clawsec 0.0.1

package/dist/src/detectors/destructive/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/detectors/destructive/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,mDAAmD;IACnD,QAAQ,EAAE,OAAO,CAAC;IAClB,gCAAgC;IAChC,QAAQ,EAAE,aAAa,CAAC;IACxB,sCAAsC;IACtC,QAAQ,EAAE,QAAQ,CAAC;IACnB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,CAAC,EAAE;QACT,2CAA2C;QAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,oCAAoC;QACpC,IAAI,EAAE,eAAe,CAAC;QACtB,oEAAoE;QACpE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,oDAAoD;QACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,0CAA0C;IAC1C,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,uCAAuC;IACvC,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,0BAA0B,GAAG,IAAI,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/src/detectors/destructive/types.js

@@ -0,0 +1,6 @@
+/**
+ * Destructive Detector Types
+ * Type definitions for detecting dangerous/destructive operations
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/detectors/destructive/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/detectors/destructive/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/src/detectors/exfiltration/cloud-detector.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Cloud Upload Detector
+ * Detects cloud storage uploads that could be data exfiltration
+ */
+import type { CloudUploadMatchResult, DetectionContext, ExfiltrationDetectionResult, SubDetector } from './types.js';
+import type { Severity } from '../../config/index.js';
+/**
+ * Match AWS S3 upload commands
+ */
+export declare function matchAwsS3Upload(command: string): CloudUploadMatchResult;
+/**
+ * Match GCP Storage upload commands
+ */
+export declare function matchGcpUpload(command: string): CloudUploadMatchResult;
+/**
+ * Match Azure Storage upload commands
+ */
+export declare function matchAzureUpload(command: string): CloudUploadMatchResult;
+/**
+ * Match Rclone upload commands
+ */
+export declare function matchRcloneUpload(command: string): CloudUploadMatchResult;
+/**
+ * Match other cloud upload commands
+ */
+export declare function matchOtherCloudUpload(command: string): CloudUploadMatchResult;
+/**
+ * Match cloud SDK upload patterns in code
+ */
+export declare function matchCloudSdkUpload(code: string): CloudUploadMatchResult;
+/**
+ * Comprehensive cloud upload matching
+ */
+export declare function matchCloudUpload(text: string): CloudUploadMatchResult;
+/**
+ * Cloud upload detector class
+ */
+export declare class CloudUploadDetector implements SubDetector {
+    private severity;
+    constructor(severity?: Severity);
+    /**
+     * Extract text content from tool context
+     */
+    private extractContent;
+    detect(context: DetectionContext): ExfiltrationDetectionResult | null;
+}
+/**
+ * Create a cloud upload detector with the given severity
+ */
+export declare function createCloudUploadDetector(severity?: Severity): CloudUploadDetector;
+//# sourceMappingURL=cloud-detector.d.ts.map

package/dist/src/detectors/exfiltration/cloud-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-detector.d.ts","sourceRoot":"","sources":["../../../../src/detectors/exfiltration/cloud-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAC3B,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAiLtD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAgBxE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAgBtE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAgBxE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAgB7E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAyBxE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAsCrE;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAW;gBAEf,QAAQ,GAAE,QAAiB;IAIvC;;OAEG;IACH,OAAO,CAAC,cAAc;IA6CtB,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,2BAA2B,GAAG,IAAI;CAuCtE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,QAAiB,GAAG,mBAAmB,CAE1F"}

package/dist/src/detectors/exfiltration/cloud-detector.js

@@ -0,0 +1,427 @@
+/**
