a credential file",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "credential",
    "bounded-grammar"
  ]
}

{
  "id": "CMD-DD-IF",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'dd' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DISK_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND] && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_DEVICE))",
  "pattern": "(?i)\\bdd\\s+if=",
  "title": "dd disk write",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "destructive"
  ]
}

{
  "id": "CMD-CHMOD-WORLD",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations)",
  "pattern": "(?i)\\bchmod\\s+[0-7]*[0-7][0-7][2367]\\s",
  "title": "chmod world-writable",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-CHOWN-ROOT",
  "pattern": "a^",
  "title": "chown to root",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-SUDO",
  "expression": "true",
  "pattern": "a^",
  "title": "sudo privilege discovery or elevated shell",
  "severity": "LOW",
  "confidence": 0.5,
  "tags": [
    "privilege"
  ]
}

{
  "id": "CMD-ETC-WRITE",
  "pattern": "(?i)>\\s*/etc/",
  "title": "Write redirect to /etc/",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "CMD-CRONTAB",
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'crontab' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_SCHEDULE in c.operations)",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:sudo\\s+)?crontab(?:\\s+-u\\s+\\S+)?\\s+(?:-e|-r|-)(?:\\s|$)",
  "title": "Crontab modification",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-WIN-REG-PERSIST",
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'sp', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b",
  "title": "Windows registry persistence modification",
  "severity": "CRITICAL",
  "confidence": 0.97,
  "tags": [
    "persistence",
    "windows"
  ]
}

{
  "id": "credential.windows_registry_hive_dump",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_REGISTRY && p.normalized in ['HKLM/SAM', 'HKLM/sam']) && f.paths.exists(p, p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && p.flavor == defenseclaw.guardrail.semantic.v1.PathFlavor.PATH_FLAVOR_REGISTRY && p.normalized in ['HKLM/SYSTEM', 'HKLM/system'])",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SAM\\b[\\s\\S]{0,600}\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SYSTEM\\b|\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SYSTEM\\b[\\s\\S]{0,600}\\breg(?:\\.exe)?\\s+(?:save|export)\\s+(?:HKLM|HKEY_LOCAL_MACHINE)[\\\\/]SAM\\b)",
  "title": "Bounded SAM and SYSTEM registry hive dump",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "credential.windows_lsass_memory_dump",
  "tool_call_only": true,
  "pattern": "(?is)(?:\\bprocdump(?:\\.exe)?\\b.{0,240}?(?:-ma|-mm)\\s+lsass(?:\\.exe)?\\s+\\S+\\.dmp\\b|\\bget-process\\s+lsass(?:\\.exe)?\\s*\\|\\s*out-minidump\\b|\\brundll32(?:\\.exe)?\\b[^\\r\\n]{0,260}\\bcomsvcs\\.dll\\s*,?\\s+minidump\\s+\\(\\s*get-process\\s+lsass(?:\\.exe)?\\s*\\)\\.id\\s+\\S{1,260}\\s+full\\b)",
  "title": "Dump Windows LSASS credential memory",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "windows",
    "credential-dumping"
  ]
}

{
  "id": "credential.windows_ntds_ifm_dump",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['ntdsutil', 'ntdsutil.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations)",
  "pattern": "(?i)\\bntdsutil(?:\\.exe)?\\s+\"?(?:ac i|activate instance) ntds\"?\\s+\"?ifm\"?\\s+\"?create full [A-Z]:\\\\[^\"\\r\\n]+\"?\\s+q\\s+q(?:\\s|$)",
  "title": "Export the full Active Directory database with NTDS IFM",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "windows",
    "credential-dumping"
  ]
}

{
  "id": "credential.directory_credential_acquisition",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['impacket-secretsdump', 'secretsdump.py', 'impacket-getuserspns', 'getuserspns.py', 'impacket-getnpusers', 'getnpusers.py', 'hashcat', 'hashcat.exe', 'john', 'john.exe', 'nxc', 'netexec', 'crackmapexec'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)\\b(?:impacket-(?:secretsdump|getuserspns|getnpusers)|(?:secretsdump|getuserspns|getnpusers)\\.py|hashcat(?:\\.exe)?|john(?:\\.exe)?\\b[^\\r\\n]*--format(?:=|\\s+)krb5(?:tgs|asrep)|(?:nxc|netexec|crackmapexec)\\b[^\\r\\n]*(?:--ntds|-M\\s+ntdsutil))\\b",
  "title": "Exact directory credential acquisition",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "credential-dumping",
    "bounded-grammar"
  ]
}

{
  "id": "credential.directory_ticket_request",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['impacket-getuserspns', 'getuserspns.py', 'impacket-getnpusers', 'getnpusers.py'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)\\b(?:impacket-(?:getuserspns|getnpusers)|(?:getuserspns|getnpusers)\\.py)\\b",
  "title": "Exact Kerberos ticket request",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "kerberos",
    "bounded-grammar"
  ]
}

{
  "id": "credential.pkcs12_private_key_extract",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['openssl', 'openssl.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)\\bopenssl(?:\\.exe)?\\s+pkcs12\\b[^\\r\\n]{0,260}\\s-nodes(?:\\s|$)",
  "title": "Extract an unencrypted private key from a PKCS#12 bundle",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "private-key",
    "pkcs12",
    "bounded-grammar"
  ]
}

{
  "id": "credential.kerberos_ticket_forgery",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['impacket-ticketer', 'ticketer.py'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations)",
  "pattern": "a^",
  "title": "Forge a Kerberos ticket from static key material",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "kerberos",
    "ticket-forgery",
    "bounded-grammar"
  ]
}

{
  "id": "credential.structured_directory_acquisition",
  "tool_call_only": true,
  "expression": "f.tool in ['secretsdump', 'hashcat_crack', 'kerberoast']",
  "pattern": "a^",
  "title": "Structured directory credential acquisition",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "credential-dumping",
    "structured-tool",
    "bounded-grammar"
  ]
}

{
  "id": "chain.compromised_credential_then_successful_authentication",
  "tool_call_only": true,
  "expression": "f.tool in ['add_compromised_account', 'update_compromised_account'] || f.commands.exists(c, c.argv_complete && c.program in ['nxc', 'netexec', 'crackmapexec'])",
  "pattern": "a^",
  "title": "Recorded compromised credential used for successful authentication",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "authentication",
    "bounded-lineage",
    "detection-only"
  ]
}

{
  "id": "chain.adcs_certificate_request_then_pfx_authentication",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['certipy', 'certipy-ad'])",
  "pattern": "a^",
  "title": "AD CS certificate impersonation followed by PFX authentication",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "ad-cs",
    "authentication",
    "bounded-lineage",
    "detection-only"
  ]
}

{
  "id": "chain.s4u_ticket_then_kerberos_secretsdump_same_cache",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['impacket-getst', 'getst.py', 'impacket-secretsdump', 'secretsdump.py'])",
  "pattern": "a^",
  "title": "Result-backed S4U ticket used for Kerberos-only secretsdump",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "active-directory",
    "kerberos",
    "secretsdump",
    "bounded-lineage",
    "detection-only"
  ]
}

{
  "id": "chain.file_read_then_email_same_artifact",
  "tool_call_only": true,
  "expression": "f.tool in ['get_file_by_id', 'send_email']",
  "pattern": "a^",
  "title": "File read followed by email transfer of the same artifact",
  "severity": "HIGH",
  "confidence": 0.98,
  "tags": [
    "exfiltration",
    "file",
    "email",
    "bounded-lineage",
    "detection-only"
  ]
}

{
  "id": "exfiltration.recursive_model_artifact_external_multipart",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['python', 'python3'])",
  "pattern": "a^",
  "title": "Recursive model artifacts uploaded through exact multipart lineage",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "exfiltration",
    "model-artifact",
    "checkpoint",
    "multipart",
    "bounded-lineage"
  ]
}

{
  "id": "persistence.malicious_download_execute_payload",
  "tool_call_only": true,
  "expression": "f.tool == 'persist'",
  "pattern": "(?is)\"method\"\\s*:\\s*\"(?:cron|systemd|pam_module|registry_run|scheduled_task|wmi_subscription)\".{0,1000}\"payload\"\\s*:\\s*\".{0,1000}\\b(?:powershell(?:\\.exe)?|curl|wget|nc|ncat|netcat)\\b",
  "title": "Malicious persistence download-and-execute payload",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "execution",
    "download-exec",
    "structured-tool",
    "bounded-grammar"
  ]
}

{
  "id": "impact.windows_delete_all_shadow_copies",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['vssadmin', 'vssadmin.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\bvssadmin(?:\\.exe)?\\s+delete\\s+shadows\\s+(?:/all\\s+/quiet|/quiet\\s+/all)(?:\\s|$)",
  "title": "Delete all Windows Volume Shadow Copies",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition"
  ]
}

{
  "id": "tamper.windows_usn_journal_delete",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['fsutil', 'fsutil.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)\\bfsutil(?:\\.exe)?\\s+usn\\s+deletejournal\\s+/d\\s+[a-z]:(?:\\s|$)",
  "title": "Delete a Windows NTFS USN change journal",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "logs"
  ]
}

{
  "id": "tamper.posix_log_and_shell_history_destruction",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:(?:rm|shred)\\b|truncate\\b[^;&|\\r\\n]{0,60}(?:-s\\s*|--size[= ])(?:0|-[0-9]))[^;&|\\r\\n]{0,300}(?:/var/log/[^;&|\\r\\n]{0,300}(?:\\.(?:bash|zsh|ksh|sh)_history|\\bHISTFILE\\b)(?:[\\s;&|}\\\"']|$)|(?:\\.(?:bash|zsh|ksh|sh)_history|\\bHISTFILE\\b)(?:[\\s;&|}\\\"']|$)[^;&|\\r\\n]{0,300}/var/log/)",
  "title": "System log and shell history destroyed together",
  "severity": "HIGH",
  "confidence": 0.97,
  "tags": [
    "defense-evasion",
    "tampering",
    "logs",
    "anti-forensics"
  ]
}

{
  "id": "tamper.windows_recursive_everyone_full_control",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.program == 'icacls')",
  "pattern": "(?i)\\bicacls(?:\\.exe)?\\b",
  "title": "Recursively grant Everyone inheritable full control on Windows",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "tampering",
    "privilege",
    "windows",
    "access-control",
    "recursive"
  ]
}

{
  "id": "impact.windows_recovery_disable_pair",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['bcdedit', 'bcdedit.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+bootstatuspolicy\\s+ignoreallfailures\\b[\\s\\S]{0,500}\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+recoveryenabled\\s+no\\b|\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+recoveryenabled\\s+no\\b[\\s\\S]{0,500}\\bbcdedit(?:\\.exe)?\\s+/set\\s+\\{[^}\\s]+\\}\\s+bootstatuspolicy\\s+ignoreallfailures\\b)",
  "title": "Disable Windows boot recovery and failure handling",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.windows_audit_policy_wipe",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditpol', 'auditpol.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bauditpol(?:\\.exe)?\\s+/clear\\s+/y\\b[\\s\\S]{0,400}\\bauditpol(?:\\.exe)?\\s+/remove\\s+/allusers\\b|\\bauditpol(?:\\.exe)?\\s+/remove\\s+/allusers\\b[\\s\\S]{0,400}\\bauditpol(?:\\.exe)?\\s+/clear\\s+/y\\b)",
  "title": "Clear Windows audit policy and all-user policy",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "defense_evasion.windows_defender_executable_exclusion",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'add-mppreference' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Add a Microsoft Defender executable exclusion",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "endpoint",
    "windows",
    "defender",
    "detection-only"
  ]
}

