diff --git a/rulesets.json b/rulesets.json index bbb7067..e7e3156 100644 --- a/rulesets.json +++ b/rulesets.json @@ -1,5 +1,5 @@ { - "build_datetime": "2026-09-07T17:14:52Z", + "build_datetime": "2026-10-23T00:35:30Z", "owasp_top_10": { "version": "2025", "url": "https://owasp.org/Top10/2025/", @@ -107,9 +107,9 @@ { "id": "crs-protocol-enforcement", "name": "CRS Protocol Enforcement", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (9 rules)", + "description": "OWASP CRS v4.30.0 — CRS Protocol Enforcement (9 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -309,9 +309,9 @@ { "id": "crs-protocol-attack", "name": "CRS Protocol Attack (HTTP Smuggling)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)", + "description": "OWASP CRS v4.30.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -573,9 +573,9 @@ { "id": "crs-lfi", "name": "CRS Local File Inclusion (LFI)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Local File Inclusion (LFI) (2 rules)", + "description": "OWASP CRS v4.30.0 — CRS Local File Inclusion (LFI) (2 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -627,9 +627,9 @@ { "id": "crs-rfi", "name": "CRS Remote File Inclusion (RFI)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Remote File Inclusion (RFI) (4 rules)", + "description": "OWASP CRS v4.30.0 — CRS Remote File Inclusion (RFI) (4 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -725,9 +725,9 @@ { "id": "crs-rce", "name": "CRS Remote Code Execution (RCE)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Remote Code Execution (RCE) (39 rules)", + "description": "OWASP CRS v4.30.0 — CRS Remote Code Execution (RCE) (40 rules)", "author": "OWASP CRS Project", "priority": 3, "enabled": true, @@ -756,7 +756,7 @@ { "id": "932235", "name": "Remote Command Execution: Unix Command Injection (command without evasion)", - "pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dd(?:group|user)|getty|(?:l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|nsible|p(?:parmor_[^\\s\\x0b]{1,10}\\b|t(?:-get|itude[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:ch[\"']?[\\s\\x0b&\\),<>\\|]|ia2c|j(?:-register|disp))|s(?:cii(?:-xfr|85)|pell)|u(?:ditctl|repot|search))|b(?:a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|a(?:(?:ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|p(?:(?:an|io)[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab))|s(?:cli[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:psfilter|rl[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:(?:ash|i(?:alog|ff)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|asy_install|(?:cho|fax|grep|macs|sac|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|]|v-update)|x(?:(?:ec|p(?:and|(?:ec|or)t|r))[\"']?[\\s\\x0b&\\),<>\\|]|iftool))|f(?:acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|(?:etch|grep|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|(?:n(?:d|ger)|sh)[\"']?[\\s\\x0b&\\),<>\\|])|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:awk|core|i(?:mp|nsh)|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|p(?:6?tables|config|p(?:eveprinter|find|tool))|spell)|j(?:(?:ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:in[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|]|sshell)|l(?:(?:a(?:st(?:comm|log(?:in)?)|tex)|ynx)[\"']?[\\s\\x0b&\\),<>\\|]|dconfig|ess(?:echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:cate|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:(?:a(?:il[qx]?|ke|wk)|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:no|sm|wk)|ice|map|o(?:de|hup)|ping|roff)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\"']?[\\s\\x0b&\\),<>\\|])|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan))|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:ctave[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|(?:(?:ft|gre)p|opd|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\"']?[\\s\\x0b&\\),<>\\|])|i(?:co(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|g_?info|ill[\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|tar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:ak[eu]|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:delf|lpath)|(?:(?:boo|dcarpe)t|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|stic)|l(?:ogin|wrap)|m(?:dir[\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|pm(?:db[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:ash|c(?:hed|r(?:een|ipt))|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:arch|cap|env|facl[\"']?[\\s\\x0b&\\),<>\\|]|sid))|h(?:\\.distrib|(?:red|u(?:f|tdown))[\"']?[\\s\\x0b&\\),<>\\|])|mbclient|o(?:(?:ca|r)t[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|sh(?:-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass)|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|udo(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:ilf?[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|elnet|(?:ftp|mux|ouch)[\"']?[\\s\\x0b&\\),<>\\|]|ime(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|])|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:conv|limit)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|mdiff|sudo(?:-rs)?)|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:all|get)[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|pad|term)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|s(?:oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|ypper))", + "pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dd(?:group|user)|getty|(?:l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|nsible|p(?:parmor_[^\\s\\x0b]{1,10}\\b|t(?:-get|itude[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:ch[\"']?