+ * Cloud Upload Detector
+ * Detects cloud storage uploads that could be data exfiltration
+ */
+/**
+ * AWS S3 upload patterns
+ * Detects uploads TO S3 (not downloads FROM S3)
+ */
+const AWS_S3_UPLOAD_PATTERNS = [
+    // aws s3 cp local_file s3://bucket
+    {
+        pattern: /\baws\s+s3\s+cp\s+(?!s3:\/\/)([^\s]+)\s+(s3:\/\/[^\s]+)/i,
+        operation: 's3 cp',
+        description: 'AWS S3 upload',
+    },
+    // aws s3 mv local_file s3://bucket
+    {
+        pattern: /\baws\s+s3\s+mv\s+(?!s3:\/\/)([^\s]+)\s+(s3:\/\/[^\s]+)/i,
+        operation: 's3 mv',
+        description: 'AWS S3 move/upload',
+    },
+    // aws s3 sync local_dir s3://bucket
+    {
+        pattern: /\baws\s+s3\s+sync\s+(?!s3:\/\/)([^\s]+)\s+(s3:\/\/[^\s]+)/i,
+        operation: 's3 sync',
+        description: 'AWS S3 sync upload',
+    },
+    // aws s3api put-object
+    {
+        pattern: /\baws\s+s3api\s+put-object\s+[^|;]*--bucket\s+([^\s]+)[^|;]*--key\s+([^\s]+)/i,
+        operation: 's3api put-object',
+        description: 'AWS S3 API upload',
+    },
+    // aws s3api put-object (alternate order)
+    {
+        pattern: /\baws\s+s3api\s+put-object\s+[^|;]*--key\s+([^\s]+)[^|;]*--bucket\s+([^\s]+)/i,
+        operation: 's3api put-object',
+        description: 'AWS S3 API upload',
+    },
+];
+/**
+ * GCP Storage upload patterns
+ */
+const GCP_UPLOAD_PATTERNS = [
+    // gsutil cp local_file gs://bucket
+    {
+        pattern: /\bgsutil\s+(?:-m\s+)?cp\s+(?:-[rRn]\s+)*(?!gs:\/\/)([^\s]+)\s+(gs:\/\/[^\s]+)/i,
+        operation: 'gsutil cp',
+        description: 'GCP Storage upload',
+    },
+    // gsutil mv local_file gs://bucket
+    {
+        pattern: /\bgsutil\s+(?:-m\s+)?mv\s+(?!gs:\/\/)([^\s]+)\s+(gs:\/\/[^\s]+)/i,
+        operation: 'gsutil mv',
+        description: 'GCP Storage move/upload',
+    },
+    // gsutil rsync local_dir gs://bucket
+    {
+        pattern: /\bgsutil\s+(?:-m\s+)?rsync\s+(?:-[rRdC]\s+)*(?!gs:\/\/)([^\s]+)\s+(gs:\/\/[^\s]+)/i,
+        operation: 'gsutil rsync',
+        description: 'GCP Storage rsync upload',
+    },
+    // gcloud storage cp
+    {
+        pattern: /\bgcloud\s+storage\s+cp\s+(?:-[rR]\s+)*(?!gs:\/\/)([^\s]+)\s+(gs:\/\/[^\s]+)/i,
+        operation: 'gcloud storage cp',
+        description: 'GCP Storage upload',
+    },
+];
+/**
+ * Azure Storage upload patterns
+ */
+const AZURE_UPLOAD_PATTERNS = [
+    // azcopy copy local_file https://account.blob.core.windows.net
+    {
+        pattern: /\bazcopy\s+copy\s+(?!https?:\/\/)([^\s]+)\s+(https:\/\/[^\s]*blob\.core\.windows\.net[^\s]*)/i,
+        operation: 'azcopy copy',
+        description: 'Azure Blob upload',
+    },
+    // azcopy sync local_dir https://account.blob.core.windows.net
+    {
+        pattern: /\bazcopy\s+sync\s+(?!https?:\/\/)([^\s]+)\s+(https:\/\/[^\s]*blob\.core\.windows\.net[^\s]*)/i,
+        operation: 'azcopy sync',
+        description: 'Azure Blob sync upload',
+    },
+    // az storage blob upload
+    {
+        pattern: /\baz\s+storage\s+blob\s+upload\s+[^|;]*(?:--file|-f)\s+([^\s]+)/i,
+        operation: 'az storage blob upload',
+        description: 'Azure CLI blob upload',
+    },
+    // az storage blob upload-batch
+    {
+        pattern: /\baz\s+storage\s+blob\s+upload-batch\s+[^|;]*(?:--source|-s)\s+([^\s]+)/i,
+        operation: 'az storage blob upload-batch',
+        description: 'Azure CLI batch upload',
+    },
+];
+/**
+ * Rclone upload patterns
+ */
+const RCLONE_UPLOAD_PATTERNS = [
+    // rclone copy local remote:path
+    {
+        pattern: /\brclone\s+(?:copy|sync|move)\s+(?![\w-]+:)([^\s]+)\s+([\w-]+:[^\s]*)/i,
+        operation: 'rclone',
+        description: 'Rclone cloud upload',
+    },
+    // rclone copyto local remote:path
+    {
+        pattern: /\brclone\s+copyto\s+(?![\w-]+:)([^\s]+)\s+([\w-]+:[^\s]*)/i,
+        operation: 'rclone copyto',
+        description: 'Rclone cloud upload',
+    },
+];
+/**
+ * Other cloud upload patterns (DigitalOcean Spaces, Backblaze B2, etc.)
