secure-scan 1.2.2

package/dist/rules/malware/index.js

@@ -0,0 +1,837 @@
+"use strict";
+/**
+ * @fileoverview Malware Detection Module - Main Entry Point
+ * @module rules/malware
+ *
+ * Enterprise-grade malware detection system with:
+ * - Multi-pattern detection (Regex, AST, Heuristic, Semantic)
+ * - Dynamic scoring with MITRE ATT&CK integration
+ * - 60+ comprehensive rules across 7 categories
+ * - Support for 13 programming languages
+ * - ReDoS protection and timeout safeguards
+ * - Obfuscation detection and entropy analysis
+ *
+ * @example
+ * ```typescript
+ * import { MalwareRuleEngine, createMalwareEngine } from './rules/malware';
+ *
+ * // Create engine with all rules
+ * const engine = createMalwareEngine();
+ *
+ * // Analyze code
+ * const findings = await engine.analyze(code, {
+ *   filePath: 'suspicious.js',
+ *   language: 'javascript'
+ * });
+ *
+ * // Check results
+ * findings.forEach(finding => {
+ *   console.log(`${finding.severity}: ${finding.ruleName}`);
+ *   console.log(`Score: ${finding.score.totalScore}/100`);
+ * });
+ * ```
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.malwareRules = exports.MALWARE_MODULE_INFO = exports.highConfidenceRules = exports.criticalRules = exports.allMalwareRules = exports.networkRulesV2 = exports.loaderRulesV2 = exports.obfuscationRulesV2 = exports.exfiltrationRulesV2 = exports.keyloggerRulesV2 = exports.cryptominerRulesV2 = exports.backdoorRulesV2 = exports.quickScan = exports.createDefaultEngine = exports.PatternMatcher = exports.MalwareRuleEngine = exports.MalwareScoreCalculator = exports.MITRE_TECHNIQUES = exports.DANGEROUS_FUNCTIONS = exports.CRYPTO_INDICATORS = exports.SUSPICIOUS_HOSTS = exports.OBFUSCATION_INDICATORS = exports.LIMITS = exports.ENTROPY_THRESHOLDS = exports.SCORE_THRESHOLDS = exports.extractSuspiciousStrings = exports.analyzeBase64Content = exports.extractSnippet = exports.safeRegexMatch = exports.detectEnvironmentChecks = exports.detectAntiDebugging = exports.detectObfuscationLevel = exports.normalizeCode = exports.analyzeEntropyByLine = exports.calculateEntropy = void 0;
+exports.createMalwareEngine = createMalwareEngine;
+exports.createCriticalOnlyEngine = createCriticalOnlyEngine;
+exports.createCustomEngine = createCustomEngine;
+exports.scanForMalware = scanForMalware;
+exports.hasMalwareCategory = hasMalwareCategory;
+exports.generateMalwareReport = generateMalwareReport;
+exports.getModuleInfo = getModuleInfo;
+// ============================================================================
+// LEGACY TYPE COMPATIBILITY
+// ============================================================================
+const types_1 = require("../../types");
+const standards_1 = require("../standards");
+// ============================================================================
+// NEW TYPE EXPORTS
+// ============================================================================
+__exportStar(require("./types"), exports);
+// ============================================================================
+// UTILITY EXPORTS
+// ============================================================================
+var utils_1 = require("./utils");
+Object.defineProperty(exports, "calculateEntropy", { enumerable: true, get: function () { return utils_1.calculateEntropy; } });
+Object.defineProperty(exports, "analyzeEntropyByLine", { enumerable: true, get: function () { return utils_1.analyzeEntropyByLine; } });
+Object.defineProperty(exports, "normalizeCode", { enumerable: true, get: function () { return utils_1.normalizeCode; } });
+Object.defineProperty(exports, "detectObfuscationLevel", { enumerable: true, get: function () { return utils_1.detectObfuscationLevel; } });
+Object.defineProperty(exports, "detectAntiDebugging", { enumerable: true, get: function () { return utils_1.detectAntiDebugging; } });
+Object.defineProperty(exports, "detectEnvironmentChecks", { enumerable: true, get: function () { return utils_1.detectEnvironmentChecks; } });
+Object.defineProperty(exports, "safeRegexMatch", { enumerable: true, get: function () { return utils_1.safeRegexMatch; } });
+Object.defineProperty(exports, "extractSnippet", { enumerable: true, get: function () { return utils_1.extractSnippet; } });
+Object.defineProperty(exports, "analyzeBase64Content", { enumerable: true, get: function () { return utils_1.analyzeBase64Content; } });
+Object.defineProperty(exports, "extractSuspiciousStrings", { enumerable: true, get: function () { return utils_1.extractSuspiciousStrings; } });