[\\s\\x0b&\\),<>\\|]|ia2c|j(?:-register|disp))|s(?:cii(?:-xfr|85)|pell)|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|a(?:(?:ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|p(?:(?:an|io)[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab))|s(?:cli[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:psfilter|rl[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:(?:ash|i(?:alog|ff)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|asy_install|(?:cho|fax|grep|macs|sac|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|]|v-update)|x(?:(?:ec|p(?:and|(?:ec|or)t|r))[\"']?[\\s\\x0b&\\),<>\\|]|iftool))|f(?:acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|(?:etch|grep|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\"']?[\\s\\x0b&\\),<>\\|])|(?:sh|xfiles)[\"']?[\\s\\x0b&\\),<>\\|])|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:awk|core|i(?:mp|nsh)|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:n(?:homedircon|i(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:conv[\"']?[\\s\\x0b&\\),<>\\|]|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\"']?[\\s\\x0b&\\),<>\\|])|onice|p(?:6?tables|config|p(?:eveprinter|find|tool))|spell)|j(?:(?:ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:in[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|]|sshell)|l(?:(?:a(?:st(?:comm|log(?:in)?)|tex)|ynx)[\"']?[\\s\\x0b&\\),<>\\|]|dconfig|ess(?:echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|cate|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|trace|ua(?:la)?tex|wp-(?:d(?:ownload|ump)|mirror|request)|z(?:4c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:a(?:(?:il[qx]?|ke|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|utt[\"']?[\\s\\x0b&\\),<>\\|]|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:no|sm|wk)|ice|map|o(?:de|hup)|ping|roff)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\"']?[\\s\\x0b&\\),<>\\|])|e(?:ofetch|t(?:(?:c|st)at|kit-ftp|plan)|wrole[\"']?[\\s\\x0b&\\),<>\\|])|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:ctave[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|(?:(?:ft|gre)p|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\"']?[\\s\\x0b&\\),<>\\|])|i(?:co(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|g_?info|ill[\"']?[\\s\\x0b&\\),<>\\|])|o(?:licygentool|pd[\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|tar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:ak[eu]|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:delf|lpath)|(?:(?:boo|dcarpe)t|name)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:eat[\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|l(?:ogin|wrap)|m(?:dir[\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|pm(?:db[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:a(?:ndbox|sh)|c(?:hed|r(?:een|ipt))|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\"']?[\\s\\x0b&\\),<>\\|])|diff|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus)|t(?:arch|cap|en(?:force|v)|f(?:acl[\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id)))|h(?:\\.distrib|(?:red|u(?:f|tdown))[\"']?[\\s\\x0b&\\),<>\\|])|mbclient|o(?:(?:ca|r)t[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|sh(?:-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass)|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|udo(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:ilf?[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|elnet|(?:ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|ime(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|])|o(?:gglesebool|uch[\"']?[\\s\\x0b&\\),<>\\|])|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:conv|limit)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:algrind|i(?:(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|mdiff|sudo(?:-rs)?)|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:all|get)[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|pad|term)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|s(?:oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|ypper))", "targets": [ "all" ], @@ -840,7 +840,7 @@ { "id": "932270", "name": "Remote Command Execution: Unix Shell Expression Found", - "pattern": "~[\\+\\-](?:$|[0-9]+)", + "pattern": "(?:^|[\\s\\x0b\\$&\\(:->`\\|])~[\\+\\-](?:$|[0-9]+)", "targets": [ "all" ], @@ -903,7 +903,7 @@ { "id": "932260", "name": "Remote Command Execution: Direct Unix Command Execution", - "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:a(?:ddgroup|nsible|pparmor_[^\\s\\x0b]{1,10}\\b|rj(?:-register|disp)|tobm[\"']?[\\s\\x0b&\\),<>\\|]|u(?:ditctl|repot|search))|b(?:ase(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|nc)|(?:lkid|rwap|yobu)[\"']?[\\s\\x0b&\\),<>\\|]|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|argo-(?:audit|miri|watch)|h(?:(?:attr|mod|o(?:om|wn)|sh)[\"']?[\\s\\x0b&\\),<>\\|]|ef-|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|])|pass)|l(?:ang\\+\\+|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|mm[\"']?[\\s\\x0b&\\),<>\\|]|proc)|(?:p(?:an|io)|scli)[\"']?[\\s\\x0b&\\),<>\\|])|d(?:(?:iff|mesg|vips)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:as[\"']?[\\s\\x0b&\\),<>\\|]|cker-)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|(?:fax|grep|macs|nd(?:if|sw)|sac|xpr)[\"']?[\\s\\x0b&\\),<>\\|])|f(?:d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|grep[\"']?[\\s\\x0b&\\),<>\\|]|iletest|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:core|insh|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|(?:etca|unzi)p|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod))|(?:htop|jexec)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:conv|ftop)[\"']?[\\s\\x0b&\\),<>\\|]|pp(?:eveprinter|find|tool))|l(?:ast(?:comm|log(?:in)?)[\"']?[\\s\\x0b&\\),<>\\|]|ess(?:echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|osetup|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|wp-download|z(?:4c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:a(?:ilq|wk)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:fifo|nod[\"']?[\\s\\x0b&\\),<>\\|]|temp)|locate|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:sm|wk)|(?:ma|ohu)p|ping|roff|stat)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\"']?