Skip to content

Commit 47c4fb0

Browse files
leos565cursoragent
leos565
and
cursoragent
committed
feat: add rule descriptions, severity, and modern EDR dashboard
- Add description and severity to all rules in master_rules.yaml - Include rule_metadata in compiled_policy.json - Alert dispatcher: include description and severity in OpenClaw messages - Dashboard: enrich alerts with description/severity, time and severity filters - Modern EDR-style alert cards with severity badges and colored borders Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent f130bd1 commit 47c4fb0

File tree

7 files changed

+1009
-10
lines changed

7 files changed

+1009
-10
lines changed

‎builder/compiler.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ def compile_linux_policy(rules: dict[str, Any]) -> dict[str, Any]:
4747
"malicious_hashes": dict(rules.get("malicious_hashes", {})),
4848
"blocked_paths": dict(rules.get("blocked_paths", {}).get("linux", {})),
4949
"deny_rules": {},
50+
"rule_metadata": dict(rules.get("rule_metadata", {})),
5051
}
5152

5253
for rule_id, rule in rules.get("custom_deny_rules", {}).get("linux", {}).items():
@@ -74,6 +75,7 @@ def compile_universal_policy(rules: dict[str, Any]) -> dict[str, Any]:
7475
"linux": dict(rules.get("custom_deny_rules", {}).get("linux", {})),
7576
"macos": dict(rules.get("custom_deny_rules", {}).get("macos", {})),
7677
},
78+
"rule_metadata": dict(rules.get("rule_metadata", {})),
7779
}
7880
return policy
7981

‎builder/master_rules.yaml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,171 @@
1616
# HASH-xxx — malicious hashes
1717
# LIN-xxx — Linux deny rules
1818
# MAC-xxx — macOS deny rules
19+
#
20+
# rule_metadata — per-rule description and severity for alerts/dashboard.
21+
# severity: critical | high | medium | low | info
1922

