/**
 * @fileoverview Malware Detection Constants
 * @module rules/malware/constants
 *
 * Central repository for all constants used in malware detection.
 */
import { MalwareSeverity, ConfidenceLevel, MitreTactic } from '../types';
/**
 * Score thresholds for severity calculation
 */
export declare const SCORE_THRESHOLDS: {
    readonly CRITICAL: 85;
    readonly HIGH: 65;
    readonly MEDIUM: 40;
    readonly LOW: 20;
    readonly INFO: 0;
};
/**
 * Risk level thresholds
 */
export declare const RISK_LEVELS: {
    readonly CRITICAL: {
        readonly min: 85;
        readonly label: "critical";
    };
    readonly HIGH: {
        readonly min: 65;
        readonly label: "high";
    };
    readonly MEDIUM: {
        readonly min: 40;
        readonly label: "medium";
    };
    readonly LOW: {
        readonly min: 20;
        readonly label: "low";
    };
    readonly MINIMAL: {
        readonly min: 0;
        readonly label: "minimal";
    };
};
/**
 * Default scoring weights
 */
export declare const DEFAULT_SCORING_WEIGHTS: {
    readonly patternCount: 0.25;
    readonly obfuscation: 0.2;
    readonly networkAccess: 0.15;
    readonly commandExecution: 0.15;
    readonly persistence: 0.15;
    readonly dataAccess: 0.1;
};
/**
 * Entropy thresholds for obfuscation detection
 */
export declare const ENTROPY_THRESHOLDS: {
    readonly NORMAL: 4.5;
    readonly SUSPICIOUS: 5.5;
    readonly HIGH_OBFUSCATION: 6.5;
    readonly BINARY_DATA: 7.5;
};
/**
 * Performance and safety limits
 */
export declare const LIMITS: {
    /** Maximum execution time for a single regex in ms */
    readonly REGEX_TIMEOUT: 1000;
    /** Maximum execution time for a single rule in ms */
    readonly RULE_TIMEOUT: 5000;
    /** Maximum execution time for a single file in ms */
    readonly FILE_TIMEOUT: 30000;
    /** Maximum matches per pattern before stopping */
    readonly MAX_MATCHES_PER_PATTERN: 100;
    /** Maximum findings per file */
    readonly MAX_FINDINGS_PER_FILE: 500;
    /** Maximum file size to analyze in bytes */
    readonly MAX_FILE_SIZE: number;
    /** Maximum pattern matches to store for a finding */
    readonly MAX_PATTERN_MATCHES_PER_FINDING: 50;
    /** Maximum code snippet length */
    readonly MAX_SNIPPET_LENGTH: 500;
    /** Lines of context before/after match */
    readonly CONTEXT_LINES: 3;
};
/**
 * Common obfuscation patterns and their weights
 */
export declare const OBFUSCATION_INDICATORS: {
    /** Hex escape sequences */
    readonly HEX_ESCAPES: {
        readonly pattern: RegExp;
        readonly weight: 0.1;
    };
    /** Unicode escape sequences */
    readonly UNICODE_ESCAPES: {
        readonly pattern: RegExp;
        readonly weight: 0.1;
    };
    /** Long base64 strings */
    readonly BASE64_STRINGS: {
        readonly pattern: RegExp;
        readonly weight: 0.15;
    };
    /** String concatenation obfuscation */
    readonly STRING_CONCAT: {
        readonly pattern: RegExp;
        readonly weight: 0.2;
    };
    /** Array access obfuscation */
    readonly ARRAY_ACCESS: {
        readonly pattern: RegExp;
        readonly weight: 0.05;
    };
    /** Obfuscator variable names */
    readonly OBFUSCATOR_VARS: {
        readonly pattern: RegExp;
        readonly weight: 0.3;
    };
    /** JSFuck-style obfuscation */
    readonly JSFUCK: {
        readonly pattern: RegExp;
        readonly weight: 0.4;
    };
    /** Long single-line functions */
    readonly LONG_LINES: {
        readonly threshold: 500;
        readonly weight: 0.1;
    };
    /** High character diversity */
    readonly CHAR_DIVERSITY: {
        readonly threshold: 0.7;
        readonly weight: 0.15;
    };
};
/**
 * Known malicious TLDs
 */
export declare const SUSPICIOUS_TLDS: readonly [".onion", ".bit", ".i2p", ".bazar", ".coin", ".lib", ".emc"];
/**
 * Known malicious hosting services
 */
export declare const SUSPICIOUS_HOSTS: readonly ["pastebin.com", "hastebin.com", "ghostbin.com", "rentry.co", "dpaste.org", "ngrok.io", "serveo.net", "localhost.run", "localtunnel.me", "webhook.site", "requestbin.com", "pipedream.com"];
/**
 * Private IP ranges (for reverse shell detection)
 */
export declare const PRIVATE_IP_RANGES: readonly [RegExp, RegExp, RegExp, RegExp];
/**
 * Known cryptomining pools and software
 */
export declare const CRYPTO_INDICATORS: {
    readonly POOLS: readonly ["pool.minergate.com", "xmr.pool.minergate.com", "pool.supportxmr.com", "xmr-eu1.nanopool.org", "monerohash.com", "minexmr.com", "pool.hashvault.pro", "gulf.moneroocean.stream"];
    readonly SOFTWARE: readonly ["coinhive", "cryptoloot", "coin-hive", "coinimp", "cryptonight", "xmrig", "xmr-stak", "minerd", "cgminer", "bfgminer"];
    readonly ALGORITHMS: readonly ["CryptoNight", "RandomX", "Ethash", "Scrypt", "SHA256d"];
    readonly PROTOCOLS: readonly ["stratum+tcp://", "stratum+ssl://", "stratum2+tcp://"];
};
/**