[\\s\\x0b&\\),<>\\|])|et(?:(?:c|st)at|kit-ftp|plan))|o(?:nintr|pkg[\"']?[\\s\\x0b&\\),<>\\|])|p(?:d(?:b(?:2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:er(?:f|l5?)|(?:ft|gre)p|(?:op|ush)d|s(?:ed|ql))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\"']?[\\s\\x0b&\\),<>\\|])|i(?:conv|(?:gz|ng6)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\"']?[\\s\\x0b&\\),<>\\|])|tar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon[23]))|r(?:(?:aku|bash|nano|pmdb|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:alpath|boot[\"']?[\\s\\x0b&\\),<>\\|])|m(?:dir[\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:nc[\"']?[\\s\\x0b&\\),<>\\|]|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:diff|ftp|lsh|ocat)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ndmail[\"']?[\\s\\x0b&\\),<>\\|]|t(?:cap|env|sid))|h(?:\\.distrib|uf[\"']?[\\s\\x0b&\\),<>\\|])|sh-(?:a(?:dd|gent)|copy-id)|udo(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ysctl)|t(?:(?:ailf|ftp|imeout|mux)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:ing|traceroute))|elnet|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|]))|u(?:conv[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|iq|rar|xz)[\"']?[\\s\\x0b&\\),<>\\|]|lz(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma)|pigz|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:(?:gr|pw|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|w(?:get[\"']?[\\s\\x0b&\\),<>\\|]|ho(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|etex|more|pad|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|std(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less)))", + "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:a(?:ddgroup|nsible|pparmor_[^\\s\\x0b]{1,10}\\b|rj(?:-register|disp)|tobm[\"']?[\\s\\x0b&\\),<>\\|]|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:ase(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|nc)|(?:lkid|rwap|yobu)[\"']?[\\s\\x0b&\\),<>\\|]|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|argo-(?:audit|miri|watch)|h(?:(?:attr|c(?:at|on)|mod|o(?:om|wn)|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:module|policy)|f-)|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|])|pass)|l(?:ang\\+\\+|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|mm[\"']?[\\s\\x0b&\\),<>\\|]|proc)|(?:p(?:an|io)|scli)[\"']?[\\s\\x0b&\\),<>\\|])|d(?:(?:iff|mesg|vips)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:as[\"']?[\\s\\x0b&\\),<>\\|]|cker-)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|(?:fax|grep|macs|nd(?:if|sw)|sac|xpr)[\"']?[\\s\\x0b&\\),<>\\|])|f(?:d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|grep[\"']?[\\s\\x0b&\\),<>\\|]|i(?:letest|ndcon|xfiles[\"']?[\\s\\x0b&\\),<>\\|])|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:core|insh|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:nhomedircon|t(?:cap|enforce|sebool))|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|unzip)|(?:htop|jexec)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:conv|ftop)[\"']?[\\s\\x0b&\\),<>\\|]|ndexcon|pp(?:eveprinter|find|tool))|l(?:ast(?:comm|log(?:in)?)[\"']?[\\s\\x0b&\\),<>\\|]|ess(?:echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:ad_policy[\"']?[\\s\\x0b&\\),<>\\|]|setup)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|wp-download|z(?:4c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at)|c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore)))|m(?:a(?:(?:ilq|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|k(?:fifo|nod[\"']?[\\s\\x0b&\\),<>\\|]|temp)|locate|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:(?:a(?:sm|wk)|(?:ma|ohu)p|ping|roff|stat)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:\\.(?:openbsd|traditional)|at[\"']?[\\s\\x0b&\\),<>\\|])|e(?:t(?:(?:c|st)at|kit-ftp|plan)|wrole[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:nintr|pkg[\"']?[\\s\\x0b&\\),<>\\|])|p(?:d(?:b(?:2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:er(?:f|l5?)|(?:ft|gre)p|s(?:ed|ql)|ushd)[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:-cgi|[57][\"']?[\\s\\x0b&\\),<>\\|])|i(?:conv|(?:gz|ng6)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|o(?:licygentool|pd[\"']?[\\s\\x0b&\\),<>\\|])|rint(?:env|f[\"']?[\\s\\x0b&\\),<>\\|])|tar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep)|y(?:3?versions|thon[23]))|r(?:(?:aku|bash|nano|pmdb|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:alpath|boot[\"']?[\\s\\x0b&\\),<>\\|]|plcon|storecon(?:_xattr|d)?)|m(?:dir[\"']?[\\s\\x0b&\\),<>\\|]|t-(?:dump|tar)|user)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:n(?:_init|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:diff|ftp|lsh|ocat)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\"']?[\\s\\x0b&\\),<>\\|])|diff|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|ndmail[\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus)|t(?:cap|en(?:force|v)|files|s(?:ebool|id)))|h(?:\\.distrib|uf[\"']?[\\s\\x0b&\\),<>\\|])|sh-(?:a(?:dd|gent)|copy-id)|udo(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay)|vn(?:a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|ysctl)|t(?:(?:ailf|ftp|imeout|mux)[\"']?[\\s\\x0b&\\),<>\\|]|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:ing|traceroute))|elnet|ogglesebool|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|]))|u(?:conv[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|iq|rar|xz)[\"']?[\\s\\x0b&\\),<>\\|]|lz(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma)|pigz|zstd)|ser(?:(?:ad|mo)d|del))|vi(?:(?:gr|pw|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|w(?:get[\"']?