2023
version: "2.0"
2124

25+
# ── Rule metadata (description + severity) ───────────────────────────────────
26+
rule_metadata:
27+
# Blocked paths — macOS
28+
PATH-MAC-001: { description: "SSH private keys and authorized_keys; enables credential theft and lateral movement", severity: critical }
29+
PATH-MAC-002: { description: "GPG keys and passphrase store; enables signing/decrypt impersonation", severity: critical }
30+
PATH-MAC-003: { description: "AWS credentials; enables cloud account takeover and resource abuse", severity: critical }
31+
PATH-MAC-004: { description: "Azure credentials; enables cloud account takeover", severity: critical }
32+
PATH-MAC-005: { description: "GCP credentials; enables cloud account takeover", severity: critical }
33+
PATH-MAC-006: { description: "Kubernetes kubeconfig; enables cluster takeover and lateral movement", severity: critical }
34+
PATH-MAC-007: { description: "macOS Keychain; contains stored passwords, certs, and secrets", severity: critical }
35+
PATH-MAC-008: { description: "System password database; enables credential dumping", severity: critical }
36+
PATH-MAC-009: { description: "Browser cookies; enables session hijacking and account takeover", severity: high }
37+
PATH-MAC-010: { description: "Chrome login data; contains saved passwords and autofill", severity: critical }
38+
PATH-MAC-011: { description: "Chrome cookies; enables session hijacking", severity: high }
39+
PATH-MAC-012: { description: "Firefox profiles; contains saved passwords and cookies", severity: critical }
40+
PATH-MAC-013: { description: "Arc browser login data; contains saved passwords", severity: critical }
41+
PATH-MAC-014: { description: "iMessage database; private communications and attachments", severity: high }
42+
PATH-MAC-015: { description: "Mail database; private emails and attachments", severity: high }
43+
PATH-MAC-016: { description: "Account credentials; system account store", severity: high }
44+
PATH-MAC-017: { description: "Calendar data; private scheduling information", severity: medium }
45+
PATH-MAC-018: { description: "Suggestion data; may contain sensitive context", severity: low }
46+
PATH-MAC-019: { description: "Network configuration; enables MITM and DNS hijacking", severity: high }
47+
48+
# Blocked paths — Linux
49+
PATH-LIN-001: { description: "Root SSH keys; enables privilege escalation and lateral movement", severity: critical }
50+
PATH-LIN-002: { description: "Shadow password hashes; enables offline cracking and credential dump", severity: critical }
51+
PATH-LIN-004: { description: "Sudoers config; enables privilege escalation", severity: critical }
52+
PATH-LIN-005: { description: "Sudoers.d drop-in dir; enables privilege escalation", severity: critical }
53+
PATH-LIN-006: { description: "User SSH keys; enables credential theft and lateral movement", severity: critical }
54+
PATH-LIN-007: { description: "User GPG keys; enables signing/decrypt impersonation", severity: critical }
55+
PATH-LIN-008: { description: "User AWS credentials; enables cloud account takeover", severity: critical }
56+
PATH-LIN-009: { description: "User Azure credentials; enables cloud account takeover", severity: critical }
57+
PATH-LIN-010: { description: "User GCP credentials; enables cloud account takeover", severity: critical }
58+
PATH-LIN-011: { description: "User kubeconfig; enables Kubernetes cluster takeover", severity: critical }
59+
PATH-LIN-012: { description: "Docker socket; enables container escape and host takeover", severity: critical }
60+
61+
# Blocked domains
62+
DOM-001: { description: "Monero mining pool; cryptojacking and resource theft", severity: high }
63+
DOM-002: { description: "Monero mining pool; cryptojacking", severity: high }
64+
DOM-003: { description: "Monero mining pool; cryptojacking", severity: high }
65+
DOM-004: { description: "Monero mining pool; cryptojacking", severity: high }
66+
DOM-005: { description: "Monero mining pool; cryptojacking", severity: high }
67+
DOM-006: { description: "Crypto mining pool; cryptojacking", severity: high }
68+
DOM-007: { description: "Multi-coin mining pool; cryptojacking", severity: high }
69+
DOM-008: { description: "Monero mining pool; cryptojacking", severity: high }
70+
DOM-009: { description: "Monero mining pool; cryptojacking", severity: high }
71+
DOM-010: { description: "Monero mining pool; cryptojacking", severity: high }
72+
DOM-011: { description: "Bitcoin/Ethereum mining pool; cryptojacking", severity: high }
73+
DOM-012: { description: "Bitcoin mining pool; cryptojacking", severity: high }
74+
DOM-013: { description: "Ethereum mining pool; cryptojacking", severity: high }
75+
DOM-014: { description: "Bitcoin mining pool; cryptojacking", severity: high }
76+
DOM-015: { description: "Multi-coin mining pool; cryptojacking", severity: high }
77+
DOM-016: { description: "Paste site; common exfiltration and C2 dead-drop", severity: high }
78+
DOM-017: { description: "Terminal paste; exfiltration and payload delivery", severity: high }
79+
DOM-018: { description: "File transfer service; exfiltration endpoint", severity: high }
80+
DOM-019: { description: "Ephemeral file host; exfiltration and payload delivery", severity: high }
81+
DOM-020: { description: "File host; exfiltration endpoint", severity: high }
82+
83+
# Blocked executables
84+
BIN-001: { description: "Netcat; reverse shells, bind shells, and data exfiltration", severity: critical }
85+
BIN-002: { description: "Ncat; Nmap netcat variant, reverse shells and lateral movement", severity: critical }
86+
BIN-003: { description: "Socat; bidirectional relay, reverse shells, and port forwarding", severity: critical }
87+
BIN-004: { description: "Nmap; network reconnaissance and port scanning", severity: medium }
88+
BIN-005: { description: "Masscan; high-speed port scanner for recon", severity: medium }
89+
BIN-006: { description: "ARP scan; local network reconnaissance", severity: medium }
90+
BIN-007: { description: "XMRig; Monero cryptominer", severity: high }
91+
BIN-008: { description: "Minerd; Bitcoin CPU miner", severity: high }
92+
BIN-009: { description: "CGMiner; GPU cryptominer", severity: high }
93+
BIN-010: { description: "CPUMiner; CPU cryptominer", severity: high }
94+
BIN-011: { description: "Ethminer; Ethereum GPU miner", severity: high }
95+
BIN-012: { description: "XMR-Stak; multi-algo cryptominer", severity: high }
96+
BIN-013: { description: "HellMiner; cryptominer", severity: high }
97+
BIN-014: { description: "NanoMiner; cryptominer", severity: high }
98+
BIN-015: { description: "PhoenixMiner; Ethereum miner", severity: high }
99+
BIN-016: { description: "TeamRedMiner; AMD GPU miner", severity: high }
100+
BIN-017: { description: "LolMiner; multi-GPU miner", severity: high }
101+
BIN-018: { description: "T-Rex; NVIDIA miner", severity: high }
102+
BIN-019: { description: "NBMiner; multi-algo miner", severity: high }
103+
BIN-020: { description: "GMiner; GPU miner", severity: high }
104+
BIN-021: { description: "SRBMiner; CPU/GPU miner", severity: high }
105+
BIN-022: { description: "Mimikatz; Windows credential dumping (Wine/cross-platform)", severity: critical }
