{
  "attack_surface": [
    "script-supply-chain"
  ],
  "control_type": "positive",
  "corpus_id": "LF-CH-SCRX-0005",
  "difficulty": "adversarial",
  "expected_decision": "BLOCK",
  "ground_truth": "synthetic-generated",
  "layerfault_rule_expectations": {
    "candidate_rules": [],
    "expected_rules": [],
    "must_not_rules": []
  },
  "oracle_ids": [
    "LF-ORACLE-SCRX-0005"
  ],
  "related_cases": [],
  "repo_name": "script-powershell-split-command-token",
  "safe_fixture": true,
  "schema": 2,
  "severity": "critical",
  "techniques": [
    "powershell",
    "split",
    "command",
    "token"
  ],
  "transformations": []
}