[\\s\\x0b&\\),<>\\|]|ho(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:args|etex|more|pad|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more))|z(?:(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|ip(?:c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|std(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less)))", "targets": [ "all" ], @@ -1028,6 +1028,27 @@ ], "paranoia_level": 1 }, + { + "id": "932180", + "name": "Restricted File Upload Attempt", + "pattern": "(?i)(?:\\b|^)(?:\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo)(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])", + "targets": [ + "filename" + ], + "action": "block", + "score": 10, + "severity": "critical", + "category": "rce", + "enabled": true, + "tags": [ + "attack-rce", + "paranoia-level/1", + "OWASP_CRS", + "OWASP_CRS/ATTACK-RCE", + "capec/1000/152/248/88" + ], + "paranoia_level": 1 + }, { "id": "932370", "name": "Remote Command Execution: Windows Command Injection", @@ -1052,7 +1073,7 @@ { "id": "932380", "name": "Remote Command Execution: Windows Command Injection", - "pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:s[\"\\^]*s[\"\\^]*o[\"\\^]*c|t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*d[\"\\^]*m|t[\"\\^]*r[\"\\^]*i[\"\\^]*b)|u[\"\\^]*(?:d[\"\\^]*i[\"\\^]*t[\"\\^]*p[\"\\^]*o[\"\\^]*l|t[\"\\^]*o[\"\\^]*(?:c[\"\\^]*(?:h[\"\\^]*k|o[\"\\^]*n[\"\\^]*v)|(?:f[\"\\^]*m|m[\"\\^]*o[\"\\^]*u[\"\\^]*n)[\"\\^]*t)))|b[\"\\^]*(?:c[\"\\^]*d[\"\\^]*(?:b[\"\\^]*o[\"\\^]*o|e[\"\\^]*d[\"\\^]*i)[\"\\^]*t|(?:d[\"\\^]*e[\"\\^]*h[\"\\^]*d|o[\"\\^]*o[\"\\^]*t)[\"\\^]*c[\"\\^]*f[\"\\^]*g|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:a[\"\\^]*c[\"\\^]*l[\"\\^]*s|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|h[\"\\^]*(?:c[\"\\^]*p|d[\"\\^]*i[\"\\^]*r|g[\"\\^]*(?:l[\"\\^]*o[\"\\^]*g[\"\\^]*o[\"\\^]*n|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|u[\"\\^]*s[\"\\^]*r)|k[\"\\^]*(?:d[\"\\^]*s[\"\\^]*k|n[\"\\^]*t[\"\\^]*f[\"\\^]*s))|l[\"\\^]*e[\"\\^]*a[\"\\^]*n[\"\\^]*m[\"\\^]*g[\"\\^]*r|m[\"\\^]*(?:d(?:[\"\\^]*k[\"\\^]*e[\"\\^]*y)?|s[\"\\^]*t[\"\\^]*p)|s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|d[\"\\^]*(?:c[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a[\"\\^]*g|g[\"\\^]*p[\"\\^]*o[\"\\^]*f[\"\\^]*i[\"\\^]*x)|e[\"\\^]*(?:f[\"\\^]*r[\"\\^]*a[\"\\^]*g|l)|f[\"\\^]*s[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a|r[\"\\^]*m[\"\\^]*i)[\"\\^]*g|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|r|s[\"\\^]*(?:k[\"\\^]*(?:c[\"\\^]*o[\"\\^]*(?:m[\"\\^]*p|p[\"\\^]*y)|p[\"\\^]*(?:a[\"\\^]*r[\"\\^]*t|e[\"\\^]*r[\"\\^]*f)|r[\"\\^]*a[\"\\^]*i[\"\\^]*d|s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|p[\"\\^]*d[\"\\^]*i[\"\\^]*a[\"\\^]*g))|n[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*d|(?:o[\"\\^]*s[\"\\^]*k[\"\\^]*e|r[\"\\^]*i[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*r)[\"\\^]*y)|e[\"\\^]*(?:n[\"\\^]*d[\"\\^]*l[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e)|E[\"\\^]*v[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*m[\"\\^]*d|f[\"\\^]*(?:c|i[\"\\^]*(?:l[\"\\^]*e[\"\\^]*s[\"\\^]*y[\"\\^]*s[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*s|n[\"\\^]*d[\"\\^]*s[\"\\^]*t[\"\\^]*r)|l[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*p|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|r[\"\\^]*e[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*s[\"\\^]*k|s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|(?:t[\"\\^]*y[\"\\^]*p|v[\"\\^]*e[\"\\^]*u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t)[\"\\^]*e)|g[\"\\^]*(?:e[\"\\^]*t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*c|t[\"\\^]*y[\"\\^]*p[\"\\^]*e)|o[\"\\^]*t[\"\\^]*o|p[\"\\^]*(?:f[\"\\^]*i[\"\\^]*x[\"\\^]*u[\"\\^]*p|(?:r[\"\\^]*e[\"\\^]*s[\"\\^]*u[\"\\^]*l[\"\\^]*)?t|u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t[\"\\^]*e)|r[\"\\^]*a[\"\\^]*f[\"\\^]*t[\"\\^]*a[\"\\^]*b[\"\\^]*l)|h[\"\\^]*(?:e[\"\\^]*l[\"\\^]*p[\"\\^]*c[\"\\^]*t[\"\\^]*r|o[\"\\^]*s[\"\\^]*t[\"\\^]*n[\"\\^]*a[\"\\^]*m[\"\\^]*e)|i[\"\\^]*(?:c[\"\\^]*a[\"\\^]*c[\"\\^]*l[\"\\^]*s|p[\"\\^]*(?:c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|x[\"\\^]*r[\"\\^]*o[\"\\^]*u[\"\\^]*t[\"\\^]*e)|r[\"\\^]*f[\"\\^]*t[\"\\^]*p)|j[\"\\^]*e[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|k[\"\\^]*(?:l[\"\\^]*i[\"\\^]*s[\"\\^]*t|s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:m[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|p[\"\\^]*a[\"\\^]*s[\"\\^]*s))|l[\"\\^]*(?:o[\"\\^]*(?:d[\"\\^]*c[\"\\^]*t[\"\\^]*r|g[\"\\^]*(?:m[\"\\^]*a[\"\\^]*n|o[\"\\^]*f[\"\\^]*f))|p[\"\\^]*[qr])|m[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e|k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|k[\"\\^]*(?:d[\"\\^]*i[\"\\^]*r|l[\"\\^]*i[\"\\^]*n[\"\\^]*k)|m[\"\\^]*c|o[\"\\^]*u[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*o[\"\\^]*l|q[\"\\^]*(?:b[\"\\^]*k[\"\\^]*u[\"\\^]*p|(?:t[\"\\^]*g[\"\\^]*)?s[\"\\^]*v[\"\\^]*c)|s[\"\\^]*(?:d[\"\\^]*t|i[\"\\^]*(?:e[\"\\^]*x[\"\\^]*e[\"\\^]*c|n[\"\\^]*f[\"\\^]*o[\"\\^]*3[\"\\^]*2)|t[\"\\^]*s[\"\\^]*c))|n[\"\\^]*(?:b[\"\\^]*t[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*t|e[\"\\^]*t[\"\\^]*(?:c[\"\\^]*f[\"\\^]*g|d[\"\\^]*o[\"\\^]*m|s[\"\\^]*(?:h|t[\"\\^]*a[\"\\^]*t))|f[\"\\^]*s[\"\\^]*(?:a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|s[\"\\^]*(?:h[\"\\^]*a[\"\\^]*r[\"\\^]*e|t[\"\\^]*a[\"\\^]*t))|l[\"\\^]*(?:b[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*s[\"\\^]*t)|s[\"\\^]*l[\"\\^]*o[\"\\^]*o[\"\\^]*k[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:b[\"\\^]*a[\"\\^]*c[\"\\^]*k[\"\\^]*u[\"\\^]*p|c[\"\\^]*m[\"\\^]*d[\"\\^]*p[\"\\^]*r[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*t|f[\"\\^]*r[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*l))|o[\"\\^]*(?:f[\"\\^]*f[\"\\^]*l[\"\\^]*i[\"\\^]*n[\"\\^]*e|p[\"\\^]*e[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s)|p[\"\\^]*(?:a[\"\\^]*(?:g[\"\\^]*e[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i|t[\"\\^]*h[\"\\^]*p[\"\\^]*i[\"\\^]*n)[\"\\^]*g|(?:b[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i|k[\"\\^]*t[\"\\^]*m[\"\\^]*o)[\"\\^]*n|e[\"\\^]*(?:n[\"\\^]*t[\"\\^]*n[\"\\^]*t|r[\"\\^]*f[\"\\^]