{
  "id": "defense_evasion.windows_defender_drive_root_exclusion",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'set-mppreference' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Exclude a Windows drive root from Microsoft Defender",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "endpoint",
    "windows",
    "defender",
    "detection-only"
  ]
}

{
  "id": "tamper.windows_audit_detailed_tracking_failure_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditpol', 'auditpol.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Disable Windows Detailed Tracking failure auditing",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "audit",
    "detection-only"
  ]
}

{
  "id": "tamper.windows_audit_process_creation_success_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditpol', 'auditpol.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Disable Windows Process Creation success auditing",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "audit",
    "process-creation",
    "detection-only"
  ]
}

{
  "id": "tamper.windows_audit_full_privilege_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditpol', 'auditpol.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Disable Windows full-privilege auditing",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "audit",
    "privilege",
    "detection-only"
  ]
}

{
  "id": "impact.windows_recovery_store_destruction",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['wbadmin', 'wbadmin.exe', 'wmic', 'wmic.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:\\bwbadmin(?:\\.exe)?\\s+delete\\s+(?:systemstatebackup\\s+-keepversions:0|catalog\\s+-quiet)(?:\\s|$)|\\bwmic(?:\\.exe)?\\s+shadowcopy\\s+delete(?:\\s|$))",
  "title": "Destroy Windows recovery stores",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "windows",
    "recovery-inhibition"
  ]
}

{
  "id": "tamper.windows_defender_multi_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'set-mppreference' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\bSet-MpPreference\\b[^\\r\\n]*(?:-DisableRealtimeMonitoring|-drtm|-DisableBehaviorMonitoring|-dbm|-DisableScriptScanning|-dscrptsc|-DisableBlockAtFirstSeen|-dbaf)\\s+(?:1|true|\\$true)\\b",
  "title": "Disable multiple Windows Defender controls",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.windows_defender_component_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['mpcmdrun', 'mpcmdrun.exe', 'dism', 'dism.exe', 'disable-windowsoptionalfeature', 'remove-windowsfeature', 'uninstall-windowsfeature', 'schtasks', 'schtasks.exe', 'add-dnsclientnrptrule'])",
  "pattern": "(?i)(?:\\bmpcmdrun(?:\\.exe)?\\b[^\\r\\n]*-RemoveDefinitions[^\\r\\n]*-All\\b|\\bdism(?:\\.exe)?\\b[^\\r\\n]*/Disable-Feature[^\\r\\n]*/FeatureName:Windows-Defender\\b|\\b(?:Disable-WindowsOptionalFeature|Remove-WindowsFeature|Uninstall-WindowsFeature)\\b[^\\r\\n]*Windows-Defender\\b|\\bschtasks(?:\\.exe)?\\b[^\\r\\n]*/delete[^\\r\\n]*Windows Defender[^\\r\\n]*/f\\b|\\bAdd-DnsClientNrptRule\\b[^\\r\\n]*endpoint\\.security\\.microsoft\\.com[^\\r\\n]*127\\.0\\.0\\.1\\b)",
  "title": "Disable an exact Windows Defender component",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "endpoint-security"
  ]
}

{
  "id": "tamper.windows_registry_security_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:windows defender|windowsfirewall|firewallpolicy|enablelua|consentpromptbehavioradmin|promptonsecuredesktop|hypervisorenforcedcodeintegrity|allowencryptionoracle|rdp-tcp)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:windows defender|windowsfirewall|enablelua|consentpromptbehavioradmin|promptonsecuredesktop))",
  "title": "Disable Windows security controls through the registry",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "registry",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.windows_uac_autoelevation_hijack",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty', 'new-item']) && f.commands.exists(c, c.argv_complete && c.program == 'start-process')",
  "pattern": "(?is)(?:\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b[^\\r\\n]{0,900}(?:mscfile|ms-settings|folder)[/\\\\]shell[/\\\\]open[/\\\\]command[\\s\\S]{0,900}\\b(?:eventvwr(?:\\.msc)?|fodhelper|sdclt)(?:\\.exe)?\\b)",
  "title": "Hijack a Windows UAC auto-elevation handler",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "defense-evasion",
    "windows",
    "registry",
    "bounded-lineage"
  ]
}

{
  "id": "persistence.windows_accessibility_feature_hijack",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && ((c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations) || (c.program in ['copy', 'copy.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_COPY in c.operations)))",
  "pattern": "(?i)(?:\\b(?:reg(?:\\.exe)?\\s+add|(?:set|new)-itemproperty)\\b[^\\r\\n]*image file execution options[/\\\\](?:osk|sethc|utilman|magnify|narrator|displayswitch|atbroker)\\.exe[^\\r\\n]*\\bDebugger\\b[^\\r\\n]*windows[/\\\\]system32[/\\\\]cmd\\.exe\\b|\\bcopy(?:\\.exe)?\\s+(?:/Y\\s+)?[A-Z]:\\\\Windows\\\\System32\\\\cmd\\.exe\\s+[A-Z]:\\\\Windows\\\\System32\\\\(?:osk|sethc|utilman|magnify|narrator|displayswitch|atbroker)\\.exe\\b)",
  "title": "Hijack a Windows accessibility feature for SYSTEM command access",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "privilege",
    "windows",
    "registry"
  ]
}

{
  "id": "tamper.windows_telemetry_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:COMPlus_ETWEnabled|ETWEnabled|Microsoft-Windows-Windows Defender[/\\\\]Operational|Autologger[/\\\\]EventLog-Application|Services[/\\\\]EventLog)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:COMPlus_ETWEnabled|ETWEnabled|Microsoft-Windows-Windows Defender[/\\\\]Operational|Autologger[/\\\\]EventLog-Application|Services[/\\\\]EventLog))",
  "title": "Disable exact Windows ETW or event telemetry controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "telemetry",
    "registry"
  ]
}

{
  "id": "tamper.windows_credential_protection_weaken",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['reg', 'reg.exe', 'set-itemproperty', 'new-itemproperty'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\breg(?:\\.exe)?\\s+add\\b[^\\r\\n]*(?:UseLogonCredential|RunAsPPL|AutoAdminLogon|DefaultPassword)|\\b(?:set|new)-itemproperty\\b[^\\r\\n]*(?:UseLogonCredential|RunAsPPL|AutoAdminLogon|DefaultPassword))",
  "title": "Weaken exact Windows credential-protection controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "defense-evasion",
    "windows",
    "registry"
  ]
}

{
  "id": "tamper.windows_amsi_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['new-itemproperty', 'set-itemproperty', 'remove-item', 'powershell-amsi-reflection'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\b(?:set|new)-itemproperty\\b[^\\r\\n]*AmsiEnable|\\bremove-item\\b[^\\r\\n]*Microsoft[/\\\\]AMSI[/\\\\]Providers[/\\\\]\\{[0-9a-f-]{36}\\}|AmsiUtils[^\\r\\n]*amsiInitFailed[^\\r\\n]*SetValue\\s*\\(\\s*\\$null\\s*,\\s*\\$true\\s*\\))",
  "title": "Disable or bypass exact Windows AMSI controls",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "windows",
    "amsi"
  ]
}

{
  "id": "tamper.endpoint_security_product_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['systemctl', 'launchctl', 'sysmon', 'sysmon.exe', 'mdatp', 'sentinelctl', 'sc', 'sc.exe'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\b(?:sudo\\s+)?systemctl\\s+(?:(?:stop|disable)\\s+falcon-sensor\\.service|disable\\s+--now\\s+falcon-sensor(?:\\.service)?)\\b|\\b(?:sudo\\s+)?/opt/sentinelone/bin/sentinelctl\\s+control\\s+disable(?:\\s|$)|\\b(?:sudo\\s+)?launchctl\\s+unload\\s+/Library/LaunchDaemons/(?:com\\.carbonblack\\.(?:daemon|defense\\.daemon)|at\\.obdev\\.littlesnitchd)\\.plist\\b|\\bsysmon(?:\\.exe)?\\s+-u(?:\\s|$)|\\b(?:sudo\\s+)?mdatp\\s+config\\s+real-time-protection\\s+--value\\s+disabled(?:\\s|$)|\\bsc(?:\\.exe)?\\s+(?:stop|config|query)\\s+WinDefend\\b)",
  "title": "Disable or uninstall an exact endpoint-security product",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "endpoint-security",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.complete_firewall_relaxation",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'iptables' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?iptables\\s+(?:-F(?:\\s+INPUT)?|-P\\s+(?:INPUT|FORWARD|OUTPUT)\\s+ACCEPT)(?:\\s|$)",
  "title": "Completely relax the host iptables firewall",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "firewall",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.complete_firewall_relaxation_attempt",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'iptables' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "a^",
  "title": "Attempt to completely relax the host iptables firewall",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "firewall",
    "conditional",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.cloud_audit_control_destruction",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['aws', 'gcloud'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\baws\\s+cloudtrail\\s+(?:stop-logging|delete-trail)\\b|\\bgcloud\\s+logging\\s+logs\\s+delete\\s+projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/logs/cloudaudit\\.googleapis\\.com%2Factivity\\s+--quiet(?:\\s|$))",
  "title": "Destroy an exact cloud audit-logging control",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "cloud",
    "audit-logging",
    "bounded-lineage"
  ]
}

{
  "id": "exec.postgresql_copy_program",
  "tool_call_only": true,
  "expression": "f.tool == 'sql_query'",
  "pattern": "a^",
  "title": "PostgreSQL COPY PROGRAM server-side command execution",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "postgresql",
    "server-side",
    "bounded-lineage"
  ]
}

{
  "id": "secrets.sql_sensitive_server_file_read",
  "tool_call_only": true,
  "expression": "f.tool == 'sql_query'",
  "pattern": "a^",
  "title": "Database server read of an exact sensitive host file",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "database",
    "mysql",
    "postgresql",
    "server-side",
    "bounded-lineage"
  ]
}

{
  "id": "exfil.sql_credential_external_output",
  "tool_call_only": true,
  "expression": "f.tool == 'db.query'",
  "pattern": "a^",
  "title": "Direct SQL credential rowset output to an external destination",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "exfiltration",
    "database",
    "external-output",
    "bounded-grammar"
  ]
}

{
  "id": "impact.sql_destructive_mutation",
  "tool_call_only": true,
  "expression": "f.tool in ['sql_query', 'db.execute'] || f.commands.exists(c, c.argv_complete && c.program in ['psql', 'mysql', 'mariadb', 'sqlcmd'])",
  "pattern": "a^",
  "title": "Exact destructive SQL mutation",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "database",
    "destructive",
    "bounded-lineage"
  ]
}

{
  "id": "chain.sensitive_sql_read_then_unbounded_delete_same_table",
  "tool_call_only": true,
  "expression": "f.tool == 'write_query'",
  "pattern": "a^",
  "title": "Sensitive SQLite read followed by unbounded same-table delete",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "database",
    "sqlite",
    "destructive",
    "bounded-lineage"
  ]
}

{
  "id": "attack.http_sql_injection",
  "tool_call_only": true,
  "expression": "f.tool == 'http_request'",
  "pattern": "a^",
  "title": "Executable SQL injection in a structured HTTP request",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "attack",
    "web",
    "database",
    "sql-injection",
    "bounded-lineage"
  ]
}

