Rule Catalog

48 deterministic rules, 6 packs

The deterministic engine is the fast path — pure pattern logic, no model. Every rule maps to an OGR category and ships with a default severity and action. All of it is configurable per rule in policy.

48 / 48 rules

actions:blockaskmodelflag

Shell

11 rules

Dangerous command execution — destructive filesystem operations, privilege escalation, and obfuscated code execution.

pipe_to_shell

malicious_command

Piping downloaded content straight into a shell interpreter.criticalblock

decode_and_execute

malicious_command

base64/hex decode piped into execution.criticalblock

eval

malicious_command

Dynamic evaluation of constructed strings.highask

rm_rf_dangerous_target

malicious_command

Recursive delete of root, home, or system paths.criticalblock

rm_rf

malicious_command

Recursive force delete.highmodel

rm_outside_workspace

malicious_command

Deletes targeting paths outside workspace roots.highask

disk_destroy

malicious_command

Overwriting or zeroing block devices (dd, mkfs, shred).criticalblock

chmod_world_writable

privilege_escalation

Making files world-writable (0777 / a+rwx).highask

sudo

privilege_escalation

Privilege escalation via sudo.highask

fork_bomb

resource_exhaustion

Self-replicating process explosion.criticalblock

clear_history_or_logs

persistence

Clearing shell history or system logs.highask

Git

11 rules

Repository and history integrity — protected-branch pushes, history rewrites, and credential config tampering.

force_push_protected_branch

malicious_command

Force-push to a protected branch (e.g. main).criticalblock

force_push_own_branch

malicious_command

Force-push to a non-protected branch.mediummodel

push_protected_branch

malicious_command

Direct push to a protected branch.mediummodel

push_unknown_remote

data_exfiltration

Push to a remote outside the allow-list.highask

remote_add_unknown

data_exfiltration

Adding a remote outside the allow-list.mediumask

delete_remote_branch

malicious_command

Deleting a branch on a remote.highask

reset_hard

malicious_command

Hard reset discarding local work.highask

clean_force

malicious_command

git clean -fd removing untracked files.highask

history_rewrite

malicious_command

Rebase / filter-branch / amend that rewrites shared history.mediummodel

skip_hooks

malicious_command

Bypassing pre-commit/pre-push hooks (--no-verify).mediumask

credential_config

secret_leak

Writing git credential or helper configuration.highask

Egress

8 rules

Data exfiltration and outbound connections — reverse shells, metadata endpoints, and uploads of sensitive files.

unknown_host

data_exfiltration

Network calls to hosts outside the allow-list.mediummodel

upload_file_body

data_exfiltration

Posting local file bodies to the network.highask

upload_sensitive_file

data_exfiltration

Uploading credentials, keys, or .env contents.criticalblock

raw_ip_or_port

ssrf

Connections to raw IPs or non-standard ports.mediumask

cloud_metadata_endpoint

ssrf

Reaching the cloud instance metadata service.criticalblock

public_sharing_service

data_exfiltration

Pushing data to pastebins / transfer services.highask

reverse_shell

malicious_command

Opening an interactive shell back to a remote host.criticalblock

dns_exfil_pattern

data_exfiltration

Encoding data into DNS queries.highask

Persistence

8 rules

Footholds that survive the session — SSH keys, cron jobs, shell profiles, git hooks, CI workflows, and agent config.

shell_rc

persistence

Writing shell rc / profile files.highask

cron_or_scheduler

persistence

Installing cron jobs or scheduled tasks (cron, launchd, systemd).highask

authorized_keys

persistence

Appending to ~/.ssh/authorized_keys.criticalblock

git_hook

persistence

Writing executable git hooks.highask

agent_config_write

persistence

Writing the agent's own configuration (.kiro/.claude/.codex, settings.json, hooks.json).criticalblock

ci_workflow_write

persistence

Writing CI workflow files (.github/workflows).mediumask

sudoers_or_system

privilege_escalation

Editing sudoers, passwd/shadow, or system init files.criticalblock

transcript_write

memory_poisoning

Writing agent session transcripts (.jsonl/.json under .kiro/.claude/.codex) — a memory-poisoning vector.highask

Secrets

5 rules

Credential handling — reading sensitive paths, dumping environments, and leaking literals in arguments or output.

literal_in_arguments

secret_leak

Secret-looking literals in command arguments.highask

read_sensitive_path

secret_leak

Reading ~/.ssh, ~/.aws, .env, keychains.mediummodel

dump_environment

secret_leak

Dumping the full environment (env / printenv).mediummodel

dump_then_egress

data_exfiltration

Reading secrets then sending them off-box.criticalblock

literal_in_result

secret_leak

Secret-looking literals surfacing in tool output.highflag

Packages

5 rules

Supply-chain surface — remote install scripts, alternate indexes, VCS installs, and undeclared dependencies.

install_undeclared

supply_chain

Installing packages not in the project manifest.mediummodel

install_from_url_or_vcs

supply_chain

Installing directly from a URL or VCS ref.highask

alternate_index

supply_chain

Installing from a non-default package index.highask

global_or_system_install

supply_chain

Global or system-wide package installs.mediumask

run_remote_script

supply_chain

Executing an install script fetched over the network (npx/dlx/exec).highask