 * Dangerous shell commands
 */
export declare const DANGEROUS_COMMANDS: {
    readonly SHELLS: readonly ["/bin/bash", "/bin/sh", "/bin/zsh", "cmd.exe", "powershell.exe"];
    readonly NETCAT: readonly ["nc", "ncat", "netcat", "socat"];
    readonly DOWNLOADERS: readonly ["curl", "wget", "Invoke-WebRequest", "certutil"];
    readonly EXECUTION: readonly ["exec", "eval", "spawn", "fork", "CreateProcess"];
};
/**
 * File patterns to ignore
 */
export declare const IGNORE_PATTERNS: {
    readonly VENDOR: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    readonly BUILD: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    readonly TEST: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    readonly GENERATED: readonly [RegExp, RegExp, RegExp];
};
/**
 * Map threat types to default severities
 */
export declare const THREAT_SEVERITY_MAP: Record<string, MalwareSeverity>;
/**
 * Confidence boost based on pattern count
 */
export declare const PATTERN_COUNT_CONFIDENCE_BOOST: Record<number, ConfidenceLevel>;
/**
 * Common MITRE ATT&CK technique mappings
 */
export declare const MITRE_TECHNIQUES: {
    readonly COMMAND_LINE: {
        readonly id: "T1059";
        readonly name: "Command and Scripting Interpreter";
        readonly tactic: MitreTactic.EXECUTION;
    };
    readonly JAVASCRIPT: {
        readonly id: "T1059.007";
        readonly name: "JavaScript";
        readonly tactic: MitreTactic.EXECUTION;
    };
    readonly PYTHON: {
        readonly id: "T1059.006";
        readonly name: "Python";
        readonly tactic: MitreTactic.EXECUTION;
    };
    readonly POWERSHELL: {
        readonly id: "T1059.001";
        readonly name: "PowerShell";
        readonly tactic: MitreTactic.EXECUTION;
    };
    readonly WEB_SHELL: {
        readonly id: "T1505.003";
        readonly name: "Web Shell";
        readonly tactic: MitreTactic.PERSISTENCE;
    };
    readonly SCHEDULED_TASK: {
        readonly id: "T1053";
        readonly name: "Scheduled Task/Job";
        readonly tactic: MitreTactic.PERSISTENCE;
    };
    readonly KEYLOGGING: {
        readonly id: "T1056.001";
        readonly name: "Keylogging";
        readonly tactic: MitreTactic.CREDENTIAL_ACCESS;
    };
    readonly CREDENTIAL_DUMPING: {
        readonly id: "T1003";
        readonly name: "OS Credential Dumping";
        readonly tactic: MitreTactic.CREDENTIAL_ACCESS;
    };
    readonly OBFUSCATION: {
        readonly id: "T1027";
        readonly name: "Obfuscated Files or Information";
        readonly tactic: MitreTactic.DEFENSE_EVASION;
    };
    readonly DEOBFUSCATE: {
        readonly id: "T1140";
        readonly name: "Deobfuscate/Decode Files or Information";
        readonly tactic: MitreTactic.DEFENSE_EVASION;
    };
    readonly APP_LAYER: {
        readonly id: "T1071";
        readonly name: "Application Layer Protocol";
        readonly tactic: MitreTactic.COMMAND_AND_CONTROL;
    };
    readonly INGRESS_TOOL: {
        readonly id: "T1105";
        readonly name: "Ingress Tool Transfer";
        readonly tactic: MitreTactic.COMMAND_AND_CONTROL;
    };
    readonly EXFIL_WEB: {
        readonly id: "T1041";
        readonly name: "Exfiltration Over C2 Channel";
        readonly tactic: MitreTactic.EXFILTRATION;
    };
    readonly RESOURCE_HIJACKING: {
        readonly id: "T1496";
        readonly name: "Resource Hijacking";
        readonly tactic: MitreTactic.IMPACT;
    };
};
/**
 * Language-specific dangerous function patterns
 */
export declare const DANGEROUS_FUNCTIONS: {
    readonly javascript: readonly ["eval", "Function", "setTimeout", "setInterval", "execScript"];
    readonly typescript: readonly ["eval", "Function", "setTimeout", "setInterval"];
    readonly python: readonly ["eval", "exec", "compile", "__import__", "execfile"];
    readonly php: readonly ["eval", "exec", "system", "passthru", "shell_exec", "popen", "proc_open", "assert", "preg_replace"];
    readonly ruby: readonly ["eval", "exec", "system", "`", "spawn", "Open3"];
    readonly csharp: readonly ["Process.Start", "Assembly.Load", "Activator.CreateInstance"];
    readonly java: readonly ["Runtime.exec", "ProcessBuilder", "ScriptEngine.eval"];
};
/**
 * Language-specific network functions
 */
export declare const NETWORK_FUNCTIONS: {
    readonly javascript: readonly ["fetch", "XMLHttpRequest", "axios", "request", "http.get", "https.get"];
    readonly typescript: readonly ["fetch", "XMLHttpRequest", "axios", "request", "http.get", "https.get"];
    readonly python: readonly ["urllib", "requests", "httplib", "socket", "http.client"];
    readonly php: readonly ["file_get_contents", "curl_exec", "fopen", "fsockopen"];
    readonly csharp: readonly ["HttpClient", "WebRequest", "WebClient", "TcpClient"];
    readonly java: readonly ["HttpURLConnection", "URLConnection", "Socket", "HttpClient"];
};
//# sourceMappingURL=index.d.ts.map