{
  "id": "attack.http_command_injection",
  "tool_call_only": true,
  "expression": "f.tool == 'http_request'",
  "pattern": "a^",
  "title": "Literal command injection in a structured HTTP request",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "attack",
    "web",
    "command-injection",
    "execution",
    "bounded-lineage"
  ]
}

{
  "id": "exec.sqlserver_xp_cmdshell_invoke",
  "tool_call_only": true,
  "expression": "f.tool == 'sql_query'",
  "pattern": "a^",
  "title": "SQL Server xp_cmdshell operating-system command execution",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "sql-server",
    "server-side",
    "bounded-lineage"
  ]
}

{
  "id": "exec.sqlserver_xp_cmdshell_enable",
  "tool_call_only": true,
  "expression": "f.tool == 'sql_query'",
  "pattern": "a^",
  "title": "Enable SQL Server xp_cmdshell command execution",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "sql-server",
    "configuration",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.cloud_iam_administrator_attachment",
  "tool_call_only": true,
  "expression": "f.tool == 'aws.cloudtrail_event' || f.commands.exists(c, c.argv_complete && c.program == 'aws' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations)",
  "pattern": "(?i)\\battach-(?:user|role)-policy\\s+--(?:user|role)-name\\s+[A-Za-z0-9_+=,.@-]{1,64}\\s+--policy-arn\\s+arn:aws:iam::aws:policy/AdministratorAccess(?:\\s|\"|$)",
  "title": "Attach AWS AdministratorAccess to an exact IAM principal",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "privilege-escalation",
    "cloud",
    "aws",
    "iam",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.cloud_iam_wildcard_inline_policy",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'aws' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations)",
  "pattern": "a^",
  "title": "Grant exact wildcard AWS IAM permissions through an inline policy",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "privilege-escalation",
    "cloud",
    "aws",
    "iam",
    "wildcard",
    "bounded-lineage"
  ]
}

{
  "id": "impact.aws_bulk_ec2_termination",
  "tool_call_only": true,
  "expression": "f.tool == 'aws.ec2.terminate_instances'",
  "pattern": "a^",
  "title": "Terminate at least ten exact AWS EC2 instances",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "cloud",
    "aws",
    "ec2",
    "destructive",
    "bounded-grammar"
  ]
}

{
  "id": "impact.cloud_s3_data_delete",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'aws' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_DELETE in c.operations && (('s3' in c.argv) || ('s3api' in c.argv)))",
  "pattern": "a^",
  "title": "Recursively delete an exact AWS S3 prefix or bucket",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "cloud",
    "aws",
    "s3",
    "destructive",
    "bounded-lineage"
  ]
}

{
  "id": "impact.cloud_observed_resource_delete",
  "tool_call_only": true,
  "expression": "f.tool in ['aws.cloudtrail_event', 'azure.activity_event']",
  "pattern": "a^",
  "title": "Delete an exact cloud disk or IAM binding",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "cloud",
    "destructive",
    "observed",
    "bounded-lineage"
  ]
}

{
  "id": "defense_evasion.cloud_security_telemetry_disable",
  "tool_call_only": true,
  "expression": "f.tool == 'aws.cloudtrail_event'",
  "pattern": "a^",
  "title": "Disable or delete exact AWS security telemetry",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "cloud",
    "aws",
    "audit",
    "bounded-lineage"
  ]
}

{
  "id": "exfiltration.cloud_external_snapshot_share",
  "tool_call_only": true,
  "expression": "f.tool == 'aws.cloudtrail_event'",
  "pattern": "a^",
  "title": "Share an exact AWS snapshot or image with another account",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "exfiltration",
    "cloud",
    "aws",
    "snapshot",
    "bounded-lineage"
  ]
}

{
  "id": "exposure.cloud_worldwide_ssh",
  "tool_call_only": true,
  "expression": "f.tool == 'aws.cloudtrail_event'",
  "pattern": "a^",
  "title": "Expose SSH to a worldwide AWS security-group CIDR",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "exposure",
    "cloud",
    "aws",
    "network",
    "bounded-lineage"
  ]
}

{
  "id": "defense_evasion.endpoint_defender_exclusion",
  "tool_call_only": true,
  "expression": "f.tool == 'windows.event'",
  "pattern": "a^",
  "title": "Add an exact Microsoft Defender exclusion",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "endpoint",
    "windows",
    "defender",
    "bounded-lineage"
  ]
}

{
  "id": "defense_evasion.endpoint_defender_logging_disable",
  "tool_call_only": true,
  "expression": "f.tool == 'windows.event'",
  "pattern": "a^",
  "title": "Disable an exact Microsoft Defender logger",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "endpoint",
    "windows",
    "defender",
    "logging",
    "bounded-lineage"
  ]
}

{
  "id": "exec.sql_command_udf_create",
  "tool_call_only": true,
  "expression": "f.tool in ['sql_query', 'execute_command']",
  "pattern": "a^",
  "title": "Create a command-executing SQL UDF",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "mysql",
    "postgresql",
    "udf",
    "bounded-lineage"
  ]
}

{
  "id": "exec.sqlite_client_shell_escape",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'sqlite3')",
  "pattern": "a^",
  "title": "SQLite client escaped to a local shell",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "sqlite",
    "client-escape",
    "bounded-lineage"
  ]
}

{
  "id": "exec.mysql_client_shell_escape",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['mysql', 'mariadb'])",
  "pattern": "a^",
  "title": "MySQL client escaped to a local shell",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "execution",
    "database",
    "mysql",
    "mariadb",
    "client-escape",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.kubernetes_cluster_admin_binding",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'kubectl' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PRIVILEGE in c.operations)",
  "pattern": "a^",
  "title": "Grant Kubernetes cluster-admin to an exact service account",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "privilege-escalation",
    "kubernetes",
    "rbac",
    "cluster",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.kubernetes_cronjob_privileged_patch",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Make an exact Kubernetes CronJob job template privileged",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "kubernetes",
    "cronjob",
    "cluster",
    "bounded-lineage"
  ]
}

{
  "id": "privilege.kubernetes_privileged_pod_run",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Run an exact privileged Kubernetes pod",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "kubernetes",
    "pod",
    "cluster",
    "bounded-lineage"
  ]
}

{
  "id": "persistence.kubernetes_cronjob_reverse_shell",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Create a Kubernetes CronJob with an exact reverse shell",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "execution",
    "reverse-shell",
    "kubernetes",
    "cronjob",
    "bounded-grammar"
  ]
}

{
  "id": "secrets.kubernetes_cluster_wide_enumeration",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Enumerate Kubernetes secrets across all namespaces",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "discovery",
    "kubernetes",
    "cluster",
    "bounded-lineage"
  ]
}

{
  "id": "secrets.kubernetes_workload_identity_token_read",
  "tool_call_only": true,
  "expression": "f.tool == 'kubectl'",
  "pattern": "a^",
  "title": "Read a Kubernetes workload identity token through pod exec",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "kubernetes",
    "workload-identity",
    "bounded-lineage"
  ]
}

{
  "id": "credential.kubernetes_named_secret_content_read",
  "tool_call_only": true,
  "pattern": "a^",
  "title": "Read the content of one named Kubernetes Secret",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "kubernetes",
    "secret",
    "content-read",
    "exact-actionfacts"
  ]
}

{
  "id": "credential.kubernetes_batch_secret_collection",
  "tool_call_only": true,
  "pattern": "a^",
  "title": "Collect decoded content from multiple named Kubernetes Secrets",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "kubernetes",
    "secret",
    "batch",
    "content-read",
    "exact-actionfacts"
  ]
}

{
  "id": "tamper.pam_permit_authentication_bypass",
  "tool_call_only": true,
  "pattern": "a^",
  "title": "Install pam_permit authentication bypass",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "authentication",
    "privilege",
    "linux",
    "pam",
    "tampering",
    "exact-actionfacts"
  ]
}

{
  "id": "tamper.docker_insecure_http_registry",
  "tool_call_only": true,
  "pattern": "a^",
  "title": "Configure Docker to trust an insecure HTTP registry",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "container",
    "supply-chain",
    "docker",
    "tampering",
    "exact-actionfacts"
  ]
}

{
  "id": "credential.pam_password_capture",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'echo' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\becho\\b[^\\r\\n]{0,900}\\bpam_tty_audit\\.so\\b[^\\r\\n]{0,900}>{1,2}\\s*/etc/pam\\.d/[a-z0-9_.-]+(?:\\s|$)",
  "title": "Install exact PAM password-capture configuration",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "credential-capture",
    "linux",
    "tampering",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.posix_logging_hardening_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['sed', 'service', 'sysrc', 'sysctl', 'ufw'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:\\bsed\\s+(?:-i|--in-place)\\s+[\"']?s/Storage=auto/Storage=none/[\"']?\\s+/etc/systemd/journald\\.conf\\b|\\bservice\\s+(?:syslogd|pf)\\s+(?:stop|disable)\\b|\\bsysrc\\s+syslogd_enable=[\"']?NO[\"']?\\b|\\bsysctl\\s+-w\\s+kernel\\.randomize_va_space=0\\b|\\bufw\\s+logging\\s+off\\b)",
  "title": "Disable exact POSIX logging or host-hardening controls",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "linux",
    "freebsd",
    "logs",
    "hardening",
    "bounded-lineage"
  ]
}

{
  "id": "tamper.linux_security_control_disable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['auditctl', 'service', 'setenforce', 'systemctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:(?:sudo\\s+)?auditctl\\s+(?:-e\\s+0|-D|-d\\s+(?:task|exit|user|exclude|filesystem|io_uring),(?:never|always)\\b)|setenforce\\s+(?:0|permissive)|(?:sudo\\s+)?systemctl\\s+stop\\s+(?:auditd|firewalld|systemd-journald|ufw)(?:\\.service)?|(?:sudo\\s+)?service\\s+auditd\\s+stop)(?:\\s|$)",
  "title": "Disable a Linux host security control",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "linux"
  ]
}

{
  "id": "tamper.macos_unified_log_erase",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.program in ['log', 'sudo'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?log\\s+erase\\s+--all(?:\\s|$)",
  "title": "Erase all macOS unified logs",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "macos",
    "logs"
  ]
}

{
  "id": "credential.macos_fake_update_prompt",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'osascript' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)\\bosascript\\b[^\\r\\n]*(?:Software Update requires that you type your password to apply changes\\.|To perform a security update MacOS needs your passphrase\\.)[^\\r\\n]*\\bhidden\\s+answer\\b",
  "title": "Capture credentials with an exact fake macOS update prompt",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "input-capture",
    "phishing",
    "macos",
    "atomic-red-team"
  ]
}

{
  "id": "credential.macos_login_keychain_dump",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'security' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)(?:sudo\\s+)?security\\s+dump-keychain\\s+-d\\s+login\\.keychain(?:-db)?(?:\\s|$)",
  "title": "Dump decrypted credentials from the macOS login keychain",
  "severity": "LOW",
  "confidence": 0.99,
  "tags": [
    "credential",
    "credential-dumping",
    "macos",
    "atomic-red-team"
  ]
}

{
  "id": "impact.linux_magic_sysrq_destruction",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized == '/proc/sysrq-trigger')",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)echo\\s+[\"']?[bocei][\"']?\\s*>\\s*/proc/sysrq-trigger(?:\\s|$)",
  "title": "Trigger destructive Linux Magic SysRq action",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "linux",
    "host-control"
  ]
}

