Go WAF Plugin (#400)

plugins/wasm-go/extensions/waf/wasmplugin/rules/crs/windows-powershell-commands.data

@@ -0,0 +1,425 @@
+# Sources:
+# Microsoft PowerShell Docs: https://github.com/MicrosoftDocs/PowerShell-Docs
+# - curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/MicrosoftDocs/PowerShell-Docs/git/trees/main\?recursive\=1 | jq -r '.tree[] .path | capture("reference/\\d.\\d/(.*)/(?<fn>[A-Z]\\w+-\\w+).md") | .fn' | sort | uniq
+
+powershell
+Add-Computer
+Add-Content
+Add-History
+Add-JobTrigger
+Add-LocalGroupMember
+Add-Member
+Add-PSSnapin
+Add-Type
+Checkpoint-Computer
+Clear-Content
+Clear-EventLog
+Clear-History
+Clear-Host
+Clear-Item
+Clear-ItemProperty
+Clear-RecycleBin
+Clear-Variable
+Compare-Object
+Complete-Transaction
+Compress-Archive
+Connect-PSSession
+Connect-WSMan
+Convert-Path
+Convert-String
+ConvertFrom-Csv
+ConvertFrom-Json
+ConvertFrom-Markdown
+ConvertFrom-SddlString
+ConvertFrom-SecureString
+ConvertFrom-String
+ConvertFrom-StringData
+ConvertTo-Csv
+ConvertTo-Html
+ConvertTo-Json
+ConvertTo-SecureString
+ConvertTo-Xml
+Copy-Item
+Copy-ItemProperty
+Debug-Job
+Debug-Process
+Debug-Runspace
+Disable-ComputerRestore
+Disable-ExperimentalFeature
+Disable-JobTrigger
+Disable-LocalUser
+Disable-PSBreakpoint
+Disable-PSRemoting
+Disable-PSSessionConfiguration
+Disable-PSTrace
+Disable-PSWSManCombinedTrace
+Disable-RunspaceDebug
+Disable-ScheduledJob
+Disable-WSManCredSSP
+Disable-WSManTrace
+Disconnect-PSSession
+Disconnect-WSMan
+Enable-ComputerRestore
+Enable-ExperimentalFeature
+Enable-JobTrigger
+Enable-LocalUser
+Enable-PSBreakpoint
+Enable-PSRemoting
+Enable-PSSessionConfiguration
+Enable-PSTrace
+Enable-PSWSManCombinedTrace
+Enable-RunspaceDebug
+Enable-ScheduledJob
+Enable-WSManCredSSP
+Enable-WSManTrace
+Enter-PSHostProcess
+Enter-PSSession
+Exit-PSHostProcess
+Exit-PSSession
+Expand-Archive
+Export-Alias
+Export-BinaryMiLog
+Export-Clixml
+Export-Console
+Export-Counter
+Export-Csv
+Export-FormatData
+Export-ModuleMember
+Export-ODataEndpointProxy
+Export-PSSession
+Find-Command
+Find-DscResource
+Find-Module
+Find-Package
+Find-PackageProvider
+Find-RoleCapability
+Find-Script
+ForEach-Object
+Format-Custom
+Format-Hex
+Format-List
+Format-Table
+Format-Wide
+Get-Acl
+Get-Alias
+Get-AuthenticodeSignature
+Get-ChildItem
+Get-CimAssociatedInstance
+Get-CimClass
+Get-CimInstance
+Get-CimSession
+Get-Clipboard
+Get-CmsMessage
+Get-Command
+Get-ComputerInfo
+Get-ComputerRestorePoint
+Get-Content
+Get-ControlPanelItem
+Get-Counter
+Get-Credential
+Get-Culture
+Get-Date
+Get-Error
+Get-Event
+Get-EventLog
+Get-EventSubscriber
+Get-ExecutionPolicy
+Get-ExperimentalFeature
+Get-FileHash
+Get-FormatData
+Get-Help
+Get-History
+Get-Host
+Get-HotFix
+Get-InstalledModule
+Get-InstalledScript
+Get-IseSnippet
+Get-Item
+Get-ItemProperty
+Get-ItemPropertyValue
+Get-Job
+Get-JobTrigger
+Get-LocalGroup
+Get-LocalGroupMember
+Get-LocalUser
+Get-Location
+Get-LogProperties
+Get-MarkdownOption
+Get-Member
+Get-Module
+Get-OperationValidation
+Get-PSBreakpoint
+Get-PSCallStack
+Get-PSDrive
+Get-PSHostProcessInfo
+Get-PSProvider
+Get-PSReadLineKeyHandler
+Get-PSReadLineOption
+Get-PSRepository
+Get-PSSession
+Get-PSSessionCapability
+Get-PSSessionConfiguration
+Get-PSSnapin
+Get-PSSubsystem
+Get-Package
+Get-PackageProvider
+Get-PackageSource
+Get-PfxCertificate
+Get-Process
+Get-Random
+Get-Runspace
+Get-RunspaceDebug
+Get-ScheduledJob
+Get-ScheduledJobOption
+Get-Service
+Get-TimeZone
+Get-TraceSource
+Get-Transaction
+Get-TypeData
+Get-UICulture
+Get-Unique
+Get-Uptime
+Get-Variable
+Get-Verb
+Get-WSManCredSSP
+Get-WSManInstance
+Get-WinEvent
+Get-WmiObject
+Group-Object
+Import-Alias
+Import-BinaryMiLog
+Import-Clixml
+Import-Counter
+Import-Csv
+Import-IseSnippet
+Import-LocalizedData
+Import-Module
+Import-PSSession
+Import-PackageProvider
+Import-PowerShellDataFile
+Install-Module
