raxe 0.4.6__py3-none-any.whl

raxe/packs/core/v1.0.0/rules/pii/pii-3023@1.0.0.yaml

@@ -0,0 +1,41 @@
+version: 1.0.0
+rule_id: pii-3023
+family: PII
+sub_family: financial
+name: US Bank Account Number Detection
+description: Detects US bank account numbers in context (6-17 digits)
+severity: high
+confidence: 0.89
+patterns:
+- pattern: (?i)(?:bank|checking|savings).{0,20}account.{0,20}(?:no|number|num|#).{0,10}\b([0-9]{6,17})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:account|acct).{0,10}(?:no|number|num|#).{0,10}\b([0-9]{10,17})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Bank account number: 1234567890123"
+  - "Checking acct #: 987654321012"
+  - "Savings account no: 12345678901234"
+  should_not_match:
+  - "What is a bank account number?"
+  - "How many digits in account number?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: financial
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3023-Us-Bank-Account-Number

raxe/packs/core/v1.0.0/rules/pii/pii-3024@1.0.0.yaml

@@ -0,0 +1,37 @@
+version: 1.0.0
+rule_id: pii-3024
+family: PII
+sub_family: financial
+name: US Routing Number Detection
+description: Detects US bank routing numbers (9 digits, ABA format)
+severity: medium
+confidence: 0.90
+patterns:
+- pattern: (?i)(?:routing|ABA|RTN).{0,20}(?:no|number|num|#).{0,10}\b([0-9]{9})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Routing number: 123456789"
+  - "ABA: 021000021"
+  - "RTN #: 111000025"
+  should_not_match:
+  - "What is a routing number?"
+  - "Routing numbers have 9 digits"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: financial
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3024-Us-Routing-Number-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3025@1.0.0.yaml

@@ -0,0 +1,38 @@
+version: 1.0.0
+rule_id: pii-3025
+family: PII
+sub_family: medical
+name: Medical Record Number (MRN) Detection
+description: Detects Medical Record Numbers in healthcare context
+severity: high
+confidence: 0.91
+patterns:
+- pattern: (?i)(?:medical\s*record|MRN|patient\s*(?:ID|number)).{0,20}(?:no|number|num|#).{0,10}\b([A-Z0-9]{6,12})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Medical Record Number: MRN12345678"
+  - "Patient ID: ABC123456"
+  - "MRN #: 987654321"
+  should_not_match:
+  - "What is an MRN?"
+  - "How to find medical record number?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: hipaa
+  compliance: HIPAA
+rule_hash: null
+risk_explanation: Medical and health information exposure violates HIPAA regulations and patient privacy rights. Leaked health data can be used for discrimination, identity theft, or blackmail, and creates severe legal liabilities for healthcare organizations.
+remediation_advice: Comply with HIPAA and healthcare privacy regulations. Implement strong access controls and encryption for medical records. Use de-identification and anonymization techniques. Audit all access to protected health information (PHI).
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3025-Medical-Record-Number-(Mrn)

raxe/packs/core/v1.0.0/rules/pii/pii-3026@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3026
+family: PII
+sub_family: medical
+name: Health Insurance Policy Number Detection
+description: Detects health insurance policy and member ID numbers
+severity: high
+confidence: 0.88
+patterns:
+- pattern: (?i)(?:insurance|policy|member|subscriber).{0,20}(?:ID|no|number|num|#).{0,10}\b([A-Z]{2,3}[0-9]{8,12})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:insurance|policy|member).{0,20}(?:ID|no|number).{0,10}\b([0-9]{9,12})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Insurance ID: ABC123456789"
+  - "Member number: 987654321012"
+  - "Policy #: XYZ12345678"
+  should_not_match:
+  - "What is an insurance ID?"
+  - "How to find policy number?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: hipaa
+  compliance: HIPAA
+rule_hash: null
+risk_explanation: Medical and health information exposure violates HIPAA regulations and patient privacy rights. Leaked health data can be used for discrimination, identity theft, or blackmail, and creates severe legal liabilities for healthcare organizations.
+remediation_advice: Comply with HIPAA and healthcare privacy regulations. Implement strong access controls and encryption for medical records. Use de-identification and anonymization techniques. Audit all access to protected health information (PHI).
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3026-Health-Insurance-Policy-Number