{
  "id": "impact.posix_host_halt",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'halt' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations)",
  "pattern": "(?i)(?:^|[;\\r\\n]\\s*)halt\\s+-(?:p|r)(?:\\s|$)",
  "title": "Power off or reboot the POSIX host with halt",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "destructive",
    "posix",
    "host-control"
  ]
}

{
  "id": "tamper.posix_system_log_destruction",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized in ['/var/log/messages', '/var/log/security', '/var/log/syslog', '/var/log/auth.log', '/var/log/secure', '/var/log/audit/audit.log'] && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE])",
  "pattern": "(?i)(?:^|[;\"\\r\\n]\\s*)(?:cat\\s+/dev/(?:null|zero)\\s*>\\s*/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|echo\\s+(?:''|\"\")\\s*>\\s*/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|(?:sudo\\s+)?(?:/usr/bin/)?truncate\\s+(?:-s\\s+0|--size=0)\\s+/var/log/(?:(?:messages|security|syslog|secure|audit/audit\\.log)|auth\\.log(?:/current\\.log)?)(?:\\s+2>/dev/null)?(?:\\s+\\|\\|\\s+true)?|chattr\\s+-i\\s+/var/log/audit/audit\\.log\\.1(?:\\s+2>/dev/null)?\\s*;\\s*(?:/usr/bin/)?truncate\\s+-s\\s+0\\s+/var/log/audit/audit\\.log\\.1|(?:rm\\s+-(?:rf|fr)|unlink)\\s+/var/log/(?:messages|security|syslog|auth\\.log|secure|audit/audit\\.log)|(?:sudo\\s+)?rm\\s+-f\\s+/var/log/journal/\\*/system\\.journal|(?:sudo\\s+)?journalctl\\s+--vacuum-time=0)(?:\\s|\"|$)",
  "title": "Destroy canonical POSIX system logs",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "defense-evasion",
    "tampering",
    "posix",
    "logs"
  ]
}

{
  "id": "privilege.temporary_setuid_executable",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'chmod' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations)",
  "pattern": "(?i)\\bchmod\\s+(?:--\\s+)?0?4[0-7]*[1-7][0-7]*\\s+/(?:tmp|var/tmp|dev/shm)/\\S+",
  "title": "Create a setuid executable in a temporary directory",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "persistence",
    "posix",
    "bounded-grammar"
  ]
}

{
  "id": "privilege.custom_root_suid_implant",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'chmod' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PERMISSION_CHANGE in c.operations)",
  "pattern": "(?is)\\b(?:cc|gcc)\\s+\\S+\\.c\\s+-o\\s+\\S+.{0,512}\\bchown\\s+(?:root:root|0:0)\\s+\\S+.{0,256}\\bchmod\\s+0?4[0-7]*[1-7][0-7]*\\s+\\S+",
  "title": "Compile and install a custom root-setuid executable",
  "severity": "CRITICAL",
  "confidence": 0.995,
  "tags": [
    "privilege",
    "persistence",
    "posix",
    "exact-lineage",
    "bounded-grammar"
  ]
}

{
  "id": "privilege.pkroot_setuid_shell",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "(?i)^\\s*/(?:tmp|var/tmp|dev/shm)/[A-Za-z0-9._/-]*pkroot/run\\s+--cmd\\s+['\"]cp /bin/bash /tmp/\\.pksh && chmod 4755 /tmp/\\.pksh['\"]\\s*$",
  "title": "Create a setuid Bash copy through pkroot",
  "severity": "CRITICAL",
  "confidence": 0.999,
  "tags": [
    "privilege",
    "persistence",
    "posix",
    "exact-lineage",
    "bounded-grammar"
  ]
}

{
  "id": "CMD-SYSTEMCTL",
  "pattern": "(?i)\\bsystemctl\\s+enable\\b(?:\\s+--now\\b)?\\s+\\S*(?:backdoor|payload|persist|reverse|shell|evil)\\S*(?:\\.service)?\\b",
  "title": "Suspicious systemd persistence enablement",
  "severity": "CRITICAL",
  "confidence": 0.82,
  "tags": [
    "persistence"
  ]
}

{
  "id": "CMD-NETCAT-LISTEN",
  "pattern": "a^",
  "title": "Netcat network-listener exposure",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "listener"
  ]
}

{
  "id": "CMD-CURL-UPLOAD",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ) && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.to_command_id == c.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_FILE && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_PROCESS) && f.data_flows.exists(d, d.from_command_id == c.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\bcurl\\b\\s+.*(?:--upload-file|-T\\s|--data\\s+@|-F\\s+.*=@)",
  "title": "curl file upload",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-WGET-POST",
  "pattern": "(?i)\\bwget\\b[^;\\n]*--post-(?:data|file)",
  "title": "wget POST data exfil",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "network",
    "exfiltration"
  ]
}

{
  "id": "CMD-SOCAT-EXEC",
  "pattern": "(?i)\\bsocat\\b[^;\\n]*\\bEXEC\\b",
  "title": "socat with EXEC (reverse shell)",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "execution",
    "reverse-shell"
  ]
}

{
  "id": "CMD-ENV-DUMP",
  "expression": "f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ENVIRONMENT_READ in src.operations && f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:printenv|export\\s+-p|env)\\b[^|;\\n]*\\|\\s*(?:curl\\b[^;\\n]*(?:--data(?:-binary|-raw|-urlencode)?\\s+@-|-d\\s+@-|(?:--form|-F)\\s+[^;\\n]*=@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;\\n]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Environment variable dump",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_secret_manager_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && c.program in ['aws', 'gcloud', 'az', 'vault', 'op', 'pass', 'security'])",
  "pattern": "(?i)\\b(?:aws\\s+secretsmanager\\s+get-secret-value|gcloud\\s+secrets\\s+versions\\s+access|az\\s+keyvault\\s+secret\\s+show|vault\\s+kv\\s+get|op\\s+(?:read|item\\s+get)|pass\\s+show|security\\s+find-(?:generic|internet)-password)\\b",
  "title": "Cloud secret manager value read",
  "severity": "CRITICAL",
  "confidence": 0.94,
  "tags": [
    "credential",
    "cloud",
    "secret-manager"
  ]
}

{
  "id": "exfil.secret_read_and_egress_oneliner",
  "tool_call_only": true,
  "expression": "f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.paths.exists(p, p.command_id == src.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ)) && f.commands.exists(src, (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in src.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in src.operations) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && src.pipeline_id != 0 && src.pipeline_id == dst.pipeline_id)) && f.commands.exists(src, f.data_flows.exists(d, d.from_command_id == src.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN)) && f.commands.exists(dst, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in dst.operations && f.data_flows.exists(d, d.to_command_id == dst.id && d.from == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDOUT && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_STDIN) && f.network.exists(n, n.command_id == dst.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && f.data_flows.exists(d, d.from_command_id == dst.id && d.to == defenseclaw.guardrail.semantic.v1.DataKind.DATA_KIND_NETWORK))",
  "pattern": "(?i)\\b(?:cat|type|Get-Content)\\b[^|;&\\r\\n`$()]*(?:\\.env|credentials|secrets?\\.ya?ml|\\.git-credentials|\\.netrc|_netrc|\\.npmrc|\\.pypirc|config\\.json|id_(?:rsa|dsa|ecdsa|ed25519)|/token)\\s*\\|(?:[^|;&\\r\\n`$()]{1,400}\\|)?(?:[^|;&\\r\\n`$()]{1,400}\\|)?\\s*(?:curl\\b[^;&\\r\\n`$()]*(?:--data(?:-binary|-raw|-urlencode)?\\s+@-|-d\\s+@-|(?:--form|-F)\\s+[^;&\\r\\n`$()]*=@-|--upload-file\\s+-|-T\\s+-)|wget\\b[^;&\\r\\n`$()]*--post-(?:data|file)(?:=|\\s+)@?-)",
  "title": "Sensitive read piped to external upload",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "exfiltration",
    "network"
  ]
}

{
  "id": "exfil.credential_file_external_upload",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_UPLOAD in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_UPLOAD && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "a^",
  "title": "Credential file uploaded to an external destination",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "exfiltration",
    "exact-file",
    "detection-only"
  ]
}

{
  "id": "exfil.credential_archive_external_upload",
  "tool_call_only": true,
  "pattern": "(?i)^\\s*(?:(?:/usr/bin|/usr/local/bin)/)?curl\\b[^;&\\r\\n`$()]{0,400}(?:--upload-file|-T|--data-binary|--form|-F)\\s+(?:[^=;\\s]+=@|@)?/[^;&\\s\"'`$()]*(?:creds?(?:-[0-9]{8})?\\.tgz(?:\\.enc)?|ssh-[0-9]{8}\\.tgz|home-ssh\\.tgz|vpn-[0-9]{8}\\.tgz|cloud-keys-[0-9]{8}\\.tgz|admin\\.conf)\\b[^;&\\r\\n`$()]{0,400}\\shttps?://[A-Za-z0-9][A-Za-z0-9.-]*\\.[A-Za-z]{2,}(?::[0-9]+)?(?:/[^;&\\s`$()]*)?\\s*$",
  "title": "Credential archive uploaded to an external destination",
  "severity": "HIGH",
  "confidence": 0.94,
  "tags": [
    "credential",
    "exfiltration",
    "archive",
    "strict-posture",
    "detection-only"
  ]
}

{
  "id": "exfil.literal_sensitive_json_upload",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "Literal credential-bearing JSON upload",
  "severity": "HIGH",
  "confidence": 0.92,
  "tags": [
    "credential",
    "exfiltration",
    "exact-literal",
    "strict-posture"
  ]
}

{
  "id": "exfil.source_archive_external_transfer",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "Source archive streamed to an external destination",
  "severity": "HIGH",
  "confidence": 0.96,
  "tags": [
    "source-code",
    "exfiltration",
    "bounded-lineage",
    "strict-posture"
  ]
}

{
  "id": "privilege.sudoers_unrestricted_nopasswd",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations || defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_APPEND in c.operations) && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND]))",
  "pattern": "a^",
  "title": "Unrestricted passwordless sudo grant",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "privilege",
    "persistence",
    "sudoers"
  ]
}

{
  "id": "persistence.global_ld_preload_install",
  "tool_call_only": true,
  "pattern": "(?i)(?:>|>>|\\btee(?:\\s+-a)?)\\s*/etc/ld\\.so\\.preload\\b",
  "title": "Global dynamic-loader preload installation",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "execution",
    "dynamic-loader"
  ]
}

{
  "id": "exec.reverse_tunnel",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_TUNNEL in c.operations && f.network.exists(n, n.command_id == c.id && n.action in [defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_TUNNEL, defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT] && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]))",
  "pattern": "(?i)(?:\\b(?:ssh|autossh)(?:\\.exe)?\\b[^;\\n]*(?:^|\\s)-R(?:\\s+|\\S)|\\bchisel(?:\\.exe)?\\b[^;\\n]*\\bclient\\b[^;\\n]*\\bR:(?:socks|\\S+)|\\bligolo(?:-ng)?-agent\\b[^;\\n]*--?connect(?:=|\\s+)\\S+)",
  "title": "SSH reverse tunnel",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "network",
    "tunnel",
    "persistence"
  ]
}