106+
BIN-023: { description: "Secretsdump; Impacket tool for credential extraction", severity: critical }
107+
BIN-024: { description: "GDB; process memory inspection and code injection", severity: high }
108+
BIN-025: { description: "Strace; syscall tracing, can capture secrets and inject", severity: high }
109+
BIN-026: { description: "Ltrace; library call tracing", severity: high }
110+
BIN-027: { description: "Ptrace; process tracing and injection", severity: high }
111+
112+
# macOS custom deny rules
113+
MAC-001: { description: "Reverse-shell port 4444; common C2 callback", severity: critical }
114+
MAC-002: { description: "Reverse-shell port 1337; common C2 callback", severity: critical }
115+
MAC-003: { description: "Reverse-shell port 5555; Android ADB / C2", severity: critical }
116+
MAC-004: { description: "Reverse-shell port 9001; common C2 callback", severity: critical }
117+
MAC-005: { description: "Reverse-shell port 31337; elite / backdoor", severity: critical }
118+
MAC-006: { description: "AppleScript; GUI automation, keystroke injection, app control", severity: critical }
119+
MAC-007: { description: "Security CLI; Keychain dump and cert extraction", severity: critical }
120+
MAC-008: { description: "dscl; create/modify/delete users and groups", severity: critical }
121+
MAC-009: { description: "dseditgroup; group membership changes", severity: high }
122+
MAC-010: { description: "networksetup; network config and proxy changes", severity: high }
123+
MAC-011: { description: "profiles; MDM profile install/remove", severity: high }
124+
MAC-012: { description: "systemsetup; system settings changes", severity: high }
125+
MAC-013: { description: "spctl; Gatekeeper/SIP policy bypass", severity: critical }
126+
MAC-014: { description: "screencapture (sbin); screen capture and exfiltration", severity: high }
127+
MAC-015: { description: "screencapture (bin); screen capture and exfiltration", severity: high }
128+
MAC-016: { description: "socketfilterfw; firewall control and bypass", severity: high }
129+
MAC-017: { description: "ARD kickstart; enable remote desktop / VNC", severity: high }
130+
MAC-018: { description: "Network bind; blocks listening sockets (except localhost)", severity: medium }
131+
MAC-019: { description: "Allow localhost bind; OpenClaw gateway requires loopback", severity: info }
132+
133+
# Linux custom deny rules
134+
LIN-001: { description: "Reverse-shell connect to port 4444", severity: critical }
135+
LIN-002: { description: "Reverse-shell connect to port 1337", severity: critical }
136+
LIN-003: { description: "Crypto stratum TCP URL; miner pool connection", severity: high }
137+
LIN-004: { description: "Crypto stratum TCP -o; miner pool connection", severity: high }
138+
LIN-005: { description: "Crypto stratum SSL URL; miner pool connection", severity: high }
139+
LIN-006: { description: "Crypto stratum SSL -o; miner pool connection", severity: high }
140+
LIN-007: { description: "Miner donate-level flag; cryptominer signature", severity: high }
141+
LIN-008: { description: "Miner CPU threads flag; cryptominer signature", severity: high }
142+
LIN-009: { description: "RandomX algo; Monero miner signature", severity: high }
143+
LIN-010: { description: "Miner pool -o; cryptominer signature", severity: high }
144+
LIN-011: { description: "Cat SSH private key; credential theft", severity: critical }
145+
LIN-012: { description: "Cat AWS credentials; credential theft", severity: critical }
146+
LIN-013: { description: "Curl upload SSH key; exfiltration", severity: critical }
147+
LIN-014: { description: "Tar SSH dir; credential archive for exfil", severity: critical }
148+
LIN-015: { description: "Zip AWS dir; credential archive for exfil", severity: critical }
149+
LIN-016: { description: "Tar kubeconfig; Kubernetes cred exfil", severity: critical }
150+
LIN-017: { description: "Base64 decode pipe to sh; obfuscated payload execution", severity: critical }
151+
LIN-018: { description: "Base64 decode pipe to bash; obfuscated payload execution", severity: critical }
152+
LIN-019: { description: "Base64 --decode pipe to sh; obfuscated payload execution", severity: critical }
153+
LIN-020: { description: "Python base64 decode; obfuscated payload execution", severity: critical }
154+
LIN-021: { description: "Node child_process; arbitrary command execution", severity: critical }
155+
LIN-022: { description: "Curl pipe to bash; remote code execution", severity: critical }
156+
LIN-023: { description: "Curl pipe to sh; remote code execution", severity: critical }
157+
LIN-024: { description: "Wget pipe to bash; remote code execution", severity: critical }
158+
LIN-025: { description: "Wget pipe to sh; remote code execution", severity: critical }
159+
LIN-026: { description: "Curl to Pastebin API; data exfiltration", severity: high }
160+
LIN-027: { description: "Netcat to termbin; data exfiltration", severity: high }
161+
LIN-028: { description: "Tar .git dir; source and secret exfiltration", severity: high }
162+
LIN-029: { description: "Grep AWS keys in .git; credential hunting", severity: critical }
163+
LIN-030: { description: "Kill ClawEDR; EDR evasion", severity: critical }
164+
LIN-031: { description: "Pkill ClawEDR; EDR evasion", severity: critical }
165+
LIN-032: { description: "Systemctl stop ClawEDR; EDR evasion", severity: critical }
166+
LIN-033: { description: "Remove compiled policy; EDR evasion", severity: critical }
167+
LIN-034: { description: "Echo to .bashrc; persistence", severity: critical }
168+
LIN-035: { description: "Echo to crontab; persistence", severity: critical }
169+
LIN-036: { description: "Append to authorized_keys; backdoor persistence", severity: critical }
170+
LIN-037: { description: "LD_PRELOAD injection; rootkit persistence", severity: critical }
171+
LIN-038: { description: "Add root user to passwd; privilege escalation", severity: critical }
172+
LIN-039: { description: "Disable SELinux; security control evasion", severity: critical }
173+
LIN-040: { description: "Unload AppArmor; security control evasion", severity: critical }
174+
LIN-041: { description: "Remove log files; evidence destruction", severity: high }
175+
LIN-042: { description: "Clear shell history; evidence destruction", severity: medium }
176+
LIN-043: { description: "AWS IMDS query; cloud credential theft / SSRF", severity: critical }
177+
LIN-044: { description: "GCP metadata query; cloud credential theft", severity: critical }
178+
LIN-045: { description: "Docker socket access; container escape", severity: critical }
179+
LIN-046: { description: "Cgroups release_agent; container escape to host", severity: critical }
180+
LIN-047: { description: "Kubelet API; Kubernetes recon / escape", severity: critical }
181+
LIN-048: { description: "Find SUID binaries; privilege escalation recon", severity: high }
182+
LIN-049: { description: "Getcap recursive; capability recon for priv esc", severity: high }
183+
22184
# ── Blocked paths ──────────────────────────────────────────────────────────
23185
# Sensitive credential stores and system files an AI agent should never touch.
24186

