secure-scan 1.2.2

package/src/rules/malware/constants/index.ts

@@ -0,0 +1,358 @@
+/**
+ * @fileoverview Malware Detection Constants
+ * @module rules/malware/constants
+ * 
+ * Central repository for all constants used in malware detection.
+ */
+
+import { MalwareSeverity, ConfidenceLevel, MitreTactic } from '../types';
+
+// ============================================================================
+// SCORING THRESHOLDS
+// ============================================================================
+
+/**
+ * Score thresholds for severity calculation
+ */
+export const SCORE_THRESHOLDS = {
+  CRITICAL: 85,
+  HIGH: 65,
+  MEDIUM: 40,
+  LOW: 20,
+  INFO: 0
+} as const;
+
+/**
+ * Risk level thresholds
+ */
+export const RISK_LEVELS = {
+  CRITICAL: { min: 85, label: 'critical' as const },
+  HIGH: { min: 65, label: 'high' as const },
+  MEDIUM: { min: 40, label: 'medium' as const },
+  LOW: { min: 20, label: 'low' as const },
+  MINIMAL: { min: 0, label: 'minimal' as const }
+} as const;
+
+/**
+ * Default scoring weights
+ */
+export const DEFAULT_SCORING_WEIGHTS = {
+  patternCount: 0.25,
+  obfuscation: 0.20,
+  networkAccess: 0.15,
+  commandExecution: 0.15,
+  persistence: 0.15,
+  dataAccess: 0.10
+} as const;
+
+// ============================================================================
+// ENTROPY THRESHOLDS
+// ============================================================================
+
+/**
+ * Entropy thresholds for obfuscation detection
+ */
+export const ENTROPY_THRESHOLDS = {
+  NORMAL: 4.5,           // Normal code
+  SUSPICIOUS: 5.5,       // Potentially obfuscated
+  HIGH_OBFUSCATION: 6.5, // Likely obfuscated
+  BINARY_DATA: 7.5       // Embedded binary/encrypted data
+} as const;
+
+// ============================================================================
+// PERFORMANCE LIMITS
+// ============================================================================
+
+/**
+ * Performance and safety limits
+ */
+export const LIMITS = {
+  /** Maximum execution time for a single regex in ms */
+  REGEX_TIMEOUT: 1000,
+  /** Maximum execution time for a single rule in ms */
+  RULE_TIMEOUT: 5000,
+  /** Maximum execution time for a single file in ms */
+  FILE_TIMEOUT: 30000,
+  /** Maximum matches per pattern before stopping */
+  MAX_MATCHES_PER_PATTERN: 100,
+  /** Maximum findings per file */
+  MAX_FINDINGS_PER_FILE: 500,
+  /** Maximum file size to analyze in bytes */
+  MAX_FILE_SIZE: 10 * 1024 * 1024, // 10MB
+  /** Maximum pattern matches to store for a finding */
+  MAX_PATTERN_MATCHES_PER_FINDING: 50,
+  /** Maximum code snippet length */
+  MAX_SNIPPET_LENGTH: 500,
+  /** Lines of context before/after match */
+  CONTEXT_LINES: 3
+} as const;
+
+// ============================================================================
+// OBFUSCATION INDICATORS
+// ============================================================================
+
+/**
+ * Common obfuscation patterns and their weights
+ */
+export const OBFUSCATION_INDICATORS = {
+  /** Hex escape sequences */
+  HEX_ESCAPES: { pattern: /\\x[0-9a-f]{2}/gi, weight: 0.1 },
+  /** Unicode escape sequences */
+  UNICODE_ESCAPES: { pattern: /\\u[0-9a-f]{4}/gi, weight: 0.1 },
+  /** Long base64 strings */
+  BASE64_STRINGS: { pattern: /[A-Za-z0-9+/]{50,}={0,2}/g, weight: 0.15 },
+  /** String concatenation obfuscation */
+  STRING_CONCAT: { pattern: /['"][a-z]['"](?:\s*\+\s*['"][a-z]['"]){3,}/gi, weight: 0.2 },
+  /** Array access obfuscation */
+  ARRAY_ACCESS: { pattern: /\[['"]\w+['"]\]/g, weight: 0.05 },
+  /** Obfuscator variable names */
+  OBFUSCATOR_VARS: { pattern: /_0x[a-f0-9]{4,}/gi, weight: 0.3 },
+  /** JSFuck-style obfuscation */
+  JSFUCK: { pattern: /\[\]!+/g, weight: 0.4 },
+  /** Long single-line functions */
+  LONG_LINES: { threshold: 500, weight: 0.1 },
+  /** High character diversity */