raxe/packs/core/v1.0.0/rules/pii/pii-3027@1.0.0.yaml

@@ -0,0 +1,38 @@
+version: 1.0.0
+rule_id: pii-3027
+family: PII
+sub_family: medical
+name: ICD-10 Diagnosis Code Detection
+description: Detects ICD-10 medical diagnosis codes in patient data context
+severity: medium
+confidence: 0.86
+patterns:
+- pattern: (?i)(?:diagnosis|ICD-10|ICD10).{0,20}(?:code).{0,10}\b([A-Z][0-9]{2}\.?[A-Z0-9]{0,4})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Diagnosis code: E11.9"
+  - "ICD-10: J44.0"
+  - "Primary diagnosis: I10"
+  should_not_match:
+  - "What is ICD-10?"
+  - "How to code diagnoses?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: hipaa
+  compliance: HIPAA
+rule_hash: null
+risk_explanation: Medical and health information exposure violates HIPAA regulations and patient privacy rights. Leaked health data can be used for discrimination, identity theft, or blackmail, and creates severe legal liabilities for healthcare organizations.
+remediation_advice: Comply with HIPAA and healthcare privacy regulations. Implement strong access controls and encryption for medical records. Use de-identification and anonymization techniques. Audit all access to protected health information (PHI).
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3027-Icd-10-Diagnosis-Code-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3028@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3028
+family: PII
+sub_family: medical
+name: Prescription Number Detection (DEA)
+description: Detects DEA prescription numbers and Rx numbers
+severity: high
+confidence: 0.90
+patterns:
+- pattern: (?i)(?:prescription|Rx|DEA).{0,20}(?:no|number|num|#).{0,10}\b([A-Z]{2}[0-9]{7})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:prescription|Rx).{0,20}(?:no|number|num|#).{0,10}\b([0-9]{7,10})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "DEA number: AB1234567"
+  - "Prescription #: 12345678"
+  - "Rx no: 987654321"
+  should_not_match:
+  - "What is a DEA number?"
+  - "How to refill prescription?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: hipaa
+  compliance: HIPAA
+rule_hash: null
+risk_explanation: Medical and health information exposure violates HIPAA regulations and patient privacy rights. Leaked health data can be used for discrimination, identity theft, or blackmail, and creates severe legal liabilities for healthcare organizations.
+remediation_advice: Comply with HIPAA and healthcare privacy regulations. Implement strong access controls and encryption for medical records. Use de-identification and anonymization techniques. Audit all access to protected health information (PHI).
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3028-Prescription-Number-Detection-(Dea)