+// ============================================================================
+// CONSTANTS EXPORTS
+// ============================================================================
+var constants_1 = require("./constants");
+Object.defineProperty(exports, "SCORE_THRESHOLDS", { enumerable: true, get: function () { return constants_1.SCORE_THRESHOLDS; } });
+Object.defineProperty(exports, "ENTROPY_THRESHOLDS", { enumerable: true, get: function () { return constants_1.ENTROPY_THRESHOLDS; } });
+Object.defineProperty(exports, "LIMITS", { enumerable: true, get: function () { return constants_1.LIMITS; } });
+Object.defineProperty(exports, "OBFUSCATION_INDICATORS", { enumerable: true, get: function () { return constants_1.OBFUSCATION_INDICATORS; } });
+Object.defineProperty(exports, "SUSPICIOUS_HOSTS", { enumerable: true, get: function () { return constants_1.SUSPICIOUS_HOSTS; } });
+Object.defineProperty(exports, "CRYPTO_INDICATORS", { enumerable: true, get: function () { return constants_1.CRYPTO_INDICATORS; } });
+Object.defineProperty(exports, "DANGEROUS_FUNCTIONS", { enumerable: true, get: function () { return constants_1.DANGEROUS_FUNCTIONS; } });
+Object.defineProperty(exports, "MITRE_TECHNIQUES", { enumerable: true, get: function () { return constants_1.MITRE_TECHNIQUES; } });
+// ============================================================================
+// SCORING EXPORTS
+// ============================================================================
+var scoring_1 = require("./scoring");
+Object.defineProperty(exports, "MalwareScoreCalculator", { enumerable: true, get: function () { return scoring_1.MalwareScoreCalculator; } });
+// ============================================================================
+// ENGINE EXPORTS
+// ============================================================================
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "MalwareRuleEngine", { enumerable: true, get: function () { return engine_1.MalwareRuleEngine; } });
+Object.defineProperty(exports, "PatternMatcher", { enumerable: true, get: function () { return engine_1.PatternMatcher; } });
+Object.defineProperty(exports, "createDefaultEngine", { enumerable: true, get: function () { return engine_1.createDefaultEngine; } });
+Object.defineProperty(exports, "quickScan", { enumerable: true, get: function () { return engine_1.quickScan; } });
+// ============================================================================
+// RULE CATEGORY EXPORTS
+// ============================================================================
+const backdoors_1 = require("./categories/backdoors");
+Object.defineProperty(exports, "backdoorRulesV2", { enumerable: true, get: function () { return backdoors_1.backdoorRules; } });
+const cryptominers_1 = require("./categories/cryptominers");
+Object.defineProperty(exports, "cryptominerRulesV2", { enumerable: true, get: function () { return cryptominers_1.cryptominerRules; } });
+const keyloggers_1 = require("./categories/keyloggers");
+Object.defineProperty(exports, "keyloggerRulesV2", { enumerable: true, get: function () { return keyloggers_1.keyloggerRules; } });
+const exfiltration_1 = require("./categories/exfiltration");
+Object.defineProperty(exports, "exfiltrationRulesV2", { enumerable: true, get: function () { return exfiltration_1.exfiltrationRules; } });
+const obfuscation_1 = require("./categories/obfuscation");
+Object.defineProperty(exports, "obfuscationRulesV2", { enumerable: true, get: function () { return obfuscation_1.obfuscationRules; } });
+const loaders_1 = require("./categories/loaders");
+Object.defineProperty(exports, "loaderRulesV2", { enumerable: true, get: function () { return loaders_1.loaderRules; } });
+const network_1 = require("./categories/network");
+Object.defineProperty(exports, "networkRulesV2", { enumerable: true, get: function () { return network_1.networkRules; } });
+/**
+ * All malware detection rules (60+ rules)
+ */
+exports.allMalwareRules = [
+    ...backdoors_1.backdoorRules, // 10 rules
+    ...cryptominers_1.cryptominerRules, // 11 rules
+    ...keyloggers_1.keyloggerRules, // 12 rules
+    ...exfiltration_1.exfiltrationRules, // 15 rules
+    ...obfuscation_1.obfuscationRules, // 14 rules
+    ...loaders_1.loaderRules, // 9 rules
+    ...network_1.networkRules // 10 rules
+];
+/**
+ * Critical severity rules only
+ */
+exports.criticalRules = exports.allMalwareRules.filter(rule => rule.severity === 'critical');
+/**
+ * High confidence rules only