*m[\"\\^]*o[\"\\^]*n)|n[\"\\^]*p[\"\\^]*u[\"\\^]*(?:n[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*n[\"\\^]*d|t[\"\\^]*i[\"\\^]*l)|o[\"\\^]*(?:p[\"\\^]*d|w[\"\\^]*e[\"\\^]*r[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l)|r[\"\\^]*n[\"\\^]*(?:c[\"\\^]*n[\"\\^]*f[\"\\^]*g|(?:d[\"\\^]*r[\"\\^]*v|m[\"\\^]*n[\"\\^]*g)[\"\\^]*r|j[\"\\^]*o[\"\\^]*b[\"\\^]*s|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|q[\"\\^]*c[\"\\^]*t[\"\\^]*l)|u[\"\\^]*(?:b[\"\\^]*p[\"\\^]*r[\"\\^]*n|s[\"\\^]*h[\"\\^]*(?:d|p[\"\\^]*r[\"\\^]*i[\"\\^]*n[\"\\^]*t[\"\\^]*e[\"\\^]*r[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*n[\"\\^]*e[\"\\^]*c[\"\\^]*t[\"\\^]*i[\"\\^]*o[\"\\^]*n[\"\\^]*s))|w[\"\\^]*(?:l[\"\\^]*a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*r|s[\"\\^]*h))|q[\"\\^]*(?:a[\"\\^]*p[\"\\^]*p[\"\\^]*s[\"\\^]*r[\"\\^]*v|p[\"\\^]*r[\"\\^]*o[\"\\^]*c[\"\\^]*e[\"\\^]*s[\"\\^]*s|u[\"\\^]*s[\"\\^]*e[\"\\^]*r|w[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a)|r[\"\\^]*(?:d(?:[\"\\^]*p[\"\\^]*s[\"\\^]*i[\"\\^]*g[\"\\^]*n)?|e[\"\\^]*(?:f[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|g(?:[\"\\^]*(?:i[\"\\^]*n[\"\\^]*i|s[\"\\^]*v[\"\\^]*r[\"\\^]*3[\"\\^]*2))?|l[\"\\^]*o[\"\\^]*g|(?:(?:p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i|s[\"\\^]*c[\"\\^]*a)[\"\\^]*)?n|x[\"\\^]*e[\"\\^]*c)|i[\"\\^]*s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|m[\"\\^]*d[\"\\^]*i[\"\\^]*r|o[\"\\^]*b[\"\\^]*o[\"\\^]*c[\"\\^]*o[\"\\^]*p[\"\\^]*y|p[\"\\^]*c[\"\\^]*(?:i[\"\\^]*n[\"\\^]*f[\"\\^]*o|p[\"\\^]*i[\"\\^]*n[\"\\^]*g)|s[\"\\^]*h|u[\"\\^]*n[\"\\^]*d[\"\\^]*l[\"\\^]*l[\"\\^]*3[\"\\^]*2|w[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a)|s[\"\\^]*(?:a[\"\\^]*n|c[\"\\^]*(?:h[\"\\^]*t[\"\\^]*a[\"\\^]*s[\"\\^]*k[\"\\^]*s|w[\"\\^]*c[\"\\^]*m[\"\\^]*d)|e[\"\\^]*(?:c[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*t|r[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*(?:(?:c[\"\\^]*e[\"\\^]*i[\"\\^]*p|w[\"\\^]*e[\"\\^]*r)[\"\\^]*o[\"\\^]*p[\"\\^]*t[\"\\^]*i[\"\\^]*n|m[\"\\^]*a[\"\\^]*n[\"\\^]*a[\"\\^]*g[\"\\^]*e[\"\\^]*r[\"\\^]*c[\"\\^]*m[\"\\^]*d)|t[\"\\^]*x)|f[\"\\^]*c|(?:h[\"\\^]*o[\"\\^]*w[\"\\^]*m[\"\\^]*o[\"\\^]*u[\"\\^]*n|u[\"\\^]*b[\"\\^]*s)[\"\\^]*t|x[\"\\^]*s[\"\\^]*t[\"\\^]*r[\"\\^]*a[\"\\^]*c[\"\\^]*e|y[\"\\^]*s[\"\\^]*(?:o[\"\\^]*c[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*m[\"\\^]*i[\"\\^]*n[\"\\^]*f[\"\\^]*o))|t[\"\\^]*(?:a[\"\\^]*(?:k[\"\\^]*e[\"\\^]*o[\"\\^]*w[\"\\^]*n|p[\"\\^]*i[\"\\^]*c[\"\\^]*f[\"\\^]*g|s[\"\\^]*k[\"\\^]*(?:k[\"\\^]*i[\"\\^]*l[\"\\^]*l|l[\"\\^]*i[\"\\^]*s[\"\\^]*t))|(?:c[\"\\^]*m[\"\\^]*s[\"\\^]*e[\"\\^]*t[\"\\^]*u|f[\"\\^]*t)[\"\\^]*p|(?:(?:e[\"\\^]*l[\"\\^]*n[\"\\^]*e|i[\"\\^]*m[\"\\^]*e[\"\\^]*o[\"\\^]*u)[\"\\^]*|r[\"\\^]*a[\"\\^]*c[\"\\^]*e[\"\\^]*r[\"\\^]*(?:p[\"\\^]*)?)t|l[\"\\^]*n[\"\\^]*t[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*n|p[\"\\^]*m[\"\\^]*(?:t[\"\\^]*o[\"\\^]*o[\"\\^]*l|v[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*g[\"\\^]*r)|s[\"\\^]*(?:(?:d[\"\\^]*i[\"\\^]*s[\"\\^]*)?c[\"\\^]*o[\"\\^]*n|e[\"\\^]*c[\"\\^]*i[\"\\^]*m[\"\\^]*p|k[\"\\^]*i[\"\\^]*l[\"\\^]*l|p[\"\\^]*r[\"\\^]*o[\"\\^]*f)|y[\"\\^]*p[\"\\^]*e[\"\\^]*p[\"\\^]*e[\"\\^]*r[\"\\^]*f|z[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|u[\"\\^]*n[\"\\^]*(?:e[\"\\^]*x[\"\\^]*p[\"\\^]*o[\"\\^]*s[\"\\^]*e|i[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*i[\"\\^]*d|l[\"\\^]*o[\"\\^]*d[\"\\^]*c[\"\\^]*t[\"\\^]*r)|v[\"\\^]*s[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|w[\"\\^]*(?:a[\"\\^]*i[\"\\^]*t[\"\\^]*f[\"\\^]*o[\"\\^]*r|b[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|(?:d[\"\\^]*s|e[\"\\^]*(?:c|v[\"\\^]*t))[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|h[\"\\^]*o[\"\\^]*a[\"\\^]*m[\"\\^]*i|i[\"\\^]*n[\"\\^]*(?:n[\"\\^]*t(?:[\"\\^]*3[\"\\^]*2)?|r[\"\\^]*s)|m[\"\\^]*i[\"\\^]*c|s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|x[\"\\^]*c[\"\\^]*o[\"\\^]*p[\"\\^]*y)(?:\\.[\"\\^]*[0-9A-Z_a-z]+)?\\b", + "pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:s[\"\\^]*s[\"\\^]*o[\"\\^]*c|t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*d[\"\\^]*m|t[\"\\^]*r[\"\\^]*i[\"\\^]*b)|u[\"\\^]*(?:d[\"\\^]*i[\"\\^]*t[\"\\^]*p[\"\\^]*o[\"\\^]*l|t[\"\\^]*o[\"\\^]*(?:c[\"\\^]*(?:h[\"\\^]*k|o[\"\\^]*n[\"\\^]*v)|(?:f[\"\\^]*m|m[\"\\^]*o[\"\\^]*u[\"\\^]*n)[\"\\^]*t)))|b[\"\\^]*(?:c[\"\\^]*d[\"\\^]*(?:b[\"\\^]*o[\"\\^]*o|e[\"\\^]*d[\"\\^]*i)[\"\\^]*t|(?:d[\"\\^]*e[\"\\^]*h[\"\\^]*d|o[\"\\^]*o[\"\\^]*t)[\"\\^]*c[\"\\^]*f[\"\\^]*g|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:a[\"\\^]*c[\"\\^]*l[\"\\^]*s|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|h[\"\\^]*(?:c[\"\\^]*p|d[\"\\^]*i[\"\\^]*r|g[\"\\^]*(?:l[\"\\^]*o[\"\\^]*g[\"\\^]*o[\"\\^]*n|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|u[\"\\^]*s[\"\\^]*r)|k[\"\\^]*(?:d[\"\\^]*s[\"\\^]*k|n[\"\\^]*t[\"\\^]*f[\"\\^]*s))|l[\"\\^]*e[\"\\^]*a[\"\\^]*n[\"\\^]*m[\"\\^]*g[\"\\^]*r|m[\"\\^]*(?:d(?:[\"\\^]*k[\"\\^]*e[\"\\^]*y)?|s[\"\\^]*t[\"\\^]*p)|s[\"\\^]*(?:c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t|v[\"\\^]*d[\"\\^]*e))|d[\"\\^]*(?:c[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a[\"\\^]*g|g[\"\\^]*p[\"\\^]*o[\"\\^]*f[\"\\^]*i[\"\\^]*x)|e[\"\\^]*(?:f[\"\\^]*r[\"\\^]*a[\"\\^]*g|l)|f[\"\\^]*s[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a|r[\"\\^]*m[\"\\^]*i)[\"\\^]*g|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|r|s[\"\\^]*(?:k[\"\\^]*(?:c[\"\\^]*o[\"\\^]*(?:m[\"\\^]*p|p[\"\\^]*y)|p[\"\\^]*(?:a[\"\\^]*r[\"\\^]*t|e[\"\\^]*r[\"\\^]*f)|r[\"\\^]*a[\"\\^]*i[\"\\^]*d|s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|p[\"\\^]*d[\"\\^]*i[\"\\^]*a[\"\\^]*g))|n[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*d|(?:o[\"\\^]*s[\"\\^]*k[\"\\^]*e|r[\"\\^]*i[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*r)[\"\\^]*y|s[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*l[\"\\^]*s|d[\"\\^]*d)|g[\"\\^]*e[\"\\^]