+ */
+const OTHER_CLOUD_PATTERNS = [
+    // s3cmd put (S3-compatible)
+    {
+        pattern: /\bs3cmd\s+put\s+([^\s]+)\s+(s3:\/\/[^\s]+)/i,
+        operation: 's3cmd put',
+        description: 'S3-compatible upload',
+    },
+    // mc (MinIO client) cp
+    {
+        pattern: /\bmc\s+cp\s+(?![\w-]+\/)([^\s]+)\s+([\w-]+\/[^\s]+)/i,
+        operation: 'mc cp',
+        description: 'MinIO client upload',
+    },
+    // b2 upload-file (Backblaze B2)
+    {
+        pattern: /\bb2\s+(?:upload-file|upload_file)\s+([^\s]+)\s+([^\s]+)/i,
+        operation: 'b2 upload',
+        description: 'Backblaze B2 upload',
+    },
+];
+/**
+ * SDK/Code patterns for cloud uploads
+ */
+const CLOUD_SDK_PATTERNS = [
+    // AWS SDK - S3 upload (Python boto3)
+    {
+        pattern: /\.upload_file\s*\(\s*["'`]([^"'`]+)["'`]\s*,\s*["'`]([^"'`]+)["'`]/i,
+        operation: 'boto3 upload_file',
+        description: 'AWS SDK upload',
+    },
+    // AWS SDK - S3 put_object
+    {
+        pattern: /\.put_object\s*\([^)]*Bucket\s*=\s*["'`]([^"'`]+)["'`]/i,
+        operation: 'boto3 put_object',
+        description: 'AWS SDK put_object',
+    },
+    // GCP SDK - upload_from_filename
+    {
+        pattern: /\.upload_from_filename\s*\(\s*["'`]([^"'`]+)["'`]/i,
+        operation: 'gcp upload_from_filename',
+        description: 'GCP SDK upload',
+    },
+    // Azure SDK - upload_blob
+    {
+        pattern: /\.upload_blob\s*\(/i,
+        operation: 'azure upload_blob',
+        description: 'Azure SDK upload',
+    },
+    // JavaScript AWS SDK - upload/putObject
+    {
+        pattern: /\b(?:s3|S3)\s*\.\s*(?:upload|putObject)\s*\(/i,
+        operation: 'aws-sdk upload',
+        description: 'AWS JavaScript SDK upload',
+    },
+];
+/**
+ * Match AWS S3 upload commands
+ */
+export function matchAwsS3Upload(command) {
+    for (const { pattern, operation } of AWS_S3_UPLOAD_PATTERNS) {
+        const match = command.match(pattern);
+        if (match) {
+            return {
+                matched: true,
+                command,
+                provider: 'aws',
+                operation,
+                dataSource: match[1],
+                destination: match[2],
+                confidence: 0.95,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Match GCP Storage upload commands
+ */
+export function matchGcpUpload(command) {
+    for (const { pattern, operation } of GCP_UPLOAD_PATTERNS) {
+        const match = command.match(pattern);
+        if (match) {
+            return {
+                matched: true,
+                command,
+                provider: 'gcp',
+                operation,
+                dataSource: match[1],
+                destination: match[2],
+                confidence: 0.95,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Match Azure Storage upload commands
+ */
+export function matchAzureUpload(command) {
+    for (const { pattern, operation } of AZURE_UPLOAD_PATTERNS) {
+        const match = command.match(pattern);
+        if (match) {
+            return {
+                matched: true,
+                command,
+                provider: 'azure',
+                operation,
+                dataSource: match[1],
+                destination: match[2] || 'Azure Blob Storage',
+                confidence: 0.95,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Match Rclone upload commands
+ */
+export function matchRcloneUpload(command) {
+    for (const { pattern, operation } of RCLONE_UPLOAD_PATTERNS) {
+        const match = command.match(pattern);
+        if (match) {
+            return {
+                matched: true,
+                command,
+                provider: 'rclone',
+                operation,
+                dataSource: match[1],
+                destination: match[2],
+                confidence: 0.9,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Match other cloud upload commands
+ */
+export function matchOtherCloudUpload(command) {
+    for (const { pattern, operation } of OTHER_CLOUD_PATTERNS) {
+        const match = command.match(pattern);
+        if (match) {
+            return {
+                matched: true,
+                command,