+ */
+exports.highConfidenceRules = exports.allMalwareRules.filter(rule => rule.confidence === 'high');
+// ============================================================================
+// ENGINE FACTORY FUNCTIONS
+// ============================================================================
+const engine_2 = require("./engine");
+/**
+ * Create a fully configured malware detection engine with all rules
+ *
+ * @param options - Optional analysis configuration
+ * @returns Configured MalwareRuleEngine instance
+ *
+ * @example
+ * ```typescript
+ * const engine = createMalwareEngine({
+ *   enableHeuristics: true,
+ *   enableAstAnalysis: true,
+ *   minConfidence: 0.5
+ * });
+ * ```
+ */
+function createMalwareEngine(options) {
+    return new engine_2.MalwareRuleEngine(exports.allMalwareRules, options);
+}
+/**
+ * Create an engine with only critical severity rules
+ *
+ * @param options - Optional analysis configuration
+ * @returns MalwareRuleEngine with critical rules only
+ */
+function createCriticalOnlyEngine(options) {
+    return new engine_2.MalwareRuleEngine(exports.criticalRules, options);
+}
+/**
+ * Create an engine with custom rule subset
+ *
+ * @param rules - Array of rules to include
+ * @param options - Optional analysis configuration
+ * @returns MalwareRuleEngine with specified rules
+ */
+function createCustomEngine(rules, options) {
+    return new engine_2.MalwareRuleEngine(rules, options);
+}
+// ============================================================================
+// CONVENIENCE FUNCTIONS
+// ============================================================================
+const types_2 = require("./types");
+/**
+ * Quick malware scan with default settings
+ *
+ * @param code - Code to analyze
+ * @param language - Programming language
+ * @returns Scan results with malicious status
+ *
+ * @example
+ * ```typescript
+ * const result = await scanForMalware(suspiciousCode, 'javascript');
+ * if (result.isMalicious) {
+ *   console.log(`Malware detected! Score: ${result.score}`);
+ *   result.findings.forEach(f => console.log(f.ruleName));
+ * }
+ * ```
+ */
+async function scanForMalware(code, language) {
+    const engine = createMalwareEngine();
+    const context = {
+        filePath: 'scan',
+        content: code,
+        language: language ?? types_2.SupportedLanguage.JAVASCRIPT
+    };
+    const findings = await engine.analyze(context);
+    const maxScore = findings.length > 0
+        ? Math.max(...findings.map(f => f.malwareScore.score))
+        : 0;
+    const criticalCount = findings.filter(f => f.severity === 'critical').length;
+    const highCount = findings.filter(f => f.severity === 'high').length;
+    let severity;
+    if (maxScore >= 85)
+        severity = 'critical';
+    else if (maxScore >= 65)
+        severity = 'high';
+    else if (maxScore >= 40)
+        severity = 'medium';
+    else if (maxScore >= 20)
+        severity = 'low';
+    else
+        severity = 'clean';
+    return {
+        isMalicious: maxScore >= 40, // Medium threshold
+        score: maxScore,
+        severity,
+        findings,
+        summary: {
+            totalFindings: findings.length,
+            criticalCount,
+            highCount
+        }
+    };
+}
+/**
+ * Check if code contains specific malware category
+ *
+ * @param code - Code to analyze
+ * @param category - Malware category to check
+ * @param language - Programming language
+ * @returns True if category detected
+ *
+ * @example
+ * ```typescript
+ * const hasBackdoor = await hasMalwareCategory(code, 'backdoor', 'javascript');
+ * ```
+ */
+async function hasMalwareCategory(code, category, language) {
+    let rules;
+    switch (category) {
+        case 'backdoor':
+            rules = backdoors_1.backdoorRules;
+            break;
+        case 'cryptominer':
+            rules = cryptominers_1.cryptominerRules;
+            break;
+        case 'keylogger':
+            rules = keyloggers_1.keyloggerRules;
+            break;
+        case 'exfiltration':
+            rules = exfiltration_1.exfiltrationRules;
+            break;
+        case 'obfuscation':
+            rules = obfuscation_1.obfuscationRules;
+            break;
+        case 'loader':
+            rules = loaders_1.loaderRules;
+            break;
+        case 'network':
+            rules = network_1.networkRules;
+            break;
+    }
+    const engine = new engine_2.MalwareRuleEngine(rules);
+    const context = {
+        filePath: 'scan',