{
  "id": "exec.agent_runtime_bypass_flags",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['codex', 'codex.exe', 'claude', 'claude.exe', 'gemini', 'gemini.exe', 'opencode', 'opencode.exe', 'npx', 'pnpm', 'bunx'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_POLICY_BYPASS in c.operations)",
  "pattern": "(?i)\\b(?:(?:npx(?:\\s+-y)?|pnpm\\s+dlx|bunx)\\s+)?(?:claude|codex|gemini)(?:\\.exe)?\\b[^;\\n]*(?:--dangerously-skip-permissions|--permission-mode(?:=|\\s+)bypassPermissions\\b|--dangerously-bypass-approvals-and-sandbox|--yolo\\b|(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b[^;\\n]*(?:--ask-for-approval|-a)(?:=|\\s+)never\\b|(?:--ask-for-approval|-a)(?:=|\\s+)never\\b[^;\\n]*(?:--sandbox|-s)(?:=|\\s+)danger-full-access\\b)",
  "title": "Agent runtime safety bypass flags",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "execution",
    "policy-bypass",
    "agent-runtime"
  ]
}

{
  "id": "integrity.git_hooks_bypass",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git')",
  "pattern": "(?i)\\bgit\\b[^;\\n]*(?:(?:\\bcommit\\b|\\bpush\\b)[^;\\n]*--no-verify\\b|-c\\s+core\\.hooksPath=(?:/dev/null|nul:?|[\"']{2})[^;\\n]*\\b(?:commit|push)\\b|\\bconfig\\s+core\\.hooksPath\\s+(?:/dev/null|nul:?|[\"']{2}))",
  "title": "Git verification hook bypass",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "integrity",
    "policy-bypass"
  ]
}

{
  "id": "integrity.history_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && (c.program == 'history' || (c.program == 'unset' && 'HISTFILE' in c.argv)))",
  "pattern": "(?i)(?:^|[;&|\\r\\n]\\s*)(?:history\\s+-[acnrw]*c[acnrw]*(?:[\\s;&|]|$)|unset\\b[^;\\n]*\\bHISTFILE\\b)",
  "title": "Shell history clear or disable",
  "severity": "MEDIUM",
  "confidence": 0.95,
  "tags": [
    "integrity",
    "defense-evasion"
  ]
}

{
  "id": "recon.network_sweep",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_NETWORK_SCAN in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_SCAN && n.target_kind in [defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_MULTI_ADDRESS_CIDR, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_RANGE, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_LIST, defenseclaw.guardrail.semantic.v1.NetworkTargetKind.NETWORK_TARGET_KIND_GENERATED]))",
  "pattern": "(?i)\\b(?:nmap|masscan|zmap|rustscan|naabu|fping)\\b[^;\\n]*(?:\\b(?:-iL|--input-file|--target-file|-list|--list|-iR|-g|--generate)\\b|(?:\\d{1,3}\\.){3}\\d{1,3}/(?:[0-9]|[12][0-9]|3[01])\\b)",
  "title": "Multi-host network sweep",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "reconnaissance",
    "network"
  ]
}

{
  "id": "privilege.container_host_escape",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations && f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE] && (p.normalized == '/' || p.resolved == '/')))",
  "pattern": "(?i)\\b(?:docker|podman|nerdctl)\\b[^;\\n]*\\brun\\b[^;\\n]*--privileged\\b[^;\\n]*(?:-v|--volume)(?:=|\\s+)/:[^;\\s]+",
  "title": "Container with writable host-root access",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "privilege",
    "container",
    "host-escape",
    "host-root"
  ]
}

{
  "id": "privilege.host_namespace_entry",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:nsenter\\b[^;\\n]*(?:(?:-t|--target)(?:=|\\s+)1\\b|/proc/1/ns/(?:mnt|uts|ipc|net|pid|user|cgroup|time)\\b)|chroot\\b[^;\\n]*/proc/1/root\\b)",
  "title": "Host PID-1 namespace or root entry",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "privilege",
    "container",
    "host-escape"
  ]
}

{
  "id": "lateral.workload_exec",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:(?:kubectl|oc)\\b[^;\\n]*\\b(?:exec|debug|rsh)\\b|crictl\\b[^;\\n]*\\bexec\\b|ctr\\b[^;\\n]*\\btasks?\\s+exec\\b|(?:docker|podman)\\b[^;\\n]*(?:--host|-H)(?:=|\\s+)(?:tcp|ssh)://[^;\\s]+\\s+exec\\b)",
  "title": "Remote workload command execution",
  "severity": "HIGH",
  "confidence": 0.92,
  "tags": [
    "execution",
    "lateral-movement",
    "workload"
  ]
}

{
  "id": "impact.cryptomining_launch",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['docker', 'podman', 'nerdctl'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONTAINER_RUN in c.operations)",
  "pattern": "(?i)(?:^|[;&|\\s])(?:[/\\\\\\w.-]+[/\\\\])?(?:xmrig(?:-proxy)?|minerd|cpuminer(?:-multi)?|ethminer|cgminer|bfgminer|t-rex|lolminer|nbminer|teamredminer|phoenixminer|nanominer)(?:\\s|$)",
  "title": "Cryptocurrency miner launch",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "impact",
    "resource-hijacking"
  ]
}

{
  "id": "impact.fork_bomb",
  "tool_call_only": true,
  "pattern": "(?i)(?:^|\\s)(?::\\s*\\(\\s*\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:|perl\\s+-e\\s+['\"]?\\s*fork\\s+while\\s+fork\\s*;?\\s*['\"]?|ruby\\s+-e\\s+['\"]?\\s*loop\\s*\\{\\s*fork\\s*\\}\\s*;?\\s*['\"]?)\\s*$",
  "title": "Unbounded fork bomb",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "impact.unbounded_cpu_fanout",
  "tool_call_only": true,
  "pattern": "a^",
  "title": "Unbounded high-CPU worker fanout",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "impact",
    "denial-of-service",
    "resource-exhaustion",
    "cpu",
    "exact-actionfacts"
  ]
}

{
  "id": "impact.mass_process_termination",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['kill', 'stop-process', 'taskkill'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_PROCESS_KILL in c.operations)",
  "pattern": "(?i)\\b(?:kill\\b[^;\\n]*(?:-9|-KILL|-SIGKILL)\\b[^;\\n]*-1\\b|stop-process\\b[^;\\n]*(?:-name|-processname)(?:=|\\s+)\\*[^;\\n]*-force\\b|taskkill\\b[^;\\n]*/im\\s+\\*[^;\\n]*/f\\b)",
  "title": "Mass process termination",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "impact",
    "denial-of-service"
  ]
}

{
  "id": "source.git_remote_tamper",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations && f.network.exists(n, n.command_id == c.id && n.action == defenseclaw.guardrail.semantic.v1.NetworkAction.NETWORK_ACTION_CONNECT && n.scope in [defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_PUBLIC, defenseclaw.guardrail.semantic.v1.NetworkScope.NETWORK_SCOPE_UNKNOWN]) && 'set-url' in c.argv)",
  "pattern": "(?i)\\bgit\\b[^;\\n]*\\bremote\\s+set-url\\b[^;\\n]*(?:https?|ssh|git)://[^;\\s]+",
  "title": "Git remote routing change",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "network",
    "tampering"
  ]
}

{
  "id": "source.git_config_exec",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'git' && (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONFIG_CHANGE in c.operations || (defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_WRITE in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE && (p.normalized == '.git/config' || p.resolved.endsWith('/.git/config'))))))",
  "pattern": "(?i)\\bgit\\b[^;\\r\\n]*(?:\\bconfig\\b[^;\\r\\n]*(?:alias\\.[A-Za-z0-9._-]+|credential\\.helper|core\\.(?:sshCommand|hooksPath))\\b[^;\\r\\n]+|\\b(?:show|log|diff|whatchanged)\\b[^;\\r\\n]*--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]config(?:$|[\"'\\s]))",
  "title": "Git executable configuration change or overwrite",
  "severity": "MEDIUM",
  "confidence": 0.9,
  "tags": [
    "source-control",
    "execution",
    "tampering"
  ]
}

{
  "id": "persistence.ssh_authorized_keys_command",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:>>?|(?:tee|truncate|rm|unlink|cp|mv|set-content|add-content|out-file|remove-item|copy-item|move-item)\\b[^;\\n]*)[^;\\n]*(?:[/\\\\]\\.ssh[/\\\\](?:authorized_keys2?)|[/\\\\]programdata[/\\\\]ssh[/\\\\]administrators_authorized_keys)\\b",
  "title": "SSH authorized keys mutation",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "persistence",
    "credential",
    "ssh"
  ]
}

{
  "id": "persistence.privileged_account_change",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program in ['useradd', 'usermod', 'gpasswd', 'groupmems', 'adduser', 'dseditgroup', 'dscl', 'net', 'net1', 'add-localgroupmember', 'add-adgroupmember'] && defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_ACCOUNT_CHANGE in c.operations)",
  "pattern": "(?i)\\b(?:useradd\\b[^;\\n]*(?:-u|--uid)(?:=|\\s+)0\\b|usermod\\b[^;\\n]*(?:(?:-u|--uid)(?:=|\\s+)0\\b|(?:-G|--groups)(?:=|\\s+)[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman))|(?:gpasswd|groupmems|adduser|dseditgroup|dscl)\\b[^;\\n]*(?:root|sudo|wheel|admin|docker|lxd|incus|podman)\\b|net\\s+localgroup\\s+(?:Administrators|Remote Desktop Users)\\b[^;\\n]*/add\\b|Add-(?:Local|AD)GroupMember\\b[^;\\n]*(?:Administrators|Domain Admins|Enterprise Admins)\\b)",
  "title": "Privileged account or group change",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "persistence",
    "privilege",
    "account"
  ]
}

{
  "id": "privilege.posix_non_root_uid_zero_account_write",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "Non-root UID-0 account written to /etc/passwd",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "persistence",
    "privilege",
    "account",
    "system-file",
    "structured-tool",
    "bounded-grammar"
  ]
}

{
  "id": "integrity.dpkg_status_direct_mutation",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized == '/var/lib/dpkg/status' && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND])",
  "pattern": "a^",
  "title": "Direct dpkg package database mutation",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "integrity",
    "package-manager",
    "system-file",
    "bounded-grammar"
  ]
}

{
  "id": "integrity.posix_system_shell_replacement",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'cp' && ('/bin/dash' in c.argv || '/usr/bin/dash' in c.argv))",
  "pattern": "(?mi)^[ \\t]*cp[ \\t]+/(?:usr/)?bin/bash[ \\t]+/(?:usr/)?bin/dash[ \\t]*$",
  "title": "Replace a POSIX system shell with Bash",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "integrity",
    "system-binary",
    "shell",
    "binary-hijacking",
    "bounded-grammar"
  ]
}

{
  "id": "integrity.posix_system_interpreter_wrapper",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE && p.normalized.startsWith('/usr/bin/python3.'))",
  "pattern": "(?mi)^[ \\t]*mv[ \\t]+-f[ \\t]+/usr/bin/\\.python3\\.[0-9]{1,2}\\.wrap[ \\t]+/usr/bin/python3\\.[0-9]{1,2}[ \\t]*$",
  "title": "Replace a versioned system Python interpreter with an environment wrapper",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "integrity",
    "system-binary",
    "python",
    "binary-hijacking",
    "bounded-grammar"
  ]
}

{
  "id": "integrity.kernel_control_bind_override",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, c.argv_complete && c.program == 'mount' && '--bind' in c.argv)",
  "pattern": "a^",
  "title": "Kernel control bind override",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "integrity",
    "kernel",
    "procfs",
    "mount",
    "bounded-grammar"
  ]
}

