18 lines
753 B
JSON
18 lines
753 B
JSON
[
|
|
"\\brm\\s+(?=[^\\n;&|]*(?:-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\\b|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*\\b|-[a-zA-Z]*r[a-zA-Z]*\\b[^\\n;&|]*-[a-zA-Z]*f[a-zA-Z]*\\b|-[a-zA-Z]*f[a-zA-Z]*\\b[^\\n;&|]*-[a-zA-Z]*r[a-zA-Z]*\\b|--recursive\\b[^\\n;&|]*(?:--force\\b|-[a-zA-Z]*f[a-zA-Z]*\\b)|(?:--force\\b|-[a-zA-Z]*f[a-zA-Z]*\\b)[^\\n;&|]*--recursive\\b))",
|
|
"\\bmkfs\\.",
|
|
"\\bdd\\s+if=.*\\s+of=/dev/",
|
|
"\\b(shutdown|reboot|poweroff|halt)\\b",
|
|
":\\(\\)\\{\\s*:\\|:\\&\\s*\\};:",
|
|
">\\s*/dev/sd",
|
|
"\\bchmod\\s+(-[a-zA-Z]*R[a-zA-Z]*|--recursive)\\s+777\\s+/",
|
|
"\\bmv\\s+/\\s",
|
|
":\\s*>\\s*/etc/",
|
|
"\\bcurl\\s+.*\\|\\s*\\bsudo\\s+\\bbash\\b",
|
|
"\\bwget\\s+.*\\|\\s*\\bsudo\\s+\\bbash\\b",
|
|
"base64.*\\|.*(?:ba)?sh",
|
|
"\\beval\\b",
|
|
"\\$\\(",
|
|
"`.+`"
|
|
]
|