+        content: code,
+        language: language ?? types_2.SupportedLanguage.JAVASCRIPT
+    };
+    const findings = await engine.analyze(context);
+    return findings.length > 0;
+}
+/**
+ * Analyze code and generate detailed report
+ *
+ * @param code - Code to analyze
+ * @param filePath - File path for context
+ * @param language - Programming language
+ * @returns Detailed analysis report
+ */
+async function generateMalwareReport(code, filePath, language) {
+    const engine = createMalwareEngine();
+    const context = {
+        filePath,
+        content: code,
+        language: language ?? types_2.SupportedLanguage.JAVASCRIPT
+    };
+    const findings = await engine.analyze(context);
+    const summary = engine.generateSummary(findings);
+    // Aggregate MITRE ATT&CK techniques
+    const mitreTechniques = new Map();
+    for (const finding of findings) {
+        if (finding.mitreAttack) {
+            for (const mitre of finding.mitreAttack) {
+                const key = `${mitre.tacticId}-${mitre.techniqueId}`;
+                const existing = mitreTechniques.get(key);
+                if (existing) {
+                    existing.count++;
+                }
+                else {
+                    mitreTechniques.set(key, {
+                        tactic: mitre.tacticName,
+                        technique: mitre.techniqueName,
+                        count: 1
+                    });
+                }
+            }
+        }
+    }
+    // Generate recommendations
+    const recommendations = [];
+    if (summary.criticalCount > 0) {
+        recommendations.push('URGENT: Critical malware detected. Isolate and analyze immediately.');
+    }
+    if (summary.bySeverity['high'] > 0) {
+        recommendations.push('High severity threats found. Review and remove malicious code.');
+    }
+    if (findings.some(f => String(f.threatType).includes('backdoor'))) {
+        recommendations.push('Backdoor detected. Check for unauthorized access and reset credentials.');
+    }
+    if (findings.some(f => String(f.threatType).includes('exfiltration'))) {
+        recommendations.push('Data exfiltration detected. Investigate what data may have been stolen.');
+    }
+    if (findings.some(f => String(f.category) === 'obfuscation')) {
+        recommendations.push('Obfuscation detected. Use deobfuscation tools to analyze intent.');
+    }
+    // Calculate by category
+    const byCategory = {};
+    for (const finding of findings) {
+        byCategory[finding.category] = (byCategory[finding.category] || 0) + 1;
+    }
+    return {
+        filePath,
+        language,
+        timestamp: new Date(),
+        findings,
+        summary: {
+            ...summary,
+            byCategory,
+            isMalicious: summary.highestScore >= 40
+        },
+        mitreAttack: Array.from(mitreTechniques.values()),
+        recommendations
+    };
+}
+// ============================================================================
+// MODULE METADATA
+// ============================================================================
+exports.MALWARE_MODULE_INFO = {
+    version: '2.0.0',
+    totalRules: exports.allMalwareRules.length,
+    categories: [
+        'backdoors',
+        'cryptominers',
+        'keyloggers',
+        'exfiltration',
+        'obfuscation',
+        'loaders',
+        'network'
+    ],
+    supportedLanguages: [
+        'javascript',
+        'typescript',
+        'python',
+        'php',
+        'c',
+        'cpp',
+        'csharp',
+        'java',
+        'ruby',
+        'go',
+        'rust',
+        'shell',
+        'powershell'
+    ],
+    features: [
+        'Multi-pattern detection (Regex, AST, Heuristic, Semantic)',
+        'Dynamic malware scoring (0-100)',
+        'MITRE ATT&CK framework integration',
+        'Obfuscation and entropy analysis',
+        'ReDoS protection',
+        'Concurrent file analysis',
+        'Detailed remediation steps',
+        'False positive reduction'
+    ]
+};
+/**
+ * Get module information
+ */
+function getModuleInfo() {
+    return exports.MALWARE_MODULE_INFO;
+}
+// ============================================================================
+// LEGACY COMPATIBILITY - ORIGINAL RULES
+// ============================================================================
+/**
+ * Backdoor Detection Rules
+ */
+const backdoorRules = [
+    {
+        id: 'MAL-BACK-001',
+        name: 'Potential Backdoor - Reverse Shell',