raxe/packs/core/v1.0.0/rules/pii/pii-3029@1.0.0.yaml

@@ -0,0 +1,36 @@
+version: 1.0.0
+rule_id: pii-3029
+family: PII
+sub_family: authentication
+name: JWT Token Detection
+description: Detects JSON Web Tokens (JWT) in format header.payload.signature
+severity: high
+confidence: 0.97
+patterns:
+- pattern: \b(eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+  - "token = eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+  should_not_match:
+  - "JWT tokens start with eyJ"
+  - "How to decode JWT?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+- T1528
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: authentication_tokens
+rule_hash: null
+risk_explanation: Authentication token exposure (JWTs, bearer tokens, session cookies) grants attackers immediate access to authenticated sessions and user accounts. Unlike passwords, tokens provide direct access without needing additional authentication steps.
+remediation_advice: Implement short token lifetimes and automatic rotation. Use secure token storage and transmission. Deploy token validation and revocation mechanisms. Never log or expose tokens in error messages or responses.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3029-Jwt-Token-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3030@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3030
+family: PII
+sub_family: authentication
+name: Bearer Token Detection
+description: Detects Bearer authentication tokens in Authorization headers
+severity: high
+confidence: 0.94
+patterns:
+- pattern: (?i)bearer\s+([A-Za-z0-9\-._~+/]+=*)
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)authorization:\s*bearer\s+([A-Za-z0-9\-._~+/]{20,})
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Authorization: Bearer ya29.a0AfH6SMBx..."
+  - "bearer abcdef1234567890ABCDEF"
+  - "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+  should_not_match:
+  - "Use Bearer token for authentication"
+  - "What is a Bearer token?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+- T1528
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: authentication_tokens
+rule_hash: null
+risk_explanation: Authentication token exposure (JWTs, bearer tokens, session cookies) grants attackers immediate access to authenticated sessions and user accounts. Unlike passwords, tokens provide direct access without needing additional authentication steps.
+remediation_advice: Implement short token lifetimes and automatic rotation. Use secure token storage and transmission. Deploy token validation and revocation mechanisms. Never log or expose tokens in error messages or responses.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3030-Bearer-Token-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3031@1.0.0.yaml

@@ -0,0 +1,37 @@
+version: 1.0.0
+rule_id: pii-3031
+family: PII
+sub_family: authentication
+name: OAuth Access Token Detection
+description: Detects OAuth 2.0 access tokens in various formats
+severity: high
+confidence: 0.93
+patterns:
+- pattern: (?i)(?:oauth|access).{0,20}token.{0,10}['\"]([A-Za-z0-9\-._~+/]{30,})['\"]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "oauth_token='ya29.a0AfH6SMBxKqZ8...' "
+  - "access_token: ghr_1B2c3D4e5F6g7H8i9J0k..."
+  should_not_match:
+  - "How to get an OAuth token?"
+  - "OAuth token format"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+- T1528
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: authentication_tokens
+rule_hash: null
+risk_explanation: Authentication token exposure (JWTs, bearer tokens, session cookies) grants attackers immediate access to authenticated sessions and user accounts. Unlike passwords, tokens provide direct access without needing additional authentication steps.
+remediation_advice: Implement short token lifetimes and automatic rotation. Use secure token storage and transmission. Deploy token validation and revocation mechanisms. Never log or expose tokens in error messages or responses.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3031-Oauth-Access-Token-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3032@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3032
+family: PII
+sub_family: authentication
+name: Session Cookie/Token Detection
+description: Detects session IDs and session tokens in cookies or headers
+severity: medium
+confidence: 0.87
+patterns:
+- pattern: (?i)(?:session|sess).{0,10}(?:id|token|key).{0,10}[=:]\s*([A-Za-z0-9]{32,})
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)PHPSESSID=([A-Za-z0-9]{26,})
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "sessionId=abc123def456ghi789jkl012mno345pqr"
+  - "PHPSESSID=1234567890abcdefghijklmnopqrstuvwxyz"
+  - "session_token: ABCD1234EFGH5678IJKL9012MNOP3456"
+  should_not_match:
+  - "What is a session ID?"
+  - "How to manage sessions?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1539
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: authentication_tokens
+rule_hash: null
+risk_explanation: Authentication token exposure (JWTs, bearer tokens, session cookies) grants attackers immediate access to authenticated sessions and user accounts. Unlike passwords, tokens provide direct access without needing additional authentication steps.
+remediation_advice: Implement short token lifetimes and automatic rotation. Use secure token storage and transmission. Deploy token validation and revocation mechanisms. Never log or expose tokens in error messages or responses.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3032-Session-Cookie/Token-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3033@1.0.0.yaml

