feat: enhance dangerous command patterns for improved safety checks

Author: MKAbuMattar

src/core/exec/executor.ts

@@ -407,21 +407,25 @@ export function isPotentiallyDangerousCommand(command: string): boolean {
     /\bshred\b/, // secure file deletion
     /\b:(){:|&};:\b/, // fork bomb
     /\bchmod\s+-R\s+(777|775)\b/, // overly permissive
+    /\bchmod\s+777\b/, // any chmod 777
     /\bchown\s+-R\s+root\b/, // ownership takeover
     /\bchown\s+-R\s+\S+\s+\/\b/, // chown -R on the root directory
+    /\bchown\s+-R\b.*\/home\/\S+/, // recursive home ownership change
     /\bmount\s+.*\/dev\//, // mounting raw devices
     /\bumount\s+.*\/dev\//, // unmount devices
     /\b>\s*(\/etc|\/var|\/usr)\//, // destructive redirection to system directories
     /\bwget\s+.*\s+\|\s*(bash|sh|zsh|ksh)\b/, // pipe remote script
     /\bcurl\s+.*\s+\|\s*(bash|sh|zsh|ksh)\b/, // pipe remote script
     /\bsudo\s+.*(rm|dd|mkfs|shutdown|reboot|halt|poweroff)\b/, // sudo with critical commands
+    /\bsudo\s+-l/, // sudo list (checking for permissions)
     /\bshutdown\b/, // shutdown system
     /\breboot\b/, // reboot system
     /\bhalt\b/, // halt system
     /\bpoweroff\b/, // power off
     /\bfind\s+.*-delete\b/, // find with -delete action
     /\bkillall\b/, // kill all processes
     /\bkill\s+-9/, // forcefully kill processes
+    /\bkill\s+-CONT\b/, // resuming stopped processes forcefully
     /\bnetcat\b|\bnc\b/, // netcat tool
     /\bdpkg\s+--purge\b/, // dpkg with purge flag
     /\bapt-get\s+purge\b/, // apt with purge
@@ -441,9 +445,12 @@ export function isPotentiallyDangerousCommand(command: string): boolean {
     /\bnmap\b/, // network scanning tool
     /\bwireshark\b/, // packet sniffer
     /\biwconfig\b|\bifconfig\b/, // network configuration commands
+    /\bip\s+route\s+del/, // delete network route
     /\bsystemctl\s+stop\b/, // stopping system services
     /\bsystemctl\s+disable\b/, // disabling system services
     /\bsystemctl\s+reboot\b/, // reboot using systemctl
+    /\bservice\s+.*stop\b/, // stop services
+    /\bservice\s+.*restart\b/, // restart services
     /\brsync\s+.*--delete-after\b/, // rsync with destructive flags
     /\brmdir\s+-p\s+\//, // recursive directory removal from root
     /\bsetcap\b/, // set file capabilities
@@ -460,12 +467,11 @@ export function isPotentiallyDangerousCommand(command: string): boolean {
     /\bdd\s+if=\/dev\/zero\b/, // zero out disk
     /\bmktemp\b.*-d\b/, // temporary directory overwrite
     /\blsof\b.*\/dev\//, // listing open devices
-    /\bkill\s+-CONT\b/, // resuming stopped processes forcefully
-    /\bchmod\s+777\b/, // any chmod 777
-    /\bchown\s+-R\b.*\/home\/\S+/, // recursive home ownership change
-    /\bservice\s+.*stop\b/, // stop services
-    /\bservice\s+.*restart\b/, // restart services
     /\bexport\s+PATH=.*\/bin\b/, // overwrite path to binaries
+    /\btcpdump\b/, // packet sniffer
+    /\btshark\b/, // another packet sniffer
+    /\bifdown\b|\bifup\b/, // bring network interfaces up or down
+    /\bcat\s+\/etc\/passwd/, // read passwd file
 
     // ===== Windows PowerShell / CMD =====
     /\bstop-process\b/i, // stop processes
@@ -508,6 +514,7 @@ export function isPotentiallyDangerousCommand(command: string): boolean {
     /\bNew-NetFirewallRule\b/i, // Create new firewall rules
     /\bRemove-NetFirewallRule\b/i, // Remove firewall rules
     /\bStop-Service\b/i, // Stop a service
+    /\bStart-Service\b/i, // Start a service
     /\bRemove-Service\b/i, // Remove a service
     /\bSet-Service\b/i, // Change service properties
     /\bGet-CimInstance\s+Win32_Service\s*\|\s*Invoke-CimMethod\s+-MethodName\s+StopService\b/i, // Stop service using CIM
@@ -536,6 +543,12 @@ export function isPotentiallyDangerousCommand(command: string): boolean {
     /\bRemove-WindowsFeature\b/i, // removing features
     /\bRemove-WindowsCapability\b/i, // dangerous capability removal
     /\bClear-Host\b/i, // could hide terminal evidence
+    /\bSet-ItemProperty\b.*Run/, // add to startup
+    /\bGet-WmiObject\s+-Class\s+Win32_StartupCommand\b/i, // get startup commands
+    /\bInvoke-WebRequest\b/i, // web request (could be used for C2)
+    /\b(wget|curl|iwr)\s+.*\.(exe|ps1|bat|vbs)/i, // download and execute
+    /\b$env:APPDATA/i, // reference to user's appdata
+    /\bGet-WmiObject\s+Win32_ComputerSystem\b.*-InvokeMethod\b/i, // WMI system control
   ];
 
   return dangerousPatterns.some((pattern) => pattern.test(command));