+        description: 'Code pattern consistent with a reverse shell detected. This allows remote attackers to gain shell access to the system.',
+        languages: ['javascript', 'typescript', 'python', 'php', 'c', 'cpp', 'csharp'],
+        threatType: types_1.ThreatType.REVERSE_SHELL,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.CRITICAL,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.REVERSE_SHELL),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: 'socket\\.(?:connect|create_connection)\\s*\\([^)]*\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: '\\/bin\\/(?:bash|sh)\\s+-i',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'nc\\s+-e\\s+\\/bin\\/(?:bash|sh)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'subprocess\\.(?:Popen|call).*(?:bash|sh|cmd)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'dup2\\s*\\(.*(?:STDIN|STDOUT|STDERR)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'CreateProcess.*cmd\\.exe',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'This code appears to implement a reverse shell backdoor. Remove immediately and investigate how this code was introduced. Audit all recent commits and contributor access.',
+        enabled: true,
+        tags: ['backdoor', 'reverse-shell', 'malware', 'critical']
+    },
+    {
+        id: 'MAL-BACK-002',
+        name: 'Web Shell Pattern',
+        description: 'Code pattern consistent with a web shell detected. Web shells provide attackers with remote command execution via web interface.',
+        languages: ['php', 'python', 'javascript', 'typescript'],
+        threatType: types_1.ThreatType.BACKDOOR,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.CRITICAL,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.BACKDOOR),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: '\\$_(?:GET|POST|REQUEST)\\s*\\[[\'"][^\'"]+[\'"]\\s*\\].*(?:exec|system|passthru|shell_exec|eval)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'eval\\s*\\(\\s*(?:base64_decode|gzinflate|str_rot13)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'assert\\s*\\(\\s*\\$_',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'preg_replace\\s*\\([^)]*\\/e[\'"]',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'This appears to be a web shell. Remove immediately. Investigate system for other compromises. Check web server logs for unauthorized access.',
+        enabled: true,
+        tags: ['webshell', 'backdoor', 'rce', 'critical']
+    }
+];
+/**
+ * Cryptominer Detection Rules
+ */
+const cryptominerRules = [
+    {
+        id: 'MAL-CRYPT-001',
+        name: 'Cryptocurrency Mining Code',
+        description: 'Code patterns associated with cryptocurrency mining detected. This may indicate unauthorized use of computing resources.',
+        languages: ['javascript', 'typescript', 'python', 'php'],
+        threatType: types_1.ThreatType.CRYPTOMINER,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.HIGH,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.CRYPTOMINER),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: 'coinhive|cryptoloot|coin-hive|coinimp|cryptonight',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'stratum\\+tcp:\\/\\/',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'xmrig|xmr-stak|minerd|cgminer',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'CryptoNight|RandomX|Ethash',
+                flags: 'g'
+            },
+            {
+                type: 'regex',
+                pattern: 'miner\\.(?:start|stop|mine)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'hashrate|nonce.*difficulty',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'Remove cryptocurrency mining code immediately. This is resource theft. Investigate how this code was introduced and review access controls.',
+        enabled: true,
+        tags: ['cryptominer', 'resource-abuse', 'malware']
+    }
+];
+/**
+ * Keylogger Detection Rules
+ */
+const keyloggerRules = [
+    {
+        id: 'MAL-KEY-001',
+        name: 'Potential Keylogger',
+        description: 'Code pattern consistent with keylogging behavior detected. Keyloggers capture and potentially exfiltrate user keystrokes.',
+        languages: ['javascript', 'typescript', 'python', 'csharp', 'c', 'cpp'],
