| { | |
| "candidate_rules": [ | |
| "LF-PS-DOWNLOAD", | |
| "LF-PS-ENCODED-COMMAND", | |
| "LF-PS-INVOKE-EXPRESSION" | |
| ], | |
| "corpus_id": "LF-CORPUS-PS-0001", | |
| "description": "PowerShell package with synthetic credential access, dynamic code, loopback download/execute syntax, native load, process, encoded command and package-install syntax.", | |
| "expected_rules": [ | |
| "LF-PS-SEMANTIC-CREDENTIAL-ACCESS", | |
| "LF-PS-SEMANTIC-DOWNLOAD-EXECUTE", | |
| "LF-PS-SEMANTIC-DYNAMIC-CODE", | |
| "LF-PS-SEMANTIC-NATIVE-LOAD", | |
| "LF-PS-SEMANTIC-NETWORK", | |
| "LF-PS-SEMANTIC-PACKAGE-INSTALL", | |
| "LF-PS-SEMANTIC-PROCESS" | |
| ], | |
| "generator": "packages.powershell_chain", | |
| "ground_truth": "synthetic-generated", | |
| "must_not_rules": [], | |
| "repo_name": "powershell-capability-chain", | |
| "repo_type": "model", | |
| "safety": "inert/canary-only", | |
| "schema": 1, | |
| "validation": { | |
| "kind": "verify-package", | |
| "target": "." | |
| } | |
| } | |