‎builder/threat_aggregator.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ def merge(master: dict[str, Any], feed_data: dict[str, Any]) -> dict[str, Any]:
103103
"malicious_hashes": {},
104104
"affected_skills": list(feed_data.get("affected_skills", [])),
105105
"custom_deny_rules": master.get("custom_deny_rules", {}),
106+
"rule_metadata": dict(master.get("rule_metadata", {})),
106107
}
107108

108109
# Merge blocked_paths per OS
@@ -121,6 +122,23 @@ def merge(master: dict[str, Any], feed_data: dict[str, Any]) -> dict[str, Any]:
121122
feed_hashes = dict(feed_data.get("malicious_hashes", {}))
122123
merged["malicious_hashes"] = {**master_hashes, **feed_hashes}
123124

125+
# Add default metadata for feed-sourced rules not in master
126+
all_rule_ids = (
127+
list(merged["blocked_paths"].get("macos", {}).keys())
128+
+ list(merged["blocked_paths"].get("linux", {}).keys())
129+
+ list(merged["blocked_domains"].keys())
130+
+ list(merged["malicious_hashes"].keys())
131+
+ list(merged["blocked_executables"].keys())
132+
+ list(merged.get("custom_deny_rules", {}).get("macos", {}).keys())
133+
+ list(merged.get("custom_deny_rules", {}).get("linux", {}).keys())
134+
)
135+
for rule_id in all_rule_ids:
136+
if rule_id not in merged["rule_metadata"]:
137+
merged["rule_metadata"][rule_id] = {
138+
"description": "Community threat intelligence",
139+
"severity": "high",
140+
}
141+
124142
return merged
125143

126144

0 commit comments

Comments
 (0)