How to Enable and Configure Windows-Specific Security Packs in dcg

You can enable Windows-specific security packs in dcg either automatically on Windows hosts via cfg(windows), manually in ~/.config/dcg/config.toml by adding "windows" to the enabled list, or through the CLI with dcg packs enable windows.

The dcg (Destructive Command Guard) repository provides native protection against dangerous commands across platforms. When working with Windows environments, you can leverage Windows-specific security packs in dcg to block destructive PowerShell cmdlets, CMD verbs, and system utilities before they execute.

Understanding Windows Security Packs

The Windows-specific security packs are organized into four distinct categories that target different attack vectors:

• windows.filesystem: Blocks destructive file-system verbs such as del, erase, and rm
• windows.system: Prevents execution of system-level utilities including diskpart and vssadmin
• windows.powershell: Protects against PowerShell cmdlets that delete or format data
• windows.misc: Covers miscellaneous dangerous patterns like robocopy misuse

By default, these packs are registered on every platform but only auto-enabled when the binary is built for Windows (cfg(windows)). This design ensures immediate protection on fresh Windows installations while maintaining performance on Unix systems.

Enabling Windows Security Packs

Automatic Enablement on Windows

When dcg runs on Windows, the packs activate automatically. The PacksConfig::enabled_pack_ids logic in src/packs/windows/mod.rs (lines 29-35) includes these packs under the cfg(windows) conditional compilation flag. No manual configuration is required on Windows hosts.

Opt-In on Non-Windows Platforms

To protect Windows scripts while running on Linux or macOS—such as when scanning .ps1 or .cmd files in CI pipelines—add the desired pack IDs to the enabled list in your configuration file.

The default configuration location is ~/.config/dcg/config.toml:

[packs]

# Enable all Windows packs

enabled = ["windows"]

# Or enable specific packs only:

# enabled = ["windows.filesystem", "windows.powershell"]

You can also use the disabled list to selectively turn off specific packs while keeping the category enabled:

[packs]
enabled = ["windows"]
disabled = ["windows.system"]

Command-Line Configuration

dcg provides experimental CLI shortcuts to toggle packs without editing the configuration file directly:

# Enable the entire Windows category

dcg packs enable windows

# Enable only the filesystem pack

dcg packs enable windows.filesystem

These commands internally write the same entries to your configuration file.

How Windows Packs Work

The Windows-specific security packs implement several optimization strategies to maintain performance while ensuring comprehensive protection.

Case-Insensitive Pattern Matching

Each regex pattern is prefixed with (?i) to match Windows' case-insensitive command verbs. For example, DEL matches del, Del, and dEl identically. This implementation appears in src/packs/windows/filesystem.rs at line 119.

Keyword Quick-Reject Filter

To keep the hot-path allocation-free, the packs use a case-sensitive Aho-Corasick filter that enumerates realistic casings. The helper function windows_keyword_casings generates lists covering lowercase and UPPERCASE for CMD verbs, plus PascalCase and lowercase for PowerShell cmdlets. This ensures the pack isn't bypassed before the regex engine processes the command.

Pack Registration

All Windows packs are created in src/packs/mod.rs under the windows module and hooked into the evaluation engine via create_pack functions. The configuration logic in src/config.rs (lines 1402-1409) handles the enabled and disabled lists, including platform-specific logic for Windows builds.

Configuration Examples

Cross-Platform CI Scanning

When scanning PowerShell scripts on a Linux CI runner, enable the PowerShell-specific pack:

# ~/.config/dcg/config.toml

[packs]
enabled = ["windows.powershell"]

Running dcg scan ./scripts now flags dangerous commands like:

Remove-Item -Recurse -Force C:\Windows\System32

The denial output includes the rule ID windows.powershell:remove-item-recursive.

Selective Pack Disabling

To disable only the system-level pack while keeping filesystem and PowerShell protection:

[packs]
enabled = ["windows"]
disabled = ["windows.system"]

This configuration allows diskpart commands to execute while blocking del and Remove-Item.

Verifying Pack Activation

Check which packs are currently active using:

dcg packs list --verbose

On Windows, you will see:

✓ windows.filesystem   (enabled)
✓ windows.system       (enabled)
✓ windows.powershell   (enabled)
✓ windows.misc         (enabled)

On non-Windows hosts, these appear as disabled unless you have explicitly enabled them in your configuration.

Summary

• Windows-specific security packs in dcg include four categories: windows.filesystem, windows.system, windows.powershell, and windows.misc
• Packs auto-enable on Windows via cfg(windows) logic in src/packs/windows/mod.rs
• Non-Windows users can opt-in by adding "windows" to the enabled list in ~/.config/dcg/config.toml
• The CLI provides dcg packs enable windows for quick toggling
• Case-insensitive regex patterns with (?i) prefixes match Windows command verb behavior
• Configuration logic resides in src/config.rs (lines 1402-1409)

Frequently Asked Questions

How do I enable Windows packs on Linux for CI scanning?

Add "windows" or specific pack IDs like "windows.powershell" to the enabled array in your ~/.config/dcg/config.toml file under the [packs] section. This allows you to scan Windows scripts (.ps1, .cmd) for destructive commands even when running on Linux or macOS build agents.

Why are Windows packs disabled by default on non-Windows systems?

The packs are registered on all platforms but only auto-enabled under cfg(windows) to optimize performance on Unix systems. This prevents unnecessary regex evaluations for Windows-specific patterns when you are not working with Windows command syntax, while allowing manual opt-in when needed for cross-platform script analysis.

Can I disable specific Windows packs while keeping others active?

Yes. Add the parent category "windows" to your enabled list, then add specific pack IDs (such as "windows.system") to the disabled list. This configuration keeps filesystem and PowerShell protection active while allowing system utilities like diskpart to execute.

Where does dcg store the Windows pack configuration?

Configuration is stored in ~/.config/dcg/config.toml by default. The enabled and disabled arrays under the [packs] section control which Windows packs are active. The CLI commands dcg packs enable and dcg packs disable modify this file directly.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}