##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##! Word list for rule 932370 (RCE Windows command injection part 1/2)
##!
##! The list comes from the project LOLBAS. You can get it using the following one-liner:
##! `curl -s -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/LOLBAS-Project/LOLBAS/git/trees/master\?recursive\=1 | jq -r '.tree[].path ' | grep ^yml/ | cut -f3 -d/ | cut -f1 -d. | tr 'A-Z' 'a-z' | sort | uniq`
##! To prevent some FP for a command, you can require command parameters
##! after a command. Only do this if the command regularly causes FP and if
##! allowing the bare command (without parameters) is not too dangerous.
##! (Note: due to \b following the regexp, a word boundary is also required
##! further on, so some letter/number is needed for a match). Example:
##!
##!   diff@

##!+ i

##! extension/switches suffix
##! cmd.com, cmd.exe, etc.
##!$ (?:\.[\"\^]*\w+)?
##! cmd/h
##!$ \b

##! starting tokens prefix
##!> assemble
  ##!> include windows-commands-prefix

  ##!> cmdline windows

    acccheckconsole
    adplus
    advpack
    agentexecutor
    appinstaller
    appvlp
    aspnet_compiler
    atbroker
    bash
    bginfo
    bitsadmin
    cdb
    certoc
    certreq
    certutil
    cl_invocation
    cl_loadassembly
    cl_mutexverifiers
    cmd
    cmdkey
    cmdl32
    cmstp
    comsvcs
    configsecuritypolicy
    conhost
    control
    coregen
    createdump
    csc
    cscript
    csi
    customshellhost
    datasvcutil
    defaultpack
    desk
    desktopimgdownldr
    devicecredentialdeployment
    devtoolslauncher
    dfshim
    dfsvc
    diantz
    diskshadow
    dnscmd
    dnx
    dotnet
    dump64
    dxcap
    esentutl
    eventvwr
    excel
    expand
    explorer
    extexport
    extrac32
    findstr
    finger
    fltmc
    forfiles
    fsi
    fsianycpu
    fsutil
    ftp
    gfxdownloadwrapper
    gpscript
    hh
    ie4uinit
    ieadvpack
    ieexec
    ieframe
    ilasm
    imewdbld
    infdefaultinstall
    installutil
    jsc
    launch-vsdevshell
    ldifde
    makecab
    manage-bde
    mavinject
    mftrace
    microsoft
    mmc
    mpcmdrun
    msbuild
    msconfig
    msdeploy
    msdt
    mshta
    mshtml
    msiexec
    msohtmed
    mspub
    msxsl
    netsh
    ntdsutil
    odbcconf
    offlinescannershell
    onedrivestandaloneupdater
    openconsole
    pcalua
    pcwrun
    pcwutl
    pester
    pktmon
    pnputil
    powerpnt
    presentationhost
    print
    printbrm
    procdump
    protocolhandler
    psr
    pubprn
    rasautou
    rcsi
    rdrleakdiag
    reg
    regasm
    regedit
    regini
    register-cimprovider
    regsvcs
    regsvr32
    remote
    replace
    rpcping
    rundll32
    runexehelper
    runonce
    runscripthelper
    sc@
    schtasks
    scriptrunner
    setres
    settingsynchost
    setupapi
    shdocvw
    shell32
    sqldumper
    sqlps
    sqltoolsps
    squirrel
    ssh
    stordiag
    syncappvpublishingserver
    syssetup
    te@
    tracker
    ttdinject
    tttracer
    unregmp2
    update
    url
    utilityfunctions
    vbc
    verclsid
    visualuiaverifynative
    vsiisexelauncher
    vsjitdebugger
    wab
    wfc
    winget
    winrm
    winword
    wlrmdr
    wmic
    workfolders
    wscript
    wsl
    wsreset
    wt@
    wuauclt
    xwizard
    zipfldr
  ##!<
##!<