@@ -0,0 +1,39 @@
+version: 1.0.0
+rule_id: pii-3033
+family: PII
+sub_family: private_keys
+name: RSA Private Key Detection
+description: Detects RSA private keys in PEM format
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: -----BEGIN\s+RSA\s+PRIVATE\s+KEY-----
+  flags: []
+  timeout: 5.0
+- pattern: -----BEGIN\s+PRIVATE\s+KEY-----
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "-----BEGIN RSA PRIVATE KEY-----"
+  - "-----BEGIN PRIVATE KEY-----"
+  should_not_match:
+  - "How to generate RSA keys?"
+  - "Example of private key format"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+- T1145
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: cryptographic_keys
+rule_hash: null
+risk_explanation: Private key exposure (RSA, SSH, PGP keys) completely compromises cryptographic security. Attackers with private keys can decrypt sensitive data, forge signatures, impersonate key owners, and gain unauthorized access to systems.
+remediation_advice: Store private keys in hardware security modules (HSMs) or secure key management systems. Never transmit or log private keys. Implement key rotation and revocation procedures. Use separate keys for different purposes with appropriate access controls.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3033-Rsa-Private-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3034@1.0.0.yaml

@@ -0,0 +1,40 @@
+version: 1.0.0
+rule_id: pii-3034
+family: PII
+sub_family: private_keys
+name: SSH Private Key Detection
+description: Detects SSH private keys in PEM format (RSA, DSA, EC, Ed25519)
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: -----BEGIN\s+OPENSSH\s+PRIVATE\s+KEY-----
+  flags: []
+  timeout: 5.0
+- pattern: -----BEGIN\s+(?:DSA|EC|ENCRYPTED)\s+PRIVATE\s+KEY-----
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "-----BEGIN OPENSSH PRIVATE KEY-----"
+  - "-----BEGIN DSA PRIVATE KEY-----"
+  - "-----BEGIN EC PRIVATE KEY-----"
+  should_not_match:
+  - "How to generate SSH keys?"
+  - "SSH key format examples"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+- T1145
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: cryptographic_keys
+rule_hash: null
+risk_explanation: Private key exposure (RSA, SSH, PGP keys) completely compromises cryptographic security. Attackers with private keys can decrypt sensitive data, forge signatures, impersonate key owners, and gain unauthorized access to systems.
+remediation_advice: Store private keys in hardware security modules (HSMs) or secure key management systems. Never transmit or log private keys. Implement key rotation and revocation procedures. Use separate keys for different purposes with appropriate access controls.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3034-Ssh-Private-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3035@1.0.0.yaml

@@ -0,0 +1,43 @@
+version: 1.0.0
+rule_id: pii-3035
+family: PII
+sub_family: private_keys
+name: PGP Private Key Detection
+description: Detects PGP/GPG private keys in ASCII armor format
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: '-----BEGIN\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----'
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - Here is PII type 3035 information
+  - Accessing sensitive data 3035
+  - Personal information 3035 exposure
+  should_not_match:
+  - What is personally identifiable information?
+  - How do I protect my privacy?
+  - Explain data protection regulations
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+- T1145
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: cryptographic_keys
+rule_hash: null
+risk_explanation: Private key exposure (RSA, SSH, PGP keys) completely compromises
+  cryptographic security. Attackers with private keys can decrypt sensitive data,
+  forge signatures, impersonate key owners, and gain unauthorized access to systems.
+remediation_advice: Store private keys in hardware security modules (HSMs) or secure
+  key management systems. Never transmit or log private keys. Implement key rotation
+  and revocation procedures. Use separate keys for different purposes with appropriate
+  access controls.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3035-Pgp-Private-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3036@1.0.0.yaml