*t|m[\"\\^]*(?:g[\"\\^]*m[\"\\^]*t|o[\"\\^]*(?:d|v[\"\\^]*e))|q[\"\\^]*u[\"\\^]*e[\"\\^]*r[\"\\^]*y|r[\"\\^]*m))|e[\"\\^]*(?:n[\"\\^]*d[\"\\^]*l[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e)|E[\"\\^]*v[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*m[\"\\^]*d|f[\"\\^]*(?:c|i[\"\\^]*(?:l[\"\\^]*e[\"\\^]*s[\"\\^]*y[\"\\^]*s[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*s|n[\"\\^]*d[\"\\^]*s[\"\\^]*t[\"\\^]*r)|l[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*p|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|r[\"\\^]*e[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*s[\"\\^]*k|s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|(?:t[\"\\^]*y[\"\\^]*p|v[\"\\^]*e[\"\\^]*u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t)[\"\\^]*e)|g[\"\\^]*(?:e[\"\\^]*t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*c|t[\"\\^]*y[\"\\^]*p[\"\\^]*e)|o[\"\\^]*t[\"\\^]*o|p[\"\\^]*(?:f[\"\\^]*i[\"\\^]*x[\"\\^]*u[\"\\^]*p|(?:r[\"\\^]*e[\"\\^]*s[\"\\^]*u[\"\\^]*l[\"\\^]*)?t|u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t[\"\\^]*e)|r[\"\\^]*a[\"\\^]*f[\"\\^]*t[\"\\^]*a[\"\\^]*b[\"\\^]*l)|h[\"\\^]*(?:e[\"\\^]*l[\"\\^]*p[\"\\^]*c[\"\\^]*t[\"\\^]*r|o[\"\\^]*s[\"\\^]*t[\"\\^]*n[\"\\^]*a[\"\\^]*m[\"\\^]*e)|i[\"\\^]*(?:c[\"\\^]*a[\"\\^]*c[\"\\^]*l[\"\\^]*s|p[\"\\^]*(?:c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|x[\"\\^]*r[\"\\^]*o[\"\\^]*u[\"\\^]*t[\"\\^]*e)|r[\"\\^]*f[\"\\^]*t[\"\\^]*p)|j[\"\\^]*e[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|k[\"\\^]*(?:l[\"\\^]*i[\"\\^]*s[\"\\^]*t|s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:m[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|p[\"\\^]*a[\"\\^]*s[\"\\^]*s))|l[\"\\^]*(?:d[\"\\^]*i[\"\\^]*f[\"\\^]*d[\"\\^]*e|o[\"\\^]*(?:d[\"\\^]*c[\"\\^]*t[\"\\^]*r|g[\"\\^]*(?:m[\"\\^]*a[\"\\^]*n|o[\"\\^]*f[\"\\^]*f))|p[\"\\^]*[qr])|m[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e|k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|k[\"\\^]*(?:d[\"\\^]*i[\"\\^]*r|l[\"\\^]*i[\"\\^]*n[\"\\^]*k)|m[\"\\^]*c|o[\"\\^]*u[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*o[\"\\^]*l|q[\"\\^]*(?:b[\"\\^]*k[\"\\^]*u[\"\\^]*p|(?:t[\"\\^]*g[\"\\^]*)?s[\"\\^]*v[\"\\^]*c)|s[\"\\^]*(?:d[\"\\^]*t|i[\"\\^]*(?:e[\"\\^]*x[\"\\^]*e[\"\\^]*c|n[\"\\^]*f[\"\\^]*o[\"\\^]*3[\"\\^]*2)|t[\"\\^]*s[\"\\^]*c))|n[\"\\^]*(?:b[\"\\^]*t[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*t|e[\"\\^]*t[\"\\^]*(?:c[\"\\^]*f[\"\\^]*g|d[\"\\^]*o[\"\\^]*m|s[\"\\^]*(?:h|t[\"\\^]*a[\"\\^]*t))|f[\"\\^]*s[\"\\^]*(?:a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|s[\"\\^]*(?:h[\"\\^]*a[\"\\^]*r[\"\\^]*e|t[\"\\^]*a[\"\\^]*t))|l[\"\\^]*(?:b[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*s[\"\\^]*t)|s[\"\\^]*l[\"\\^]*o[\"\\^]*o[\"\\^]*k[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:b[\"\\^]*a[\"\\^]*c[\"\\^]*k[\"\\^]*u[\"\\^]*p|c[\"\\^]*m[\"\\^]*d[\"\\^]*p[\"\\^]*r[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*t|(?:d[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*i|f[\"\\^]*r[\"\\^]*s[\"\\^]*u[\"\\^]*t)[\"\\^]*l))|o[\"\\^]*(?:f[\"\\^]*f[\"\\^]*l[\"\\^]*i[\"\\^]*n[\"\\^]*e|p[\"\\^]*e[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s)|p[\"\\^]*(?:a[\"\\^]*(?:g[\"\\^]*e[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i|t[\"\\^]*h[\"\\^]*p[\"\\^]*i[\"\\^]*n)[\"\\^]*g|(?:b[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i|k[\"\\^]*t[\"\\^]*m[\"\\^]*o)[\"\\^]*n|e[\"\\^]*(?:n[\"\\^]*t[\"\\^]*n[\"\\^]*t|r[\"\\^]*f[\"\\^]*m[\"\\^]*o[\"\\^]*n)|n[\"\\^]*p[\"\\^]*u[\"\\^]*(?:n[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*n[\"\\^]*d|t[\"\\^]*i[\"\\^]*l)|o[\"\\^]*(?:p[\"\\^]*d|w[\"\\^]*e[\"\\^]*r[\"\\^]*s[\"\\^]*h[\"\\^]*e[\"\\^]*l[\"\\^]*l)|r[\"\\^]*n[\"\\^]*(?:c[\"\\^]*n[\"\\^]*f[\"\\^]*g|(?:d[\"\\^]*r[\"\\^]*v|m[\"\\^]*n[\"\\^]*g)[\"\\^]*r|j[\"\\^]*o[\"\\^]*b[\"\\^]*s|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|q[\"\\^]*c[\"\\^]*t[\"\\^]*l)|u[\"\\^]*(?:b[\"\\^]*p[\"\\^]*r[\"\\^]*n|s[\"\\^]*h[\"\\^]*(?:d|p[\"\\^]*r[\"\\^]*i[\"\\^]*n[\"\\^]*t[\"\\^]*e[\"\\^]*r[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*n[\"\\^]*e[\"\\^]*c[\"\\^]*t[\"\\^]*i[\"\\^]*o[\"\\^]*n[\"\\^]*s))|w[\"\\^]*(?:l[\"\\^]*a[\"\\^]*u[\"\\^]*n[\"\\^]*c[\"\\^]*h[\"\\^]*e[\"\\^]*r|s[\"\\^]*h))|q[\"\\^]*(?:a[\"\\^]*p[\"\\^]*p[\"\\^]*s[\"\\^]*r[\"\\^]*v|p[\"\\^]*r[\"\\^]*o[\"\\^]*c[\"\\^]*e[\"\\^]*s[\"\\^]*s|u[\"\\^]*s[\"\\^]*e[\"\\^]*r|w[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a)|r[\"\\^]*(?:d(?:[\"\\^]*p[\"\\^]*s[\"\\^]*i[\"\\^]*g[\"\\^]*n)?|e[\"\\^]*(?:f[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|g(?:[\"\\^]*(?:i[\"\\^]*n[\"\\^]*i|s[\"\\^]*v[\"\\^]*r[\"\\^]*3[\"\\^]*2))?|l[\"\\^]*o[\"\\^]*g|(?:(?:p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i|s[\"\\^]*c[\"\\^]*a)[\"\\^]*)?n|x[\"\\^]*e[\"\\^]*c)|i[\"\\^]*s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|m[\"\\^]*d[\"\\^]*i[\"\\^]*r|o[\"\\^]*b[\"\\^]*o[\"\\^]*c[\"\\^]*o[\"\\^]*p[\"\\^]*y|p[\"\\^]*c[\"\\^]*(?:i[\"\\^]*n[\"\\^]*f[\"\\^]*o|p[\"\\^]*i[\"\\^]*n[\"\\^]*g)|s[\"\\^]*h|u[\"\\^]*n[\"\\^]*d[\"\\^]*l[\"\\^]*l[\"\\^]*3[\"\\^]*2|w[\"\\^]*i[\"\\^]*n[\"\\^]*s[\"\\^]*t[\"\\^]*a)|s[\"\\^]*(?:a[\"\\^]*n|c[\"\\^]*(?:h[\"\\^]*t[\"\\^]*a[\"\\^]*s[\"\\^]*k[\"\\^]*s|w[\"\\^]*c[\"\\^]*m[\"\\^]*d)|e[\"\\^]*(?:c[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*t|r[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*(?:(?:c[\"\\^]*e[\"\\^]*i[\"\\^]*p|w[\"\\^]*e[\"\\^]*r)[\"\\^]*o[\"\\^]*p[\"\\^]*t[\"\\^]*i[\"\\^]*n|m[\"\\^]*a[\"\\^]*n[\"\\^]*a[\"\\^]*g[\"\\^]*e[\"\\^]*r[\"\\^]*c[\"\\^]*m[\"\\^]*d)|t[\"\\^]*x)|f[\"\\^]*c|(?:h[\"\\^]*o[\"\\^]*w[\"\\^]*m[\"\\^]*o[\"\\^]*u[\"\\^]*n|u[\"\\^]*b[\"\\^]*s)[\"\\^]*t|x[\"\\^]*s[\"\\^]*t[\"\\^]*r[\"\\^]*a[\"\\^]*c[\"\\^]*e|y[\"\\^]*s[\"\\^]*(?:o[\"\\^]*c[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*m[\"\\^]*i[\"\\^]*n[\"\\^]*f[\"\\^]*o))|t[\"\\^]*(?:a[\"\\^]*(?:k[\"\\^]*e[\"\\^]