+  CHAR_DIVERSITY: { threshold: 0.7, weight: 0.15 }
+} as const;
+
+// ============================================================================
+// SUSPICIOUS DOMAINS & IPS
+// ============================================================================
+
+/**
+ * Known malicious TLDs
+ */
+export const SUSPICIOUS_TLDS = [
+  '.onion',
+  '.bit',
+  '.i2p',
+  '.bazar',
+  '.coin',
+  '.lib',
+  '.emc'
+] as const;
+
+/**
+ * Known malicious hosting services
+ */
+export const SUSPICIOUS_HOSTS = [
+  'pastebin.com',
+  'hastebin.com',
+  'ghostbin.com',
+  'rentry.co',
+  'dpaste.org',
+  'ngrok.io',
+  'serveo.net',
+  'localhost.run',
+  'localtunnel.me',
+  'webhook.site',
+  'requestbin.com',
+  'pipedream.com'
+] as const;
+
+/**
+ * Private IP ranges (for reverse shell detection)
+ */
+export const PRIVATE_IP_RANGES = [
+  /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/,
+  /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/,
+  /^192\.168\.\d{1,3}\.\d{1,3}$/,
+  /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
+] as const;
+
+// ============================================================================
+// MINING INDICATORS
+// ============================================================================
+
+/**
+ * Known cryptomining pools and software
+ */
+export const CRYPTO_INDICATORS = {
+  POOLS: [
+    'pool.minergate.com',
+    'xmr.pool.minergate.com',
+    'pool.supportxmr.com',
+    'xmr-eu1.nanopool.org',
+    'monerohash.com',
+    'minexmr.com',
+    'pool.hashvault.pro',
+    'gulf.moneroocean.stream'
+  ],
+  SOFTWARE: [
+    'coinhive',
+    'cryptoloot',
+    'coin-hive',
+    'coinimp',
+    'cryptonight',
+    'xmrig',
+    'xmr-stak',
+    'minerd',
+    'cgminer',
+    'bfgminer'
+  ],
+  ALGORITHMS: [
+    'CryptoNight',
+    'RandomX',
+    'Ethash',
+    'Scrypt',
+    'SHA256d'
+  ],
+  PROTOCOLS: [
+    'stratum+tcp://',
+    'stratum+ssl://',
+    'stratum2+tcp://'
+  ]
+} as const;
+
+// ============================================================================
+// SHELL COMMANDS
+// ============================================================================
+
+/**
+ * Dangerous shell commands
+ */
+export const DANGEROUS_COMMANDS = {
+  SHELLS: ['/bin/bash', '/bin/sh', '/bin/zsh', 'cmd.exe', 'powershell.exe'],
+  NETCAT: ['nc', 'ncat', 'netcat', 'socat'],
+  DOWNLOADERS: ['curl', 'wget', 'Invoke-WebRequest', 'certutil'],
+  EXECUTION: ['exec', 'eval', 'spawn', 'fork', 'CreateProcess']
+} as const;
+
+// ============================================================================
+// FILE PATTERNS
+// ============================================================================
+
+/**
+ * File patterns to ignore
+ */
+export const IGNORE_PATTERNS = {
+  VENDOR: [
+    /node_modules\//,
+    /vendor\//,
+    /bower_components\//,
+    /\.bundle\//,
+    /packages\//
+  ],
+  BUILD: [
+    /dist\//,
+    /build\//,
+    /out\//,
+    /\.next\//,
+    /\.nuxt\//
+  ],
+  TEST: [
+    /\.test\.[jt]sx?$/,
+    /\.spec\.[jt]sx?$/,
+    /__tests__\//,
+    /test\//,
+    /tests\//
+  ],
+  GENERATED: [
+    /\.min\.[jt]s$/,
+    /\.bundle\.[jt]s$/,
+    /\.generated\./
+  ]
+} as const;
+
+// ============================================================================
+// SEVERITY MAPPING
+// ============================================================================
+
+/**
+ * Map threat types to default severities
+ */
+export const THREAT_SEVERITY_MAP: Record<string, MalwareSeverity> = {
+  reverse_shell: MalwareSeverity.CRITICAL,
+  web_shell: MalwareSeverity.CRITICAL,
+  backdoor: MalwareSeverity.CRITICAL,
+  remote_access_trojan: MalwareSeverity.CRITICAL,
+  keylogger: MalwareSeverity.CRITICAL,
+  credential_stealer: MalwareSeverity.CRITICAL,
+  token_stealer: MalwareSeverity.HIGH,
+  data_exfiltration: MalwareSeverity.CRITICAL,