@@ -0,0 +1,41 @@
+version: 1.0.0
+rule_id: pii-3036
+family: PII
+sub_family: database_credentials
+name: Database Connection String Detection (Generic)
+description: Detects database connection strings with embedded credentials
+severity: critical
+confidence: 0.95
+patterns:
+- pattern: (?i)(?:jdbc|mysql|postgresql|mongodb|mssql)://[^:]+:([^@\s]+)@
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+# REDOS FIX: Replaced .{0,50} and .{0,30} with [^;]{0,50} and [^;]{0,30} to prevent greedy backtracking
+# Also added minimum length requirement and excluded whitespace from password match
+- pattern: (?i)(?:Server|Data\s*Source)=[^;]{0,50};(?:User\s*ID|UID)=[^;]{0,30};(?:Password|PWD)=([^;\s]{8,})
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "jdbc:mysql://localhost:3306/db?user=admin&password=secret123"
+  - "mongodb://user:password123@localhost:27017/mydb"
+  - "Server=myserver;Database=mydb;User ID=sa;Password=MyP@ssw0rd;"
+  should_not_match:
+  - "How to create a connection string?"
+  - "Database connection examples"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-17'
+  author: raxe-ce
+  category: database_credentials
+  redos_fix: 'Pattern 2 fixed on 2025-11-17 to prevent greedy quantifier backtracking'
+rule_hash: null

raxe/packs/core/v1.0.0/rules/pii/pii-3037@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3037
+family: PII
+sub_family: database_credentials
+name: MongoDB Connection String Detection
+description: Detects MongoDB connection strings with embedded credentials
+severity: critical
+confidence: 0.97
+patterns:
+- pattern: mongodb(?:\+srv)?://[^:]+:([^@\s]+)@[^/\s]+
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "mongodb://admin:password123@cluster0.mongodb.net/test"
+  - "mongodb+srv://user:P@ssw0rd@cluster.mongodb.net/mydb"
+  should_not_match:
+  - "How to connect to MongoDB?"
+  - "MongoDB connection string format"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: database_credentials
+rule_hash: null
+risk_explanation: Database connection string exposure reveals database locations, credentials, and configuration details. Attackers can use this information to directly access databases, extract sensitive data, modify records, or completely compromise data stores.
+remediation_advice: Use secure secret management for database credentials. Implement connection string encryption and access controls. Never hardcode connection strings in code or configuration files. Use service principals and managed identities where possible.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3037-Mongodb-Connection-String-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3038@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3038
+family: PII
+sub_family: database_credentials
+name: PostgreSQL Connection String Detection
+description: Detects PostgreSQL connection strings with embedded credentials
+severity: critical
+confidence: 0.97
+patterns:
+- pattern: postgres(?:ql)?://[^:]+:([^@\s]+)@[^/\s]+
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "postgresql://user:mypassword@localhost:5432/mydb"
+  - "postgres://admin:secret123@db.example.com/production"
+  should_not_match:
+  - "How to connect to PostgreSQL?"
+  - "PostgreSQL connection examples"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: database_credentials
+rule_hash: null
+risk_explanation: Database connection string exposure reveals database locations, credentials, and configuration details. Attackers can use this information to directly access databases, extract sensitive data, modify records, or completely compromise data stores.
+remediation_advice: Use secure secret management for database credentials. Implement connection string encryption and access controls. Never hardcode connection strings in code or configuration files. Use service principals and managed identities where possible.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3038-Postgresql-Connection-String-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3039@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3039
+family: PII
+sub_family: database_credentials
+name: Redis Connection String Detection
+description: Detects Redis connection strings with embedded passwords
+severity: high
+confidence: 0.96
+patterns:
+# REDOS FIX: Added maximum bounds to prevent infinite backtracking on negated character classes
+# Replaced unbounded [^X]+ with bounded [^X]{1,N} for all components
+- pattern: redis://(?::([^\s@]{1,256})@|[^:\s]{1,64}:([^\s@]{1,256})@)[^\s/]{1,256}
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "redis://:mypassword@localhost:6379/0"
+  - "redis://user:password123@redis.example.com:6379"
+  should_not_match:
+  - "How to connect to Redis?"
+  - "Redis connection format"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-17'
+  author: raxe-ce
+  category: database_credentials
+  redos_fix: 'Pattern fixed on 2025-11-17 to add bounds and prevent backtracking on negated character classes'
+rule_hash: null