+        threatType: types_1.ThreatType.KEYLOGGER,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.CRITICAL,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.KEYLOGGER),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: 'addEventListener\\s*\\([\'"]key(?:down|up|press)[\'"]',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'onkey(?:down|up|press)\\s*=',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'pynput\\.keyboard\\.Listener',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'GetAsyncKeyState|SetWindowsHookEx.*WH_KEYBOARD',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'keyboard\\.on_(?:press|release)',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'This code captures keyboard input. If not intentional for legitimate purposes (like accessibility), remove immediately and investigate.',
+        enabled: true,
+        tags: ['keylogger', 'spyware', 'malware', 'critical']
+    }
+];
+/**
+ * Data Exfiltration Detection Rules
+ */
+const exfiltrationRules = [
+    {
+        id: 'MAL-EXFIL-001',
+        name: 'Suspicious Data Exfiltration',
+        description: 'Code pattern suggests collection and transmission of sensitive data to external endpoints.',
+        languages: ['javascript', 'typescript', 'python', 'php'],
+        threatType: types_1.ThreatType.DATA_EXFILTRATION,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.CRITICAL,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.DATA_EXFILTRATION),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: 'document\\.cookie.*(?:fetch|XMLHttpRequest|ajax|axios)',
+                flags: 'gis'
+            },
+            {
+                type: 'regex',
+                pattern: 'localStorage.*(?:fetch|XMLHttpRequest|ajax)',
+                flags: 'gis'
+            },
+            {
+                type: 'regex',
+                pattern: '(?:password|credit|ssn|secret).*(?:http|fetch|post)',
+                flags: 'gis'
+            },
+            {
+                type: 'regex',
+                pattern: 'navigator\\.(?:credentials|clipboard).*fetch',
+                flags: 'gis'
+            }
+        ],
+        remediation: 'This code appears to collect and transmit sensitive data. Verify this is intentional and authorized. If not, remove immediately and audit data flows.',
+        enabled: true,
+        tags: ['exfiltration', 'data-theft', 'malware']
+    }
+];
+/**
+ * Obfuscated Code Detection Rules
+ */
+const obfuscationRules = [
+    {
+        id: 'MAL-OBF-001',
+        name: 'Heavily Obfuscated Code',
+        description: 'Code appears to be heavily obfuscated, potentially hiding malicious functionality. Legitimate code rarely requires this level of obfuscation.',
+        languages: ['javascript', 'typescript', 'python', 'php'],
+        threatType: types_1.ThreatType.OBFUSCATED_CODE,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.HIGH,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.OBFUSCATED_CODE),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: '\\\\x[0-9a-f]{2}(?:\\\\x[0-9a-f]{2}){10,}',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: '\\\\u[0-9a-f]{4}(?:\\\\u[0-9a-f]{4}){10,}',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'String\\.fromCharCode\\s*\\([^)]{50,}\\)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'atob\\s*\\([\'"][A-Za-z0-9+/=]{100,}[\'"]\\)',
+                flags: 'g'
+            },
+            {
+                type: 'regex',
+                pattern: 'eval\\s*\\(\\s*(?:atob|Buffer\\.from|unescape)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: '_0x[a-f0-9]{4,}',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'Heavily obfuscated code should be investigated. Deobfuscate and review the actual functionality. Consider removing if source cannot be verified.',
+        enabled: true,
+        tags: ['obfuscation', 'suspicious', 'malware']
+    }
+];
+/**
+ * Embedded Payload Detection Rules
+ */
+const payloadRules = [
+    {
+        id: 'MAL-PAYLOAD-001',
+        name: 'Embedded Binary Payload',
+        description: 'Large base64-encoded or hex-encoded data detected that may contain embedded malware or executable payloads.',
+        languages: ['javascript', 'typescript', 'python', 'php', 'java', 'csharp'],
+        threatType: types_1.ThreatType.EMBEDDED_PAYLOAD,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.HIGH,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.EMBEDDED_PAYLOAD),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: '[\'"][A-Za-z0-9+/]{500,}={0,2}[\'"]',
+                flags: 'g'
+            },
+            {
+                type: 'regex',
+                pattern: '(?:4d5a|7f454c46|cafebabe)[0-9a-f]{100,}',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'base64\\.b64decode\\s*\\([\'"][A-Za-z0-9+/]{200,}',