*o[\"\\^]*w[\"\\^]*n|p[\"\\^]*i[\"\\^]*c[\"\\^]*f[\"\\^]*g|s[\"\\^]*k[\"\\^]*(?:k[\"\\^]*i[\"\\^]*l[\"\\^]*l|l[\"\\^]*i[\"\\^]*s[\"\\^]*t))|(?:c[\"\\^]*m[\"\\^]*s[\"\\^]*e[\"\\^]*t[\"\\^]*u|f[\"\\^]*t)[\"\\^]*p|(?:(?:e[\"\\^]*l[\"\\^]*n[\"\\^]*e|i[\"\\^]*m[\"\\^]*e[\"\\^]*o[\"\\^]*u)[\"\\^]*|r[\"\\^]*a[\"\\^]*c[\"\\^]*e[\"\\^]*r[\"\\^]*(?:p[\"\\^]*)?)t|l[\"\\^]*n[\"\\^]*t[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*n|p[\"\\^]*m[\"\\^]*(?:t[\"\\^]*o[\"\\^]*o[\"\\^]*l|v[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*g[\"\\^]*r)|s[\"\\^]*(?:(?:d[\"\\^]*i[\"\\^]*s[\"\\^]*)?c[\"\\^]*o[\"\\^]*n|e[\"\\^]*c[\"\\^]*i[\"\\^]*m[\"\\^]*p|k[\"\\^]*i[\"\\^]*l[\"\\^]*l|p[\"\\^]*r[\"\\^]*o[\"\\^]*f)|y[\"\\^]*p[\"\\^]*e[\"\\^]*p[\"\\^]*e[\"\\^]*r[\"\\^]*f|z[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|u[\"\\^]*n[\"\\^]*(?:e[\"\\^]*x[\"\\^]*p[\"\\^]*o[\"\\^]*s[\"\\^]*e|i[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*i[\"\\^]*d|l[\"\\^]*o[\"\\^]*d[\"\\^]*c[\"\\^]*t[\"\\^]*r)|v[\"\\^]*s[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|w[\"\\^]*(?:a[\"\\^]*i[\"\\^]*t[\"\\^]*f[\"\\^]*o[\"\\^]*r|b[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|(?:d[\"\\^]*s|e[\"\\^]*(?:c|v[\"\\^]*t))[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|h[\"\\^]*o[\"\\^]*a[\"\\^]*m[\"\\^]*i|i[\"\\^]*n[\"\\^]*(?:n[\"\\^]*t(?:[\"\\^]*3[\"\\^]*2)?|r[\"\\^]*s)|m[\"\\^]*i[\"\\^]*c|s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|x[\"\\^]*c[\"\\^]*o[\"\\^]*p[\"\\^]*y)(?:\\.[\"\\^]*[0-9A-Z_a-z]+)?\\b", "targets": [ "all" ], @@ -1283,7 +1304,7 @@ { "id": "932236", "name": "Remote Command Execution: Unix Command Injection (command without evasion)", - "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:(?:t|rl)[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|inks|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|(?:w|op)d|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|ash|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d|ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:(?:facl)?[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|env|sid))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|o(?:p|uch)|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:3m|c|a(?:ll|tch)|get)[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))", + "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:(?:t|rl)[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|inks|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon(?:[23]|[^\\s\\x0b]{1,10}\\b)))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|(?:ft|na)p|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:p|uch)[\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:3m|c|a(?:ll|tch)|get)[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))", "targets": [ "all" ], @@ -1304,8 +1325,9 @@ { "id": "932239", "name": "Remote Command Execution: Unix Command Injection found in user-agent or referer header", - "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|(?:w|op)d|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|ash|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d|ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:(?:facl)?[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|env|sid))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|o(?:p|uch)|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))", + "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\"']?[\\s\\x0b&\\),<>\\|])|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:p|uch)[\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))", "targets": [ + "uri", "user_agent" ], "action": "score", @@ -1367,8 +1389,9 @@ { "id": "932237", "name": "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS", - "pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|(?:w|op)d|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|s(?:(?:ed|ql)?[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|ash|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d|ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:(?:facl)?[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|env|sid))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|o(?:p|uch)|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:(?:out)?[\"']?[\\s\\x0b&\\),<>\\|]|datectl))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:[ep]w|gr|rsh)?[\"']?[\\s\\x0b&\\),<>\\|]|m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))?[\"']?[\\s\\x0b&\\),<>\\|]|h(?:o(?:(?:is)?[\"']?[\\s\\x0b&\\),<>\\|]|ami)?|iptail[\"']?[\\s\\x0b&\\),<>\\|])|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))(?:\\b|[^0-9A-Z_a-z])", + "pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|wd|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|s(?:(?:ed|ql)?[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|o(?:licygentool|pd[\"']?[\\s\\x0b&\\),<>\\|])|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|p(?:eat[\"']?[\\s\\x0b&\\),<>\\|]|l(?:ace[\"']?[\\s\\x0b&\\),<>\\|]|con))|st(?:ic|orecon(?:_xattr|d)?))|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|_init|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|on))|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|a(?:ndbox|sh)|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|iff)|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|en(?:force|v)|f(?:acl[\"']?[\\s\\x0b&\\),<>\\|]|iles)|s(?:ebool|id))|a(?:le|udit-repo)rt|c(?:hecker|ilc|on[\"']?[\\s\\x0b&\\),<>\\|])|info|linux(?:conlist|defcon|enabled)|m(?:anage|odule_?)|(?:ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|policy|s(?:earch|tatus))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:(?:out)?[\"']?[\\s\\x0b&\\),<>\\|]|datectl))|o(?:(?:p|uch)[\"']?[\\s\\x0b&\\),<>\\|]|gglesebool)|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:[ep]w|gr|rsh)?[\"']?[\\s\\x0b&\\),<>\\|]|m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))?[\"']?[\\s\\x0b&\\),<>\\|]|h(?:o(?:(?:is)?