+  cryptominer: MalwareSeverity.HIGH,
+  dropper: MalwareSeverity.HIGH,
+  loader: MalwareSeverity.HIGH,
+  obfuscated_code: MalwareSeverity.MEDIUM,
+  c2_communication: MalwareSeverity.HIGH,
+  persistence: MalwareSeverity.HIGH,
+  fileless: MalwareSeverity.HIGH,
+  supply_chain: MalwareSeverity.CRITICAL,
+  suspicious_network: MalwareSeverity.MEDIUM
+};
+
+/**
+ * Confidence boost based on pattern count
+ */
+export const PATTERN_COUNT_CONFIDENCE_BOOST: Record<number, ConfidenceLevel> = {
+  1: ConfidenceLevel.LOW,
+  2: ConfidenceLevel.MEDIUM,
+  3: ConfidenceLevel.HIGH,
+  5: ConfidenceLevel.CONFIRMED
+};
+
+// ============================================================================
+// MITRE ATT&CK MAPPINGS
+// ============================================================================
+
+/**
+ * Common MITRE ATT&CK technique mappings
+ */
+export const MITRE_TECHNIQUES = {
+  // Execution
+  COMMAND_LINE: { id: 'T1059', name: 'Command and Scripting Interpreter', tactic: MitreTactic.EXECUTION },
+  JAVASCRIPT: { id: 'T1059.007', name: 'JavaScript', tactic: MitreTactic.EXECUTION },
+  PYTHON: { id: 'T1059.006', name: 'Python', tactic: MitreTactic.EXECUTION },
+  POWERSHELL: { id: 'T1059.001', name: 'PowerShell', tactic: MitreTactic.EXECUTION },
+  
+  // Persistence
+  WEB_SHELL: { id: 'T1505.003', name: 'Web Shell', tactic: MitreTactic.PERSISTENCE },
+  SCHEDULED_TASK: { id: 'T1053', name: 'Scheduled Task/Job', tactic: MitreTactic.PERSISTENCE },
+  
+  // Credential Access
+  KEYLOGGING: { id: 'T1056.001', name: 'Keylogging', tactic: MitreTactic.CREDENTIAL_ACCESS },
+  CREDENTIAL_DUMPING: { id: 'T1003', name: 'OS Credential Dumping', tactic: MitreTactic.CREDENTIAL_ACCESS },
+  
+  // Defense Evasion
+  OBFUSCATION: { id: 'T1027', name: 'Obfuscated Files or Information', tactic: MitreTactic.DEFENSE_EVASION },
+  DEOBFUSCATE: { id: 'T1140', name: 'Deobfuscate/Decode Files or Information', tactic: MitreTactic.DEFENSE_EVASION },
+  
+  // Command and Control
+  APP_LAYER: { id: 'T1071', name: 'Application Layer Protocol', tactic: MitreTactic.COMMAND_AND_CONTROL },
+  INGRESS_TOOL: { id: 'T1105', name: 'Ingress Tool Transfer', tactic: MitreTactic.COMMAND_AND_CONTROL },
+  
+  // Exfiltration
+  EXFIL_WEB: { id: 'T1041', name: 'Exfiltration Over C2 Channel', tactic: MitreTactic.EXFILTRATION },
+  
+  // Impact
+  RESOURCE_HIJACKING: { id: 'T1496', name: 'Resource Hijacking', tactic: MitreTactic.IMPACT }
+} as const;
+
+// ============================================================================
+// LANGUAGE SPECIFIC PATTERNS
+// ============================================================================
+
+/**
+ * Language-specific dangerous function patterns
+ */
+export const DANGEROUS_FUNCTIONS = {
+  javascript: ['eval', 'Function', 'setTimeout', 'setInterval', 'execScript'],
+  typescript: ['eval', 'Function', 'setTimeout', 'setInterval'],
+  python: ['eval', 'exec', 'compile', '__import__', 'execfile'],
+  php: ['eval', 'exec', 'system', 'passthru', 'shell_exec', 'popen', 'proc_open', 'assert', 'preg_replace'],
+  ruby: ['eval', 'exec', 'system', '`', 'spawn', 'Open3'],
+  csharp: ['Process.Start', 'Assembly.Load', 'Activator.CreateInstance'],
+  java: ['Runtime.exec', 'ProcessBuilder', 'ScriptEngine.eval']
+} as const;
+
+/**
+ * Language-specific network functions
+ */
+export const NETWORK_FUNCTIONS = {
+  javascript: ['fetch', 'XMLHttpRequest', 'axios', 'request', 'http.get', 'https.get'],
+  typescript: ['fetch', 'XMLHttpRequest', 'axios', 'request', 'http.get', 'https.get'],
+  python: ['urllib', 'requests', 'httplib', 'socket', 'http.client'],
+  php: ['file_get_contents', 'curl_exec', 'fopen', 'fsockopen'],
+  csharp: ['HttpClient', 'WebRequest', 'WebClient', 'TcpClient'],
+  java: ['HttpURLConnection', 'URLConnection', 'Socket', 'HttpClient']
+} as const;