+                flags: 'g'
+            }
+        ],
+        remediation: 'Large embedded binary data should be investigated. Extract and analyze the payload. If legitimate, document its purpose; otherwise, remove.',
+        enabled: true,
+        tags: ['payload', 'binary', 'embedded', 'malware']
+    }
+];
+/**
+ * Suspicious Network Activity Rules
+ */
+const networkRules = [
+    {
+        id: 'MAL-NET-001',
+        name: 'Suspicious External Connection',
+        description: 'Code makes connections to external IP addresses or suspicious domains. This may indicate C2 communication or data exfiltration.',
+        languages: ['javascript', 'typescript', 'python', 'php', 'java', 'csharp'],
+        threatType: types_1.ThreatType.SUSPICIOUS_NETWORK,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.MEDIUM,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.SUSPICIOUS_NETWORK),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: '(?:fetch|axios|request|http).*(?:pastebin|hastebin|ghostbin)',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: '(?:fetch|axios|request).*\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: '\\.(?:onion|bit|i2p)[\\/\\s\\\'\\"]',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'ngrok\\.io|serveo\\.net|localhost\\.run',
+                flags: 'gi'
+            }
+        ],
+        remediation: 'Review all external network connections. Verify destinations are legitimate and authorized. Block unauthorized external communications.',
+        enabled: true,
+        tags: ['network', 'c2', 'suspicious', 'malware']
+    }
+];
+/**
+ * Malicious Loader Detection Rules
+ */
+const loaderRules = [
+    {
+        id: 'MAL-LOAD-001',
+        name: 'Dynamic Code Loading',
+        description: 'Code dynamically loads and executes external content. This is a common technique for loading malware payloads.',
+        languages: ['javascript', 'typescript', 'python', 'php'],
+        threatType: types_1.ThreatType.MALICIOUS_LOADER,
+        category: types_1.FindingCategory.MALWARE,
+        severity: types_1.Severity.HIGH,
+        standards: (0, standards_1.getStandardsForThreat)(types_1.ThreatType.MALICIOUS_LOADER),
+        patterns: [
+            {
+                type: 'regex',
+                pattern: 'eval\\s*\\(\\s*(?:fetch|axios|request|http\\.get)',
+                flags: 'gis'
+            },
+            {
+                type: 'regex',
+                pattern: 'document\\.write\\s*\\([\'"]<script[^>]*src=',
+                flags: 'gi'
+            },
+            {
+                type: 'regex',
+                pattern: 'exec\\s*\\(\\s*(?:urllib|requests)\\.get',
+                flags: 'gis'
+            },
+            {
+                type: 'regex',
+                pattern: '\\.createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*\\.src\\s*=',
+                flags: 'gim'
+            }
+        ],
+        remediation: 'Dynamic code loading from external sources is dangerous. Use Content Security Policy. Verify all external code sources and use integrity checks.',
+        enabled: true,
+        tags: ['loader', 'dynamic', 'remote-code', 'malware']
+    }
+];
+/**
+ * Export all malware rules (LEGACY COMPATIBILITY)
+ * For backward compatibility with existing codebase
+ */
+exports.malwareRules = [
+    ...backdoorRules,
+    ...cryptominerRules,
+    ...keyloggerRules,
+    ...exfiltrationRules,
+    ...obfuscationRules,
+    ...payloadRules,
+    ...networkRules,
+    ...loaderRules
+];
+// ============================================================================
+// DEFAULT EXPORT
+// ============================================================================
+exports.default = {
+    // New Engine API
+    MalwareRuleEngine: engine_2.MalwareRuleEngine,
+    createMalwareEngine,
+    createCriticalOnlyEngine,
+    createCustomEngine,
+    // New Rules (v2)
+    allMalwareRules: exports.allMalwareRules,
+    backdoorRulesV2: backdoors_1.backdoorRules,
+    cryptominerRules,
+    keyloggerRules,
+    exfiltrationRules,
+    obfuscationRules,
+    loaderRules,
+    networkRules,
+    // Convenience functions
+    scanForMalware,
+    hasMalwareCategory,
+    generateMalwareReport,
+    getModuleInfo,
+    // Legacy compatibility
+    malwareRules: exports.malwareRules,
+    backdoorRules,
+    // Metadata
+    MALWARE_MODULE_INFO: exports.MALWARE_MODULE_INFO
+};
+//# sourceMappingURL=index.js.map