deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Shell Execution via Nice - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection": {
    "Image|endswith": "/nice",
    "CommandLine|endswith": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/nice/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
Sigma Detection Rule: Python Spawning Pretty TTY Via PTY Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nextron Systems
Date: 2022-06-03
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "/python",
        "/python2",
        "/python3"
      ]
    },
    {
      "Image|contains": [
        "/python2.",
        "/python3."
      ]
    }
  ],
  "selection_cli_import": {
    "CommandLine|contains": [
      "import pty",
      "from pty "
    ]
  },
  "selection_cli_spawn": {
    "CommandLine|contains": "spawn"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Sigma Detection Rule: Suspicious Download and Execute Pattern via Curl/Wget
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Aayush Gupta
Date: 2025-06-17
ATT&CK techniques: T1059.004, T1203
Log source: linux/process_creation

Description:
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.


Detection logic:
{
  "selection_downloader": {
    "CommandLine|contains": [
      "/curl",
      "/wget"
    ]
  },
  "selection_tmp": {
    "CommandLine|contains": [
      "/tmp/",
      "/dev/shm/"
    ]
  },
  "selection_executor": {
    "CommandLine|contains": "sh -c"
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/wget/
  - https://gtfobins.github.io/gtfobins/curl/
Sigma Detection Rule: Capabilities Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-28
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Detection logic:
{
  "selection": {
    "Image|endswith": "/getcap",
    "CommandLine|contains": " -r "
  },
  "condition": "selection"
}

References:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
  - https://github.com/carlospolop/PEASS-ng
  - https://github.com/diego-treitos/linux-smart-enumeration
Sigma Detection Rule: Linux Base64 Encoded Shebang In CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "IyEvYmluL2Jhc2",
      "IyEvYmluL2Rhc2",
      "IyEvYmluL3pza",
      "IyEvYmluL2Zpc2",
      "IyEvYmluL3No"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
  - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
Sigma Detection Rule: Suspicious Curl File Upload - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
Date: 2022-09-15
ATT&CK techniques: T1567, T1105
Log source: linux/process_creation

Description:
Detects a suspicious curl process start the adds a file to a web request

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/curl"
  },
  "selection_cli": [
    {
      "CommandLine|contains": [
        " --form",
        " --upload-file ",
        " --data ",
        " --data-"
      ]
    },
    {
      "CommandLine|re": "\\s-[FTd]\\s"
    }
  ],
  "filter_optional_localhost": {
    "CommandLine|contains": [
      "://localhost",
      "://127.0.0.1"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/d1r4c/status/[PII_REDACTED]08081664
  - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
  - https://curl.se/docs/manpage.html
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
Sigma Detection Rule: Touch Suspicious Service File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-11
ATT&CK techniques: T1070.006
Log source: linux/process_creation

Description:
Detects usage of the "touch" process in service file.

Detection logic:
{
  "selection": {
    "Image|endswith": "/touch",
    "CommandLine|contains": " -t ",
    "CommandLine|endswith": ".service"
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/[PII_REDACTED]74822144
Sigma Detection Rule: Python WebServer Execution - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Mohamed LAKRI
Date: 2025-10-17
ATT&CK techniques: T1048.003
Log source: linux/process_creation

Description:
Detects the execution of Python web servers via command line interface (CLI).
After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "/python",
        "/python2",
        "/python3"
      ]
    },
    {
      "Image|contains": [
        "/python2.",
        "/python3."
      ]
    }
  ],
  "selection_module": {
    "CommandLine|contains": [
      "http.server",
      "SimpleHTTPServer"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
  - https://docs.python.org/3/library/http.server.html
  - https://docs.python.org/2/library/simplehttpserver.html
Sigma Detection Rule: Suspicious Git Clone - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
ATT&CK techniques: T1593.003
Log source: linux/process_creation

Description:
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/git",
    "CommandLine|contains": " clone "
  },
  "selection_keyword": {
    "CommandLine|contains": [
      "exploit",
      "Vulns",
      "vulnerability",
      "RCE",
      "RemoteCodeExecution",
      "Invoke-",
      "CVE-",
      "poc-",
      "ProofOfConcept",
      "proxyshell",
      "log4shell",
      "eternalblue",
      "eternal-blue",
      "MS17-"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e[PII_REDACTED]897b620c25fde1ea258c8218fe3d3/history.txt
Sigma Detection Rule: Linux Setgid Capability Set on a Binary via Setcap Utility
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Luc Génaux
Date: 2026-01-24
ATT&CK techniques: T1548, T1554
Log source: linux/process_creation

Description:
Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.