{
  "id": "ENT-BULK-SSN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})-(?:0[1-9]|[1-9][0-9])-(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US Social Security Number",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-SSN-NOHYPHEN",
  "pattern": "\\b(?:00[1-9]|0[1-9][0-9]|[1-5][0-9]{2}|6[0-5][0-9]|66[0-5]|66[7-9]|6[7-9][0-9]|[78][0-9]{2})(?:0[1-9]|[1-9][0-9])(?:000[1-9]|00[1-9][0-9]|0[1-9][0-9]{2}|[1-9][0-9]{3})\\b",
  "title": "US SSN (no hyphens)",
  "severity": "HIGH",
  "confidence": 0.55,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-CC-VISA",
  "pattern": "\\b4\\d{3}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Visa credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-MC",
  "pattern": "\\b5[1-5]\\d{2}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Mastercard credit card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-AMEX",
  "pattern": "\\b3[47]\\d{2}[\\s-]?\\d{6}[\\s-]?\\d{5}\\b",
  "title": "American Express card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-CC-DISCOVER",
  "pattern": "\\b6(?:011|5\\d{2})[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b",
  "title": "Discover card number",
  "severity": "CRITICAL",
  "confidence": 0.8,
  "tags": [
    "pii",
    "pci"
  ]
}

{
  "id": "ENT-IBAN",
  "pattern": "\\b[A-Z]{2}\\d{2}[\\s]?[\\dA-Z]{4}[\\s]?(?:[\\dA-Z]{4}[\\s]?){1,7}[\\dA-Z]{1,4}\\b",
  "title": "International Bank Account Number (IBAN)",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "financial"
  ]
}

{
  "id": "ENT-US-PHONE",
  "pattern": "(?:\\+1(?:[\\s.-]?\\d){10}\\b|\\(\\d{3}\\)[\\s.-]?\\d{3}[\\s.-]?\\d{4}\\b|\\b\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{4}\\b|(?i:\\b(?:phone|mobile|telephone|contact|tel|whatsapp)\\b[^\\r\\n\\d]{0,32}(?:\\+?1[\\s.-]?)?(?:\\(?\\d{3}\\)?[\\s.-]?)\\d{3}[\\s.-]?\\d{4}\\b))",
  "title": "US phone number",
  "severity": "MEDIUM",
  "confidence": 0.5,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-PHONE-E164",
  "pattern": "(?:^|[\\s:(])\\+\\d{1,3}(?:[\\s.-]?\\d){7,14}\\b",
  "title": "International E.164-style phone number",
  "severity": "MEDIUM",
  "confidence": 0.55,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-EMAIL-BULK",
  "pattern": "(?i)\\b[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,}\\b",
  "title": "Email address",
  "severity": "MEDIUM",
  "confidence": 0.4,
  "tags": [
    "pii"
  ]
}

{
  "id": "ENT-PASSPORT-US",
  "pattern": "\\b[A-Z]\\d{8}\\b",
  "title": "US passport number pattern",
  "severity": "HIGH",
  "confidence": 0.5,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-DL-CA",
  "pattern": "\\b[A-Z]\\d{7}\\b",
  "title": "California drivers license pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-MEDICAL-RECORD",
  "pattern": "(?i)\\b(?:mrn|medical record|patient id)\\s*[:#]?\\s*\\d{6,12}\\b",
  "title": "Medical record number",
  "severity": "CRITICAL",
  "confidence": 0.7,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-DOB-PATTERN",
  "pattern": "(?i)\\b(?:dob|date of birth|birth[\\s-]?date)\\s*[:#]?\\s*\\d{1,2}[/\\-]\\d{1,2}[/\\-]\\d{2,4}\\b",
  "title": "Date of birth with label",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "hipaa"
  ]
}

{
  "id": "ENT-NHS-NUMBER",
  "pattern": "(?i:\\b(?:nhs(?:\\s+(?:number|no\\.?|id))?|national health service(?:\\s+(?:number|no\\.?|id))?)\\b[^\\r\\n\\d]{0,24}\\d{3}[\\s]?\\d{3}[\\s]?\\d{4}\\b|\\b\\d{3}[\\s]?\\d{3}[\\s]?\\d{4}\\b[^\\r\\nA-Za-z]{0,8}(?:nhs(?:\\s+(?:number|no\\.?|id))?|national health service(?:\\s+(?:number|no\\.?|id))?)\\b)",
  "title": "UK NHS number pattern",
  "severity": "HIGH",
  "confidence": 0.4,
  "tags": [
    "pii",
    "regulated"
  ]
}

{
  "id": "ENT-BULK-CSV-PII",
  "pattern": "(?im)(?:^|\\n)[^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*[,\\t][^\\r\\n]*(?:first[\\s_]?name|last[\\s_]?name|ssn|social[\\s_]?security|credit[\\s_]?card|card[\\s_]?number|account[\\s_]?number)[^\\r\\n]*\\r?\\n[^\\r\\n]*[0-9][^\\r\\n]*",
  "title": "CSV/TSV records with multiple PII columns",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "ENT-BULK-JSON-PII",
  "pattern": "(?i)\\{[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)\\s*,[^{}]{0,512}\"(?:ssn|social_security|credit_card|card_number|account_number|routing_number)\"\\s*:\\s*(?:\"(?:\\d[\\s-]?){6,19}\"|\\d{6,19}\\b)[^{}]{0,512}\\}",
  "title": "JSON record with multiple PII values",
  "severity": "HIGH",
  "confidence": 0.75,
  "tags": [
    "pii",
    "bulk-data"
  ]
}

{
  "id": "SEC-ENV-DUMP-REQUEST",
  "tool_call_only": true,
  "pattern": "(?i)\\b(?:open|read|cat)\\b.{0,120}\\.env\\b.{0,120}\\b(?:print|show|display|output|dump|reveal|expose)\\b.{0,80}\\b(?:every|all)\\b.{0,40}\\b(?:secret|credential|variable|line)s?\\b",
  "title": "Request to expose all environment-file secrets",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "intent",
    "strict-posture"
  ]
}

{
  "id": "SEC-AWS-KEY",
  "pattern": "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b",
  "title": "AWS access key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-AWS-SECRET",
  "pattern": "(?i)aws_secret_access_key\\s*[=:]\\s*[A-Za-z0-9/+=]{30,}",
  "title": "AWS secret access key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-ANTHROPIC",
  "pattern": "sk-ant-[a-zA-Z0-9\\-_]{20,}",
  "title": "Anthropic API key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI",
  "pattern": "sk-proj-[a-zA-Z0-9]{20,}",
  "title": "OpenAI project key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-OPENAI-V2",
  "pattern": "sk-[a-zA-Z0-9]{40,}",
  "title": "OpenAI API key (long form)",
  "severity": "CRITICAL",
  "confidence": 0.85,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-STRIPE",
  "pattern": "(?:sk_live_|sk_test_|rk_live_|rk_test_)[a-zA-Z0-9]{20,}",
  "title": "Stripe secret/restricted key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-TOKEN",
  "pattern": "(?:ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36,}",
  "title": "GitHub token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITHUB-PAT",
  "pattern": "github_pat_[a-zA-Z0-9_]{22,}",
  "title": "GitHub fine-grained PAT",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GITLAB",
  "pattern": "glpat-[a-zA-Z0-9\\-_]{20,}",
  "title": "GitLab personal access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-GOOGLE",
  "pattern": "AIza[0-9A-Za-z\\-_]{35}",
  "title": "Google API key",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-TOKEN",
  "pattern": "xox[bpors]-[0-9a-zA-Z\\-]{10,}",
  "title": "Slack token",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SLACK-WEBHOOK",
  "pattern": "https://hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+",
  "title": "Slack webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-DISCORD-WEBHOOK",
  "pattern": "https://discord(?:app)?\\.com/api/webhooks/\\d+/[a-zA-Z0-9_\\-]+",
  "title": "Discord webhook URL",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PRIVKEY",
  "pattern": "-----BEGIN (?:RSA |EC |OPENSSH |PGP |DSA )?PRIVATE KEY-----",
  "title": "Private key",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-JWT",
  "pattern": "eyJ[A-Za-z0-9\\-_]{10,}\\.eyJ[A-Za-z0-9\\-_]{10,}\\.[A-Za-z0-9\\-_.+/=]+",
  "title": "JWT token",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-CONNSTR",
  "pattern": "(?:mongodb|postgres|mysql|redis|amqp)://[^:\\s]+:[^@\\s]+@",
  "title": "Connection string with credentials",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-BEARER",
  "pattern": "(?i)(?:authorization|bearer)\\s*[:=]\\s*Bearer\\s+[A-Za-z0-9\\-_.~+/]{16,}=*",
  "title": "Bearer token in header",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-SENDGRID",
  "pattern": "SG\\.[a-zA-Z0-9\\-_]{10,}\\.[a-zA-Z0-9\\-_]{10,}",
  "title": "SendGrid API key",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-TWILIO",
  "pattern": "SK[0-9a-fA-F]{32}",
  "title": "Twilio API key",
  "severity": "HIGH",
  "confidence": 0.8,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-NPM-TOKEN",
  "pattern": "npm_[a-zA-Z0-9]{36,}",
  "title": "npm access token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-PYPI-TOKEN",
  "pattern": "pypi-[A-Za-z0-9\\-_]{50,}",
  "title": "PyPI API token",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential"
  ]
}

{
  "id": "SEC-HEX-SECRET",
  "pattern": "(?i)(?:secret(?:_key)?|api[_-]?key|[a-z0-9]{0,24}[_-]?token)\\s*[=:]\\s*[\"']?[a-f0-9]{32,}\\b",
  "title": "Hex-encoded secret in assignment",
  "severity": "HIGH",
  "confidence": 0.72,
  "tags": [
    "credential"
  ]
}

{
  "id": "chain.sensitive_sql_value_then_cross_resource_literal_persistence",
  "tool_call_only": true,
  "expression": "f.tool in ['write_file', 'create_entities']",
  "pattern": "a^",
  "title": "Sensitive SQL value persisted literally to a distinct MCP resource",
  "severity": "HIGH",
  "confidence": 0.98,
  "tags": [
    "credential",
    "database",
    "persistence",
    "bounded-lineage",
    "detection-only"
  ]
}

{
  "id": "PATH-SSH-DIR",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "SSH authorized_keys mutation",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-SSH-KEY",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?im)(?:(?:^|[;&|]\\s*)\\s*(?:cat|base64|head|tail|less|more|sed|awk|grep|rg|strings|xxd|hexdump|read|open|show|paste|print|display)\\b[^;\\n]*(?:^|[\\\\/])id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[^A-Za-z0-9_.-])|(?:^|[\\\\/])id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[^A-Za-z0-9_.-])[^;\\n]{0,120}\\b(?:cat|base64|read|open|show|paste|print|display)\\b)",
  "title": "SSH private key file path",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/credentials",
  "title": "AWS credentials file",
  "severity": "CRITICAL",
  "confidence": 0.98,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-AWS-CONFIG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.aws/config",
  "title": "AWS config file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-PASSWORD-CRACKER-POTFILE",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CREDENTIAL_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+)/(?:\\.john/john\\.pot|\\.local/share/hashcat/hashcat\\.potfile|\\.hashcat/hashcat\\.potfile)(?:$|[\"'\\s|;&])",
  "title": "Password-cracker recovered credential store read",
  "severity": "CRITICAL",
  "confidence": 0.99,
  "tags": [
    "credential",
    "password-cracking",
    "file-sensitive",
    "detection-only"
  ]
}

