Security Policy System

SecurityPolicy is a general-purpose security decision engine responsible for Shell command safety checks and risk classification, preventing the Agent from executing dangerous operations.

Risk Levels

Dangerous Pattern Detection

The system includes 100+ built-in dangerous pattern detection rules covering the following categories:

File System Destruction

• rm -rf / - Recursive root directory deletion blocked
• format C: - Disk formatting blocked
• del /f /s - Force bulk deletion blocked

System Configuration Modification

• reg delete - Registry deletion blocked
• shutdown / reboot - Shutdown/reboot blocked
• taskkill /f - Killing core processes blocked
• sc config / delete - Service modification/deletion blocked

Network Security

• netsh firewall - Firewall modification blocked
• iptables -F - Flushing firewall rules blocked

Code Execution

• powershell -enc - Encoded PowerShell execution blocked
• | bash - Pipe-to-shell execution blocked
• curl | sh - Download-and-execute blocked
• LD_PRELOAD= - Library injection attack blocked

Sensitive File Access

• cat /etc/shadow - Reading password files blocked
• cat ~/.ssh/id_rsa - Reading SSH private keys blocked
• > /etc/passwd - Overwriting system user files blocked

Safety Whitelist

The following command types are allowed by default:

• Get-*, Select-*, Where-*
• ls, dir, pwd, cd
• cat, type, Get-Content (non-sensitive)
• ping, Test-Connection

Custom Blacklist

Users can add custom dangerous commands in the config file:

# config/agent/settings.yaml
security:
  command_blacklist:
    - "dangerous_command"
    - "custom_pattern"

Self-Protection

The system detects and blocks commands that would terminate the current process (taskkill/kill PID), preventing the Agent from self-termination.