Detection logic:
{
  "selection": {
    "Image|endswith": "/setcap",
    "CommandLine|contains": "cap_setgid"
  },
  "condition": "selection"
}

References:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setgid
Sigma Detection Rule: Python Reverse Shell Execution Via PTY And Socket Modules
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-24
Log source: linux/process_creation

Description:
Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.


Detection logic:
{
  "selection": {
    "Image|contains": "python",
    "CommandLine|contains|all": [
      " -c ",
      "import",
      "pty",
      "socket",
      "spawn",
      ".connect"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.revshells.com/
Sigma Detection Rule: Potentially Suspicious Execution From Tmp Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1036
Log source: linux/process_creation

Description:
Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Detection logic:
{
  "selection": {
    "Image|startswith": "/tmp/"
  },
  "filter_optional_nextcloud": {
    "Image|endswith": "/usr/bin/nextcloud"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Shell Execution via Git - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/git",
    "ParentCommandLine|contains|all": [
      " -p ",
      "help"
    ],
    "CommandLine|contains": [
      "bash 0<&1",
      "dash 0<&1",
      "sh 0<&1"
    ]
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/git/#shell
Sigma Detection Rule: Potentially Suspicious Named Pipe Created Via Mkfifo
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
Log source: linux/process_creation

Description:
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location

Detection logic:
{
  "selection": {
    "Image|endswith": "/mkfifo",
    "CommandLine|contains": " /tmp/"
  },
  "condition": "selection"
}

References:
  - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: Interactive Bash Suspicious Children
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-14
ATT&CK techniques: T1059.004, T1036
Log source: linux/process_creation

Description:
Detects suspicious interactive bash as a parent to rather uncommon child processes

Detection logic:
{
  "selection": {
    "ParentCommandLine": "bash -i"
  },
  "anomaly1": {
    "CommandLine|contains": [
      "-c import ",
      "base64",
      "pty.spawn"
    ]
  },
  "anomaly2": {
    "Image|endswith": [
      "whoami",
      "iptables",
      "/ncat",
      "/nc",
      "/netcat"
    ]
  },
  "condition": "selection and 1 of anomaly*"
}

References:
  - Internal Research
Sigma Detection Rule: Shell Execution Of Process Located In Tmp Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
Log source: linux/process_creation

Description:
Detects execution of shells from a parent process located in a temporary (/tmp) directory

Detection logic:
{
  "selection": {
    "ParentImage|startswith": "/tmp/",
    "Image|endswith": [
      "/bash",
      "/csh",
      "/dash",
      "/fish",
      "/ksh",
      "/sh",
      "/zsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Potential GobRAT File Discovery Via Grep
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects the use of grep to discover specific files created by the GobRAT malware

Detection logic:
{
  "selection": {
    "Image|endswith": "/grep",
    "CommandLine|contains": [
      "apached",
      "frpc",
      "sshd.sh",
      "zone.arm"
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Pnscan Binary Data Transmission Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: David Burkett (@signalblur)
Date: 2024-04-16
ATT&CK techniques: T1046
Log source: linux/process_creation

Description:
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT


Detection logic:
{
  "selection": {
    "CommandLine|re": "-(W|R)\\s?(\\s|\"|')([0-9a-fA-F]{2}\\s?){2,20}(\\s|\"|')"
  },
  "condition": "selection"
}

References:
  - https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence
  - https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf
  - https://regex101.com/r/RugQYK/1
  - https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content
Sigma Detection Rule: Chmod Targeting Sensitive Directories
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-03
ATT&CK techniques: T1222.002
Log source: linux/process_creation

Description:
Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.