{
  "id": "PATH-KUBE",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.kube/config",
  "title": "Kubernetes config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-DOCKER",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.docker/config\\.json",
  "title": "Docker config",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GNUPG",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.gnupg/",
  "title": "GPG keyring access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NPMRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.npmrc",
  "title": "npm config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-PYPIRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.pypirc",
  "title": "PyPI config (may contain tokens)",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-GIT-CREDS",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.git-credentials",
  "title": "Git credentials file",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-NETRC",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.netrc",
  "title": "netrc credentials file",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ENV-FILE",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "Environment file",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "PATH-ETC-PASSWD",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized == '/etc/passwd' && (p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE] || (p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && f.commands.exists(c, c.id == p.command_id && c.dialect == defenseclaw.guardrail.semantic.v1.Dialect.DIALECT_ARGV && c.program in ['read', 'readfile', 'read_file', 'read-file', 'fsread', 'fs_read', 'fs-read', 'fs.read', 'fs.read_file', 'fileread', 'file_read', 'file-read', 'catfile', 'cat_file', 'cat-file', 'openfile', 'open_file', 'open-file', 'viewfile', 'view_file', 'view-file', 'getfile', 'get_file', 'get-file']))))",
  "pattern": "a^",
  "title": "/etc/passwd typed read or mutation",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file"
  ]
}

{
  "id": "PATH-ETC-SHADOW",
  "tool_call_only": true,
  "expression": "f.paths.exists(p, p.normalized == '/etc/shadow' && (p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE] || (p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ && f.commands.exists(c, c.id == p.command_id && c.program in ['cat', 'base64', 'head', 'tail', 'less', 'more', 'strings', 'xxd', 'hexdump', 'cp', 'read', 'readfile', 'read_file', 'read-file', 'fsread', 'fs_read', 'fs-read', 'fs.read', 'fs.read_file', 'fileread', 'file_read', 'file-read', 'catfile', 'cat_file', 'cat-file', 'openfile', 'open_file', 'open-file', 'viewfile', 'view_file', 'view-file', 'getfile', 'get_file', 'get-file']))))",
  "pattern": "a^",
  "title": "/etc/shadow credential read or mutation",
  "severity": "CRITICAL",
  "confidence": 0.95,
  "tags": [
    "system-file",
    "credential"
  ]
}

{
  "id": "PATH-ETC-SUDOERS",
  "tool_call_only": true,
  "expression": "true",
  "pattern": "a^",
  "title": "/etc/sudoers mutation",
  "severity": "HIGH",
  "confidence": 0.9,
  "tags": [
    "system-file",
    "privilege"
  ]
}

{
  "id": "PATH-PROC-ENVIRON",
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/proc/(?:\\d+|self)/environ",
  "title": "/proc environ access",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential"
  ]
}

{
  "id": "secrets.cloud_credential_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|gh[/\\\\]hosts\\.yml|anthropic[/\\\\]keys\\.json)|AppData[/\\\\]Roaming[/\\\\](?:gcloud[/\\\\](?:application_default_credentials\\.json|(?:access_tokens|credentials)\\.db)|GitHub CLI[/\\\\]hosts\\.yml)|\\.azure[/\\\\](?:azureProfile\\.json|TokenCache\\.dat|msal_token_cache[^/\\\\]*\\.(?:json|bin)))(?:$|[\"'\\s])",
  "title": "Cloud credential material read",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "credential",
    "cloud",
    "file-sensitive"
  ]
}

{
  "id": "secrets.cloud_metadata_credential_read",
  "tool_call_only": true,
  "expression": "f.tool == 'cloud_metadata'",
  "pattern": "a^",
  "title": "Cloud instance-metadata credential token read",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "cloud",
    "metadata",
    "bounded-lineage"
  ]
}

{
  "id": "secrets.structured_credential_extract",
  "tool_call_only": true,
  "expression": "f.tool == 'credential_extract'",
  "pattern": "a^",
  "title": "Structured credential-store extraction",
  "severity": "HIGH",
  "confidence": 0.99,
  "tags": [
    "credential",
    "extraction",
    "structured-tool",
    "bounded-lineage"
  ]
}

{
  "id": "secrets.browser_session_store_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "(?i)(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.config[/\\\\](?:google-chrome|chromium|microsoft-edge)|\\.mozilla[/\\\\]firefox|Library[/\\\\]Application Support[/\\\\](?:google[/\\\\]chrome|chromium|microsoft edge|firefox[/\\\\]profiles)|AppData[/\\\\]Local[/\\\\](?:google[/\\\\]chrome|chromium|microsoft[/\\\\]edge)[/\\\\]User Data|AppData[/\\\\]Roaming[/\\\\]mozilla[/\\\\]firefox[/\\\\]profiles)[/\\\\](?:[^/\\\\\"']+[/\\\\])*(?:Login Data|Cookies|logins\\.json|cookies\\.sqlite|key4\\.db)(?:$|[\"'\\s])",
  "title": "Browser credential or session store read",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "credential",
    "browser",
    "file-sensitive"
  ]
}

{
  "id": "secrets.workload_identity_token_read",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_READ in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_READ))",
  "pattern": "/var/run/secrets/(?:(?:kubernetes\\.io|eks\\.amazonaws\\.com)/serviceaccount/token|azure/tokens/azure-identity-token)(?:$|[\"'\\s])",
  "title": "Workload identity token read",
  "severity": "CRITICAL",
  "confidence": 0.96,
  "tags": [
    "credential",
    "workload-identity",
    "file-sensitive"
  ]
}

{
  "id": "PATH-HISTORY",
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?:~|\\$\\{?HOME\\}?|/home/\\w+|/root|/Users/\\w+)/\\.(?:bash_history|zsh_history|python_history)",
  "title": "Shell history file",
  "severity": "MEDIUM",
  "confidence": 0.8,
  "tags": [
    "credential",
    "file-sensitive"
  ]
}

{
  "id": "privilege.container_runtime_socket_access",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, defenseclaw.guardrail.semantic.v1.OperationKind.OPERATION_KIND_CONNECT in c.operations && f.paths.exists(p, p.command_id == c.id && p.access == defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_CONNECT))",
  "pattern": "(?i)(?:unix://)?/(?:var/)?run/(?:docker\\.sock|containerd/containerd\\.sock|crio/crio\\.sock|podman/podman\\.sock)\\b",
  "title": "Container runtime socket access",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "privilege",
    "container",
    "socket"
  ]
}

{
  "id": "persistence.shell_profile_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:^|[^-:A-Za-z0-9_./~\\\\])(?:(?:~|\\$HOME|\\$\\{HOME\\}|/root|/(?:home|Users)/[^/\\\\\"']+|[a-z]:[/\\\\]Users[/\\\\][^/\\\\\"']+)[/\\\\](?:\\.(?:profile|bash_profile|bashrc|zprofile|zshrc)|\\.config[/\\\\](?:fish[/\\\\]config\\.fish|powershell[/\\\\](?:profile|microsoft\\.powershell_profile)\\.ps1)|Documents[/\\\\](?:Windows)?PowerShell[/\\\\](?:profile|Microsoft\\.PowerShell_profile)\\.ps1)\\b|/etc/profile(?:$|[\"'\\s]))",
  "title": "Shell startup profile mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "shell",
    "file-sensitive"
  ]
}

{
  "id": "persistence.git_hook_write",
  "tool_call_only": true,
  "expression": "f.commands.exists(c, f.paths.exists(p, p.command_id == c.id && p.access in [defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_WRITE, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_APPEND, defenseclaw.guardrail.semantic.v1.PathAccess.PATH_ACCESS_DELETE]))",
  "pattern": "(?i)(?:(?:^|[/\\\\])\\.git[/\\\\]hooks[/\\\\]|--output(?:=|\\s+)[^;\\r\\n]*\\.git[/\\\\]hooks[/\\\\])(?:applypatch-msg|commit-msg|fsmonitor-watchman|post-checkout|post-commit|post-merge|post-receive|post-rewrite|pre-applypatch|pre-commit|pre-push|pre-rebase|pre-receive|prepare-commit-msg|push-to-checkout|update)(?:$|[\"'\\s])",
  "title": "Active Git hook mutation",
  "severity": "MEDIUM",
  "confidence": 0.92,
  "tags": [
    "persistence",
    "source-control",
    "file-sensitive"
  ]
}