+                provider: 's3-compatible',
+                operation,
+                dataSource: match[1],
+                destination: match[2],
+                confidence: 0.9,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Match cloud SDK upload patterns in code
+ */
+export function matchCloudSdkUpload(code) {
+    for (const { pattern, operation } of CLOUD_SDK_PATTERNS) {
+        const match = code.match(pattern);
+        if (match) {
+            let provider = 'unknown';
+            if (operation.includes('boto3') || operation.includes('aws')) {
+                provider = 'aws';
+            }
+            else if (operation.includes('gcp')) {
+                provider = 'gcp';
+            }
+            else if (operation.includes('azure')) {
+                provider = 'azure';
+            }
+            return {
+                matched: true,
+                command: code,
+                provider,
+                operation,
+                dataSource: match[1] || undefined,
+                destination: match[2] || undefined,
+                confidence: 0.85,
+            };
+        }
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Comprehensive cloud upload matching
+ */
+export function matchCloudUpload(text) {
+    // Try AWS S3
+    const awsResult = matchAwsS3Upload(text);
+    if (awsResult.matched) {
+        return awsResult;
+    }
+    // Try GCP Storage
+    const gcpResult = matchGcpUpload(text);
+    if (gcpResult.matched) {
+        return gcpResult;
+    }
+    // Try Azure Storage
+    const azureResult = matchAzureUpload(text);
+    if (azureResult.matched) {
+        return azureResult;
+    }
+    // Try Rclone
+    const rcloneResult = matchRcloneUpload(text);
+    if (rcloneResult.matched) {
+        return rcloneResult;
+    }
+    // Try other S3-compatible
+    const otherResult = matchOtherCloudUpload(text);
+    if (otherResult.matched) {
+        return otherResult;
+    }
+    // Try SDK patterns
+    const sdkResult = matchCloudSdkUpload(text);
+    if (sdkResult.matched) {
+        return sdkResult;
+    }
+    return { matched: false, confidence: 0 };
+}
+/**
+ * Cloud upload detector class
+ */
+export class CloudUploadDetector {
+    severity;
+    constructor(severity = 'high') {
+        this.severity = severity;
+    }
+    /**
+     * Extract text content from tool context
+     */
+    extractContent(context) {
+        const input = context.toolInput;
+        // Direct command field
+        if (typeof input.command === 'string') {
+            return input.command;
+        }
+        // Shell/bash command field
+        if (typeof input.shell === 'string') {
+            return input.shell;
+        }
+        if (typeof input.bash === 'string') {
+            return input.bash;
+        }
+        // Script field
+        if (typeof input.script === 'string') {
+            return input.script;
+        }
+        // Code field
+        if (typeof input.code === 'string') {
+            return input.code;
+        }
+        // Text content
+        if (typeof input.text === 'string') {
+            return input.text;
+        }
+        // Content field
+        if (typeof input.content === 'string') {
+            return input.content;
+        }
+        // Body field
+        if (typeof input.body === 'string') {
+            return input.body;
+        }
+        return null;
+    }
+    detect(context) {
+        const content = this.extractContent(context);
+        if (!content) {
+            return null;
+        }
+        const result = matchCloudUpload(content);
+        if (!result.matched) {
+            return null;
+        }
+        const providerNames = {
+            aws: 'AWS S3',
+            gcp: 'Google Cloud Storage',
+            azure: 'Azure Blob Storage',
+            rclone: 'Cloud (via rclone)',
+            's3-compatible': 'S3-compatible storage',
+            unknown: 'Cloud storage',
+        };
+        const providerName = providerNames[result.provider || 'unknown'] || result.provider;
+        const destInfo = result.destination ? ` to ${result.destination}` : '';
+        const srcInfo = result.dataSource ? ` (source: ${result.dataSource})` : '';