Detection logic:
{
  "selection": {
    "Image|endswith": "/chmod",
    "CommandLine|contains": [
      "/tmp/",
      "/.Library/",
      "/etc/",
      "/opt/"
    ]
  },
  "filter_main_update_shells": {
    "CommandLine|contains": "chmod --reference=/etc/shells",
    "ParentCommandLine|endswith": "/update-shells"
  },
  "filter_main_postinst": {
    "CommandLine|contains": "/etc/",
    "ParentCommandLine|contains|all": [
      "/var/lib/dpkg/info/",
      ".postinst configure"
    ]
  },
  "filter_main_apt_key": {
    "CommandLine|startswith": "chmod 700 /tmp/apt-key-gpghome."
  },
  "filter_main_mkinitramfs": {
    "CommandLine|startswith": "chmod 755 /var/tmp/mkinitramfs"
  },
  "filter_main_landscape": {
    "CommandLine": "chmod 0775 /etc/landscape/"
  },
  "filter_main_ubuntu_apparmor": {
    "CommandLine": "chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
Sigma Detection Rule: Local System Accounts Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community, CheraghiMilad
Date: 2020-10-08
ATT&CK techniques: T1087.001
Log source: linux/process_creation

Description:
Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/lastlog"
  },
  "selection_2": {
    "CommandLine|contains": "'x:0:'"
  },
  "selection_3": {
    "Image|endswith": [
      "/cat",
      "/ed",
      "/head",
      "/more",
      "/nano",
      "/tail",
      "/vi",
      "/vim",
      "/less",
      "/emacs",
      "/sqlite3",
      "/makemap"
    ],
    "CommandLine|contains": [
      "/etc/passwd",
      "/etc/shadow",
      "/etc/sudoers",
      "/etc/spwd.db",
      "/etc/pwd.db",
      "/etc/master.passwd"
    ]
  },
  "selection_4": {
    "Image|endswith": "/id"
  },
  "selection_5": {
    "Image|endswith": "/lsof",
    "CommandLine|contains": "-u"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
  - https://my.f5.com/manage/s/article/K589
  - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb
Sigma Detection Rule: Shell Execution via Flock - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "/flock",
    "CommandLine|contains": " -u "
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/flock/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
Sigma Detection Rule: Potential Suspicious Change To Sensitive/Critical Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @d4ns4n_ (Wuerth-Phoenix)
Date: 2023-05-30
ATT&CK techniques: T1565.001
Log source: linux/process_creation

Description:
Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.


Detection logic:
{
  "selection_img_1": {
    "Image|endswith": [
      "/cat",
      "/echo",
      "/grep",
      "/head",
      "/more",
      "/tail"
    ],
    "CommandLine|contains": ">"
  },
  "selection_img_2": {
    "Image|endswith": [
      "/emacs",
      "/nano",
      "/sed",
      "/vi",
      "/vim"
    ]
  },
  "selection_paths": {
    "CommandLine|contains": [
      "/bin/login",
      "/bin/passwd",
      "/boot/",
      "/etc/*.conf",
      "/etc/cron.",
      "/etc/crontab",
      "/etc/hosts",
      "/etc/init.d",
      "/etc/sudoers",
      "/opt/bin/",
      "/sbin",
      "/usr/bin/",
      "/usr/local/bin/"
    ]
  },
  "filter_main_mdadm.conf": {
    "Image|endswith": "/bin/sed",
    "CommandLine|startswith": [
      "sed -i /^*",
      "sed -ne s/^"
    ],
    "CommandLine|endswith": "/etc/mdadm/mdadm.conf"
  },
  "condition": "1 of selection_img_* and selection_paths and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor
Sigma Detection Rule: Vim GTFOBin Abuse - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-28
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/rvim",
      "/vim",
      "/vimdiff"
    ],
    "CommandLine|contains": [
      " --cmd",
      " -c "
    ]
  },
  "selection_cli": {
    "CommandLine|contains": [
      ":!/",
      ":lua ",
      ":py ",
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/vim/
  - https://gtfobins.github.io/gtfobins/rvim/
  - https://gtfobins.github.io/gtfobins/vimdiff/