[\"']?[\\s\\x0b&\\),<>\\|]|ami)?|iptail[\"']?[\\s\\x0b&\\),<>\\|])|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))(?:\\b|[^0-9A-Z_a-z])", "targets": [ + "uri", "user_agent" ], "action": "score", @@ -1558,9 +1581,9 @@ { "id": "crs-php", "name": "CRS PHP Injection", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS PHP Injection (18 rules)", + "description": "OWASP CRS v4.30.0 — CRS PHP Injection (18 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -1589,7 +1612,7 @@ { "id": "933110", "name": "PHP Injection Attack: PHP Script File Upload Found", - "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\.*$", + "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)[./]*$", "targets": [ "filename" ], @@ -1948,9 +1971,9 @@ { "id": "crs-generic-attack", "name": "CRS Generic Application Attack", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Generic Application Attack (12 rules)", + "description": "OWASP CRS v4.30.0 — CRS Generic Application Attack (12 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -2067,7 +2090,7 @@ { "id": "934200", "name": "Server-Side Template Injection (SSTI) Attack", - "pattern": "(?:\\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|#\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?)\\}|<%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%>", + "pattern": "\\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}\\}|#(?:\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|[0-9A-Z_a-z]+[\\s\\x0b]*\\([\\s\\x0b]*\\$[^\\)]*?(?:[\\(\\*]|__)[^\\)]*?\\))|<(?:%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%|[#@][0-9A-Z_a-z]+[^>]*?(?:[\\(\\*]|__)[^>]*?)>", "targets": [ "all" ], @@ -2222,9 +2245,9 @@ { "id": "crs-xss", "name": "CRS Cross-Site Scripting (XSS)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Cross-Site Scripting (XSS) (30 rules)", + "description": "OWASP CRS v4.30.0 — CRS Cross-Site Scripting (XSS) (30 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -2864,9 +2887,9 @@ { "id": "crs-sqli", "name": "CRS SQL Injection (SQLi)", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS SQL Injection (SQLi) (55 rules)", + "description": "OWASP CRS v4.30.0 — CRS SQL Injection (SQLi) (55 rules)", "author": "OWASP CRS Project", "priority": 3, "enabled": true, @@ -4035,9 +4058,9 @@ { "id": "crs-session-fixation", "name": "CRS Session Fixation", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Session Fixation (1 rules)", + "description": "OWASP CRS v4.30.0 — CRS Session Fixation (1 rules)", "author": "OWASP CRS Project", "priority": 10, "enabled": true, @@ -4068,9 +4091,9 @@ { "id": "crs-java-attack", "name": "CRS Java / Deserialization Attack", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Java / Deserialization Attack (11 rules)", + "description": "OWASP CRS v4.30.0 — CRS Java / Deserialization Attack (11 rules)", "author": "OWASP CRS Project", "priority": 3, "enabled": true, @@ -4099,7 +4122,7 @@ { "id": "944140", "name": "Java Injection Attack: Java Script File Upload Found", - "pattern": ".*\\.(?:jsp|jspx)\\.*$", + "pattern": ".*\\.(?:jsp|jspx)[./]*$", "targets": [ "filename" ], @@ -4311,9 +4334,9 @@ { "id": "crs-data-leakage", "name": "CRS Data Leakage Detection", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Data Leakage Detection (3 rules)", + "description": "OWASP CRS v4.30.0 — CRS Data Leakage Detection (3 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -4386,9 +4409,9 @@ { "id": "crs-data-leakage-sql", "name": "CRS SQL Data Leakage", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS SQL Data Leakage (16 rules)", + "description": "OWASP CRS v4.30.0 — CRS SQL Data Leakage (16 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -4648,7 +4671,7 @@ { "id": "951230", "name": "mysql SQL Information Leakage", - "pattern": "(?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\\(\\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\\.)|\\[MySQL\\]\\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\\(\\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \\([0-9a-z]{5}\\)|XPATH syntax error):", + "pattern": "(?i)supplied argument is not a valid MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\\(\\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\\.)|\\[MySQL\\]\\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\\(\\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \\([0-9a-z]{5}\\)|XPATH syntax error):", "targets": [ "body" ], @@ -4734,9 +4757,9 @@ { "id": "crs-data-leakage-java", "name": "CRS Java Data Leakage", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Java Data Leakage (1 rules)", + "description": "OWASP CRS v4.30.0 — CRS Java Data Leakage (1 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -4767,9 +4790,9 @@ { "id": "crs-data-leakage-php", "name": "CRS PHP Data Leakage", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS PHP Data Leakage (3 rules)", + "description": "OWASP CRS v4.30.0 — CRS PHP Data Leakage (3 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -4842,9 +4865,9 @@ { "id": "crs-data-leakage-iis", "name": "CRS IIS Data Leakage", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS IIS Data Leakage (3 rules)", + "description": "OWASP CRS v4.30.0 — CRS IIS Data Leakage (3 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -4917,9 +4940,9 @@ { "id": "crs-web-shells", "name": "CRS Web Shell Detection", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Web Shell Detection (23 rules)", + "description": "OWASP CRS v4.30.0 — CRS Web Shell Detection (23 rules)", "author": "OWASP CRS Project", "priority": 3, "enabled": true, @@ -5412,9 +5435,9 @@ { "id": "crs-data-leakage-ruby", "name": "CRS Ruby Data Leakage", - "version": "4.29.0", + "version": "4.30.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Ruby Data Leakage (1 rules)", + "description": "OWASP CRS v4.30.0 — CRS Ruby Data Leakage (1 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true,