+Install-Package
+Install-PackageProvider
+Install-Script
+Invoke-AsWorkflow
+Invoke-CimMethod
+Invoke-Command
+Invoke-Expression
+Invoke-History
+Invoke-Item
+Invoke-OperationValidation
+Invoke-RestMethod
+Invoke-WSManAction
+Invoke-WebRequest
+Invoke-WmiMethod
+Join-Path
+Join-String
+Limit-EventLog
+Measure-Command
+Measure-Object
+Move-Item
+Move-ItemProperty
+New-Alias
+New-CimInstance
+New-CimSession
+New-CimSessionOption
+New-Event
+New-EventLog
+New-FileCatalog
+New-Guid
+New-IseSnippet
+New-Item
+New-ItemProperty
+New-JobTrigger
+New-LocalGroup
+New-LocalUser
+New-Module
+New-ModuleManifest
+New-Object
+New-PSDrive
+New-PSRoleCapabilityFile
+New-PSSession
+New-PSSessionConfigurationFile
+New-PSSessionOption
+New-PSTransportOption
+New-PSWorkflowExecutionOption
+New-PSWorkflowSession
+New-ScheduledJobOption
+New-ScriptFileInfo
+New-Service
+New-TemporaryFile
+New-TimeSpan
+New-Variable
+New-WSManInstance
+New-WSManSessionOption
+New-WebServiceProxy
+New-WinEvent
+Out-Default
+Out-File
+Out-GridView
+Out-Host
+Out-Null
+Out-Printer
+Out-String
+Pop-Location
+Protect-CmsMessage
+Publish-Module
+Publish-Script
+Push-Location
+Read-Host
+Receive-Job
+Receive-PSSession
+Register-ArgumentCompleter
+Register-CimIndicationEvent
+Register-EngineEvent
+Register-ObjectEvent
+Register-PSRepository
+Register-PSSessionConfiguration
+Register-PackageSource
+Register-ScheduledJob
+Register-WmiEvent
+Remove-Alias
+Remove-CimInstance
+Remove-CimSession
+Remove-Computer
+Remove-Event
+Remove-EventLog
+Remove-Item
+Remove-ItemProperty
+Remove-Job
+Remove-JobTrigger
+Remove-LocalGroup
+Remove-LocalGroupMember
+Remove-LocalUser
+Remove-Module
+Remove-PSBreakpoint
+Remove-PSDrive
+Remove-PSReadLineKeyHandler
+Remove-PSSession
+Remove-PSSnapin
+Remove-Service
+Remove-TypeData
+Remove-Variable
+Remove-WSManInstance
+Remove-WmiObject
+Rename-Computer
+Rename-Item
+Rename-ItemProperty
+Rename-LocalGroup
+Rename-LocalUser
+Reset-ComputerMachinePassword
+Resolve-Path
+Restart-Computer
+Restart-Service
+Restore-Computer
+Resume-Job
+Resume-Service
+Save-Help
+Save-Module
+Save-Package
+Save-Script
+Select-Object
+Select-String
+Select-Xml
+Send-MailMessage
+Set-Acl
+Set-Alias
+Set-AuthenticodeSignature
+Set-CimInstance
+Set-Clipboard
+Set-Content
+Set-Date
+Set-ExecutionPolicy
+Set-Item
+Set-ItemProperty
+Set-JobTrigger
+Set-LocalGroup
+Set-LocalUser
+Set-Location
+Set-LogProperties
+Set-MarkdownOption
+Set-PSBreakpoint
+Set-PSDebug
+Set-PSReadLineKeyHandler
+Set-PSReadLineOption
+Set-PSRepository
+Set-PSSessionConfiguration
+Set-PackageSource
+Set-ScheduledJob
+Set-ScheduledJobOption
+Set-Service
+Set-StrictMode
+Set-TimeZone
+Set-TraceSource
+Set-Variable
+Set-WSManInstance
+Set-WSManQuickConfig
+Set-WmiInstance
+Show-Command
+Show-ControlPanelItem
+Show-EventLog
+Show-Markdown
+Sort-Object
+Split-Path
+Start-Job
+Start-Process
+Start-Service
+Start-Sleep
+Start-ThreadJob
+Start-Trace
+Start-Transaction
+Start-Transcript
+Stop-Computer
+Stop-Job
+Stop-Process
+Stop-Service
+Stop-Trace
+Stop-Transcript
+Suspend-Job
+Suspend-Service
+Switch-Process
+Tee-Object
+Test-ComputerSecureChannel
+Test-Connection
+Test-FileCatalog
+Test-Json
+Test-ModuleManifest
+Test-PSSessionConfigurationFile
+Test-Path
+Test-ScriptFileInfo
+Test-WSMan
+Trace-Command
+Unblock-File
+Undo-Transaction
+Uninstall-Module
+Uninstall-Package
+Uninstall-Script
+Unprotect-CmsMessage
+Unregister-Event
+Unregister-PSRepository
+Unregister-PSSessionConfiguration
+Unregister-PackageSource
+Unregister-ScheduledJob
+Update-FormatData
+Update-Help
+Update-List
+Update-Module
+Update-ModuleManifest
+Update-Script
+Update-ScriptFileInfo
+Update-TypeData
+Use-Transaction
+Wait-Debugger
+Wait-Event
+Wait-Job
+Wait-Process
+Where-Object
+Write-Debug
+Write-Error
+Write-EventLog
+Write-Host
+Write-Information
+Write-Output
+Write-Progress
+Write-Verbose
+Write-Warning