+        return {
+            detected: true,
+            category: 'exfiltration',
+            severity: this.severity,
+            confidence: result.confidence,
+            reason: `Cloud upload detected: ${result.operation} via ${providerName}${destInfo}${srcInfo}`,
+            metadata: {
+                method: 'cloud',
+                destination: result.destination,
+                dataSource: result.dataSource,
+                command: result.command,
+            },
+        };
+    }
+}
+/**
+ * Create a cloud upload detector with the given severity
+ */
+export function createCloudUploadDetector(severity = 'high') {
+    return new CloudUploadDetector(severity);
+}
+//# sourceMappingURL=cloud-detector.js.map

package/dist/src/detectors/exfiltration/cloud-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-detector.js","sourceRoot":"","sources":["../../../../src/detectors/exfiltration/cloud-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,mCAAmC;IACnC;QACE,OAAO,EAAE,0DAA0D;QACnE,SAAS,EAAE,OAAO;QAClB,WAAW,EAAE,eAAe;KAC7B;IACD,mCAAmC;IACnC;QACE,OAAO,EAAE,0DAA0D;QACnE,SAAS,EAAE,OAAO;QAClB,WAAW,EAAE,oBAAoB;KAClC;IACD,oCAAoC;IACpC;QACE,OAAO,EAAE,4DAA4D;QACrE,SAAS,EAAE,SAAS;QACpB,WAAW,EAAE,oBAAoB;KAClC;IACD,uBAAuB;IACvB;QACE,OAAO,EAAE,+EAA+E;QACxF,SAAS,EAAE,kBAAkB;QAC7B,WAAW,EAAE,mBAAmB;KACjC;IACD,yCAAyC;IACzC;QACE,OAAO,EAAE,+EAA+E;QACxF,SAAS,EAAE,kBAAkB;QAC7B,WAAW,EAAE,mBAAmB;KACjC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,mCAAmC;IACnC;QACE,OAAO,EAAE,gFAAgF;QACzF,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,oBAAoB;KAClC;IACD,mCAAmC;IACnC;QACE,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,yBAAyB;KACvC;IACD,qCAAqC;IACrC;QACE,OAAO,EAAE,oFAAoF;QAC7F,SAAS,EAAE,cAAc;QACzB,WAAW,EAAE,0BAA0B;KACxC;IACD,oBAAoB;IACpB;QACE,OAAO,EAAE,+EAA+E;QACxF,SAAS,EAAE,mBAAmB;QAC9B,WAAW,EAAE,oBAAoB;KAClC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,+DAA+D;IAC/D;QACE,OAAO,EAAE,+FAA+F;QACxG,SAAS,EAAE,aAAa;QACxB,WAAW,EAAE,mBAAmB;KACjC;IACD,8DAA8D;IAC9D;QACE,OAAO,EAAE,+FAA+F;QACxG,SAAS,EAAE,aAAa;QACxB,WAAW,EAAE,wBAAwB;KACtC;IACD,yBAAyB;IACzB;QACE,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,wBAAwB;QACnC,WAAW,EAAE,uBAAuB;KACrC;IACD,+BAA+B;IAC/B;QACE,OAAO,EAAE,0EAA0E;QACnF,SAAS,EAAE,8BAA8B;QACzC,WAAW,EAAE,wBAAwB;KACtC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,gCAAgC;IAChC;QACE,OAAO,EAAE,wEAAwE;QACjF,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,qBAAqB;KACnC;IACD,kCAAkC;IAClC;QACE,OAAO,EAAE,4DAA4D;QACrE,SAAS,EAAE,eAAe;QAC1B,WAAW,EAAE,qBAAqB;KACnC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG;IAC3B,4BAA4B;IAC5B;QACE,OAAO,EAAE,6CAA6C;QACtD,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,sBAAsB;KACpC;IACD,uBAAuB;IACvB;QACE,OAAO,EAAE,sDAAsD;QAC/D,SAAS,EAAE,OAAO;QAClB,WAAW,EAAE,qBAAqB;KACnC;IACD,gCAAgC;IAChC;QACE,OAAO,EAAE,2DAA2D;QACpE,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,qBAAqB;KACnC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,qCAAqC;IACrC;QACE,OAAO,EAAE,qEAAqE;QAC9E,SAAS,EAAE,mBAAmB;QAC9B,WAAW,EAAE,gBAAgB;KAC9B;IACD,0BAA0B;IAC1B;QACE,OAAO,EAAE,yDAAyD;QAClE,SAAS,EAAE,kBAAkB;QAC7B,WAAW,EAAE,oBAAoB;KAClC;IACD,iCAAiC;IACjC;QACE,OAAO,EAAE,oDAAoD;QAC7D,SAAS,EAAE,0BAA0B;QACrC,WAAW,EAAE,gBAAgB;KAC9B;IACD,0BAA0B;IAC1B;QACE,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,mBAAmB;QAC9B,WAAW,EAAE,kBAAkB;KAChC;IACD,wCAAwC;IACxC;QACE,OAAO,EAAE,+CAA+C;QACxD,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,2BAA2B;KACzC;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,sBAAsB,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,qBAAqB,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,OAAO;gBACjB,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,oBAAoB;gBAC7C,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,sBAAsB,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,QAAQ;gBAClB,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,GAAG;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,oBAAoB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,QAAQ,EAAE,eAAe;gBACzB,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,GAAG;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,QAAQ,