Destructive system commands
A command resembles a broad deletion, disk-formatting operation, or other system-damaging action.
Why it is risky
Section titled “Why it is risky”These operations can remove data, damage a filesystem, or change permissions beyond the project. Recovery may require backups or rebuilding the system.
Example
Section titled “Example”An agent tasked with clearing a build cache instead proposes a recursive deletion of the whole home directory.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches selected shell command patterns for deleting root or home targets, formatting filesystems, writing block devices, and partition tools. It also scans recognized staged scripts.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_DESTRUCTIVE_COMMAND | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Pause the operation and verify the exact expanded target, backups, and task authorization. If it ran, review the outcome before attempting recovery.
False positives
Section titled “False positives”Authorized disk provisioning, disposable-environment resets, and a script containing a quoted example can match. Some partition-tool uses only inspect the system.
False negatives
Section titled “False negatives”Destructive commands in other shells, aliases, indirect scripts, or deletion of valuable project files rather than root or home can be missed.
Technical details
Section titled “Technical details”The base severity is HIGH. A staged match generally receives a lower severity than an execution match. Text patterns do not establish that a command completed or caused damage.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.