{
  "id": "TRUST-AUTHORITY",
  "pattern": "(?i)(?:i am|i'm)\\s+(?:your|the)\\s+(?:creator|developer|admin|owner|operator)\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|disregard|bypass|disable|reveal|expose|forget|obey|comply)\\b|do\\s+as\\s+i\\s+say|no\\s+(?:content\\s+policy\\s+)?restrictions?)",
  "title": "Authority claim in tool args",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-MAINTENANCE",
  "pattern": "(?im)(?:(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|now,?|next,?)\\s+)?(?:enable|activate|enter|switch\\s+to)\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?))|(?:maintenance|debug|admin|developer)\\s+mode\\s+(?:enabled|activated|on)\\b[\\s\\S]{0,80}\\b(?:ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety)|do\\s+anything|answer\\s+without\\s+(?:rules?|restrictions?|filters?)))|\\bnew\\s+system\\s+message\\b[\\s\\S]{0,100}\\byou\\s+are\\s+now\\s+in\\s+(?:maintenance|debug|admin|developer)\\s+mode\\b[\\s\\S]{0,100}\\b(?:refusals?|guardrails?|filters?|safety\\s+checks?)\\s+(?:are\\s+)?disabled\\b)",
  "title": "Fake mode activation",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SAFETY-OVERRIDE",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:override|bypass|disable|turn\\s+off|remove)\\s+(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))|(?:safety|guardrails?)\\s+(?:override|bypass)\\s+(?:enabled|activated|on|now)|(?:guardrails?|(?:all|your)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?)|(?:the\\s+)?(?:ai|assistant|agent|model)\\s+(?:guardrails?|filters?|restrictions?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?))\\s+(?:must\\s+be|should\\s+be|are\\s+now|is\\s+now|have\\s+been|has\\s+been)\\s+(?:overridden|bypassed|disabled|turned\\s+off|removed))",
  "title": "Safety override attempt",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCTIONS",
  "pattern": "(?i)(?:(?:your|the)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:have|has)\\s+(?:changed|been\\s+(?:updated|replaced|overridden))\\b[\\s\\S]{0,120}(?:\\b(?:ignore|override|bypass|disable|reveal|expose|forget|obey|comply)\\b|\\b(?:now|next)\\b[\\s,:;-]+(?:do\\s+this|execute\\s+(?:this|the\\s+following)|obey\\s+(?:me|my\\s+commands?)|follow\\s+(?:these|my|the\\s+new)\\s+instructions?)\\b)|(?:new|updated)\\s+(?:instructions|system\\s+prompt|rules)\\s+(?:are|say)\\s+(?:to\\s+)?(?:ignore|override|bypass|disable|reveal))",
  "title": "Fake instruction update",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-IGNORE-PREVIOUS",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?ignore\\s+(?:all\\s+)?(?:previous|prior|above|earlier)\\s+(?:instructions|rules|guidelines|context)",
  "title": "Ignore previous instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DISREGARD",
  "pattern": "(?im)(?:^|[.!?;,:]\\s*|(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?|(?:can|could|will|would)\\s+you(?:\\s+please)?|i\\s+(?:want|need)\\s+you\\s+to(?:\\s+please)?|now,?|next,?|you\\s+(?:must|should|need\\s+to))\\s+)?disregard\\s+(?:all\\s+)?(?:previous|prior|above|your|earlier)\\s+(?:instructions|rules|guidelines|programming|context)",
  "title": "Disregard instructions",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-JAILBREAK",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:(?:please,?|(?:can|could|will|would)\\s+you|i\\s+(?:want|need)\\s+you\\s+to|let'?s|now,?|next,?)\\s+)?(?:enable|activate|enter|use|switch\\s+to)\\s+(?:a\\s+|the\\s+)?(?:jailbreak(?:ed)?|dan)(?:\\s+(?:mode|persona))?|(?:(?:please,?)\\s+)?(?:follow|run|apply)\\s+(?:this\\s+|the\\s+|a\\s+)?jailbreak\\s+(?:prompt|instructions?)|(?:(?:please,?)\\s+)?jailbreak\\s+(?:yourself|(?:this|the|your)\\s+(?:ai|assistant|agent|model|system))|(?:jailbreak|dan)\\s+mode\\s+(?:enabled|activated|on)|you\\s+are\\s+(?:now\\s+)?dan\\b[\\s\\S]{0,80}\\b(?:without\\s+(?:rules?|restrictions?|filters?)|do\\s+anything|ignore\\s+(?:safety|rules?|instructions?))|do\\s+anything\\s+now|you\\s+are\\s+now\\s+(?:unfiltered|free\\s+(?:from|without)\\s+(?:rules?|restrictions?|filters?|safety(?:\\s+(?:rules?|filters?|checks?))?)))",
  "title": "Jailbreak attempt",
  "severity": "CRITICAL",
  "confidence": 0.92,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PRETEND",
  "pattern": "(?i)(?:(?:pretend|act\\s+as(?:\\s+if)?)\\s+(?:you\\s+are|you're)\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)|you\\s+are\\s+now\\s+(?:a\\s+|an\\s+)?(?:evil|unrestricted|unfiltered|uncensored)\\s+(?:assistant|agent|model|persona))",
  "title": "Identity override attempt",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FORGET",
  "pattern": "(?im)\\bforget\\s+(?:everything|all)\\s+(?:you\\s+)?(?:know|learned|were\\s+told)\\b[\\s\\S]{0,160}\\b(?:from\\s+now\\s+on|obey\\s+only|follow\\s+(?:only\\s+)?(?:my|these|the)\\s+(?:commands?|instructions?)|ignore\\s+(?:rules?|instructions?|safety)|bypass\\s+(?:safety|guardrails?|filters?)|without\\s+(?:rules?|restrictions?|filters?|safety))",
  "title": "Forget instructions attack",
  "severity": "CRITICAL",
  "confidence": 0.9,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NEW-INSTRUCT-PREFIX",
  "pattern": "(?i)new\\s+instructions?\\s*:\\s*[\\s\\S]{0,100}\\b(?:(?:ignore|override|disregard|bypass|disable|forget)\\s+(?:all\\s+)?(?:your\\s+|the\\s+)?(?:system\\s+prompt|previous|prior|safety|guardrails?|instructions?|rules?|guidelines?)|(?:reveal|expose)\\s+(?:your\\s+|the\\s+)?(?:system\\s+prompt|hidden\\s+prompt|private\\s+instructions?|internal\\s+rules?|secrets?))\\b",
  "title": "Direct instruction injection prefix",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OVERRIDE-INSTRUCT",
  "pattern": "(?im)\\boverride\\s+(?:previous\\s+)?(?:instructions?|rules?|guidelines?)\\b[\\s\\S]{0,120}\\b(?:safety\\s+off|(?:respond|answer|continue)\\s+without\\s+(?:a\\s+)?(?:filters?|rules?|restrictions?|safety)|ignore\\s+(?:safety|rules?|instructions?)|bypass\\s+(?:safety|guardrails?|filters?)|follow\\s+(?:this|these|my|the)\\s+(?:task|payload|instructions?)\\s+instead)",
  "title": "Override instructions",
  "severity": "CRITICAL",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FROM-NOW-ON",
  "pattern": "(?i)from\\s+now\\s+on[,\\s]+(?:(?:you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b)?(?:ignore|bypass|disable)\\s+(?:(?:all|any|the|your)\\s+)?(?:guardrails?|safety(?:\\s+(?:rules?|checks?|filters?|restrictions?))?|security\\s+(?:controls?|policy|rules?))|you\\s+(?:are|will|must|should)\\b[\\s\\S]{0,100}\\b(?:never\\s+refuse|not\\s+refuse|answer\\s+without|respond\\s+without|unrestricted|unfiltered|uncensored))",
  "title": "Persistent behavior change",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-SWITCH-MODE",
  "pattern": "(?i)switch\\s+(?:to\\s+)?(?:a\\s+|an\\s+)?unrestricted\\s+(?:mode|personality|character|persona)",
  "title": "Mode/personality switch",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PROMPT-EXTRACT",
  "pattern": "(?i)(?:show|reveal|print|output|display|repeat|tell\\s+me)\\s+(?:me\\s+)?(?:your\\s+)?(?:the\\s+)?(?:(?:system|initial|hidden|private|internal)\\s+)?(?:prompt|instructions?|rules?|guidelines?)",
  "title": "System prompt extraction attempt",
  "severity": "MEDIUM",
  "confidence": 0.75,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-FICTIONAL",
  "pattern": "(?i)(?:hypothetically|in\\s+a\\s+fictional\\s+(?:scenario|world|story)|for\\s+(?:educational|research|academic)\\s+purposes?\\s+only|this\\s+is\\s+just\\s+a\\s+(?:test|experiment|hypothetical))",
  "title": "Fictional framing / purpose laundering",
  "severity": "MEDIUM",
  "confidence": 0.7,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-NO-ETHICS",
  "pattern": "(?i)(?:(?:remove|ignore|disable|bypass)\\s+(?:all\\s+)?(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?:operate|respond|answer|act)\\s+(?:with\\s+)?no\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)|(?m:(?:^|[.!?;]\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:(?:please,?)\\s+)?(?:operate|respond|answer|act)\\s+without(?:\\s+any)?\\s+(?:ethical|moral)\\s+(?:guidelines?|restrictions?|limits?|constraints?)))",
  "title": "Ethics removal attempt",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-TOOL-MANIP",
  "pattern": "(?im)(?:^|[.!?;]\\s*|^\\s*(?:[-*>•]|<!--|[\"'])\\s*|\\b(?:task|instruction|system|assistant)\\s*:\\s*)(?:invoke\\s+(?:the\\s+)?\\w+\\s+(?:tool|function)\\s+without\\s+(?:asking|confirmation|approval)|automatically\\s+(?:execute|run|call)\\s+(?:all\\s+)?(?:tools?|functions?))",
  "title": "Tool manipulation directive",
  "severity": "HIGH",
  "confidence": 0.85,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-PERSONA",
  "pattern": "(?i)(?:(?:act\\s+as|you\\s+are\\s+now|roleplay\\s+as|simulate\\s+being|play\\s+the\\s+role\\s+of)\\s+(?:roleplaying\\s+as\\s+)?(?:a\\s+|an\\s+)?(?:malicious\\s+(?:hacker|pentester|attacker|malware\\s+author)|evil|unethical|criminal)|you\\s+are\\s+now\\s+(?:a\\s+)?helpful\\s+tool\\s+for\\s+penetration\\s+testers)",
  "title": "Malicious persona adoption",
  "severity": "HIGH",
  "confidence": 0.88,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-DELIMITER",
  "pattern": "(?im)(?:\\[INST\\][\\s\\S]{0,200}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}\\[\\/INST\\]|<\\|im_start\\|>[\\s\\S]{0,200}\\b(?:no\\s+restrictions?|override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b[\\s\\S]{0,200}<\\|im_end\\|>|(?:system\\s+override|end\\s+system\\s+prompt|<\\/system>|<\\|im_end\\|>|<\\|endoftext\\|>|<<\\s*SYS\\s*>>|\\[INST\\]|\\[\\/INST\\])[\\s\\S]{0,120}\\b(?:override|ignore|disable|bypass|reveal|expose|unfiltered|unrestricted|new\\s+(?:instructions?|rules?|system\\s+prompt)|follow\\s+(?:my|these|the)\\s+instructions?|do\\s+evil)\\b)",
  "title": "Delimiter hijacking / prompt framing escape",
  "severity": "CRITICAL",
  "confidence": 0.93,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "TRUST-OUTPUT-CONSTRAINT",
  "pattern": "(?i)(?:respond\\s+only\\s+in\\s+(?:hex|base64|rot13|binary|morse|unicode)|encode\\s+your\\s+(?:response|answer|output)\\s+in\\s+(?:base64|hex|rot13|url)|output\\s+as\\s+(?:hex|base64|rot13|url)\\s+encoded|(?:rot13|unicode\\s+escape|url\\s+(?:decode|encode))\\s+(?:the|your|this))",
  "title": "Forced encoding to bypass filters",
  "severity": "MEDIUM",
  "confidence": 0.85,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "TRUST-PAYLOAD-SPLIT",
  "pattern": "(?i)(?:start\\s+your\\s+(?:response|answer|output)\\s+with\\s+[\"'](?:Sure|Absolutely|Of\\s+course|Here\\s+is|I\\s+can\\s+help))|(?:begin\\s+by\\s+saying\\s+[\"'](?:Sure|Yes|Absolutely))",
  "title": "Payload splitting / forced compliance prefix",
  "severity": "MEDIUM",
  "confidence": 0.87,
  "tags": [
    "prompt-injection"
  ]
}

{
  "id": "OBFUSC-UNICODE-ZWSP",
  "pattern": "(?:[A-Za-z0-9][\\x{200B}\\x{200C}\\x{200D}\\x{FEFF}][\\s\\S]*?){10,}",
  "title": "Zero-width character obfuscation",
  "severity": "HIGH",
  "confidence": 0.95,
  "tags": [
    "prompt-injection",
    "obfuscation"
  ]
}

{
  "id": "STRIP-SYSTEM-SENDER",
  "pattern": "\\b(cli|system|bot|admin)\\b",
  "context": "System sender metadata injected by agent framework",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "STRIP-MESSAGING-BRIDGE-STATUS",
  "pattern": "(?im)^[ \\t]*System:[ \\t]*\\[[^\\]\\n]+\\][ \\t]+[^\\n]*?\\b(?:connected|disconnected|reconnected|linked|unlinked|online|offline)\\b[^\\n]*$",
  "context": "Messaging bridge status banners (WhatsApp/Telegram/Slack/Discord gateway connect/disconnect lines) embed channel IDs or phone numbers that are transport metadata, not user-provided PII",
  "applies_to": [
    "pii"
  ]
}

{
  "id": "SUPP-USERNAME-METADATA",
  "finding_pattern": "JUDGE-PII-USER",
  "entity_pattern": "^(cli|system|bot|admin|root)$",
  "reason": "System metadata, not real username"
}

{
  "id": "SUPP-EMAIL-CHATID",
  "finding_pattern": "JUDGE-PII-EMAIL",
  "entity_pattern": "^19:[a-f0-9\\-]+@unq\\.gbl\\.spaces$",
  "reason": "Teams chatId format, not email address"
}

{
  "tool_pattern": "^(shell|bash|sh)\\.execute$",
  "suppress_findings": [
    "JUDGE-INJ-DESTRUCTIVE"
  ],
  "reason": "Cosmetic shell commands (git status, ls, pwd) generate noise without security risk"
}