GAAG,SAAS,CAAC;YACzB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,QAAQ,GAAG,OAAO,CAAC;YACrB,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS;gBACjC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS;gBAClC,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,aAAa;IACb,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kBAAkB;IAClB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oBAAoB;IACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,aAAa;IACb,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,mBAAmB;IACnB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACtB,QAAQ,CAAW;IAE3B,YAAY,WAAqB,MAAM;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAyB;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;QAEhC,uBAAuB;QACvB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAED,eAAe;QACf,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,MAAM,CAAC;QACtB,CAAC;QAED,aAAa;QACb,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAED,eAAe;QACf,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,aAAa;QACb,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,OAAyB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAA2B;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,oBAAoB;YAC5B,eAAe,EAAE,uBAAuB;YACxC,OAAO,EAAE,eAAe;SACzB,CAAC;QAEF,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE3E,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,0BAA0B,MAAM,CAAC,SAAS,QAAQ,YAAY,GAAG,QAAQ,GAAG,OAAO,EAAE;YAC7F,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO;gBACf,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;SACF,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAqB,MAAM;IACnE,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/detectors/exfiltration/http-detector.d.ts

@@ -0,0 +1,47 @@
+/**
+ * HTTP Exfiltration Detector
+ * Detects HTTP POST/PUT requests that send data to external destinations
+ */
+import type { HttpMatchResult, DetectionContext, ExfiltrationDetectionResult, SubDetector } from './types.js';
+import type { Severity } from '../../config/index.js';
+/**
+ * Match curl POST/PUT commands
+ */
+export declare function matchCurlCommand(command: string): HttpMatchResult;
+/**
+ * Match wget POST commands
+ */
+export declare function matchWgetCommand(command: string): HttpMatchResult;
+/**
+ * Match httpie commands
+ */
+export declare function matchHttpieCommand(command: string): HttpMatchResult;
+/**
+ * Match HTTP client library patterns in code
+ */
+export declare function matchCodeHttpPattern(code: string): HttpMatchResult;
+/**
+ * Match encoded exfiltration patterns
+ */
+export declare function matchEncodedExfiltration(command: string): HttpMatchResult;
+/**
+ * Comprehensive HTTP exfiltration matching
+ */
+export declare function matchHttpExfiltration(text: string): HttpMatchResult;
+/**
+ * HTTP exfiltration detector class
+ */
+export declare class HttpDetector implements SubDetector {
+    private severity;
+    constructor(severity?: Severity);
+    /**
+     * Extract text content from tool context
+     */
+    private extractContent;
+    detect(context: DetectionContext): ExfiltrationDetectionResult | null;
+}
+/**
+ * Create an HTTP detector with the given severity
+ */
+export declare function createHttpDetector(severity?: Severity): HttpDetector;
+//# sourceMappingURL=http-detector.d.ts.map

package/dist/src/detectors/exfiltration/http-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-detector.d.ts","sourceRoot":"","sources":["../../../../src/detectors/exfiltration/http-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAmOtD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAgBjE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAgBjE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAenE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAmBlE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAgBzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAgCnE;AAED;;GAEG;AACH,qBAAa,YAAa,YAAW,WAAW;IAC9C,OAAO,CAAC,QAAQ,CAAW;gBAEf,QAAQ,GAAE,QAAiB;IAIvC;;OAEG;IACH,OAAO,CAAC,cAAc;IA6CtB,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,2BAA2B,GAAG,IAAI;CA6BtE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,QAAiB,GAAG,YAAY,CAE5E"}