/**
 * @fileoverview Cryptominer Detection Rules
 * @module rules/malware/categories/cryptominers
 */

import {
  MalwareRule,
  MalwareThreatType,
  MalwareCategory,
  MalwareSeverity,
  ConfidenceLevel,
  SupportedLanguage,
  PatternType,
  MitreTactic
} from '../types';

// ============================================================================
// BROWSER MINER DETECTION RULES
// ============================================================================

export const browserMinerRules: MalwareRule[] = [
  {
    id: 'MAL-MINE-001',
    name: 'Browser Cryptominer - Known Services',
    description: 'Detects references to known browser mining services like CoinHive.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.CONFIRMED,
    baseScore: 88,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'known-miner-services',
        pattern: '(?:coinhive|cryptoloot|coin-hive|crypto-loot|minero|webminer|browser-mine|cryptonight)',
        flags: 'gi',
        weight: 1.0,
        description: 'Known browser miner service references'
      },
      {
        type: PatternType.REGEX,
        patternId: 'miner-constructor',
        pattern: 'new\\s+(?:CoinHive|Coinimp)(?:\\.Anonymous)?\\s*\\([\'"][a-zA-Z0-9]{32,}',
        flags: 'g',
        weight: 1.0,
        description: 'Mining service instantiation with key'
      }
    ],
    maliciousExamples: [
      {
        code: `var miner = new CoinHive.Anonymous('site-key-123');`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'CoinHive instantiation'
      }
    ],
    impact: {
      technical: 'Uses visitor CPU for cryptocurrency mining.',
      business: 'User experience degradation.',
      affectedAssets: ['Client devices'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove all cryptominer references.',
      steps: ['Remove miner scripts', 'Scan for injection point']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.IMPACT,
        tacticName: 'Impact',
        techniqueId: 'T1496',
        techniqueName: 'Resource Hijacking',
        url: 'https://attack.mitre.org/techniques/T1496/'
      }
    ],
    tags: ['cryptominer', 'browser', 'high'],
    enabled: true
  },
  {
    id: 'MAL-MINE-002',
    name: 'WASM Cryptominer',
    description: 'Detects WebAssembly-based miners.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 85,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'wasm-mining-load',
        pattern: 'WebAssembly\\.instantiate(?:Streaming)?.*(?:hash|mine|crypto)',
        flags: 'gis',
        weight: 0.9,
        description: 'WASM instantiation with mining context'
      },
      {
        type: PatternType.REGEX,
        patternId: 'wasm-randomx',
        pattern: 'randomx|cryptonight.*wasm',
        flags: 'gi',
        weight: 0.95,
        description: 'Known WASM mining algorithms'
      }
    ],
    maliciousExamples: [
      {
        code: `WebAssembly.instantiate(wasmCode).then(m => m.exports.cryptonight_hash());`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'WASM cryptominer'
      }
    ],
    impact: {
      technical: 'High-performance client-side mining.',
      business: 'Device resource abuse.',
      affectedAssets: ['Client CPU'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove WASM miner code.',
      steps: ['Remove WASM module', 'Remove loader script']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.IMPACT,
        tacticName: 'Impact',
        techniqueId: 'T1496',
        techniqueName: 'Resource Hijacking',
        url: 'https://attack.mitre.org/techniques/T1496/'
      }
    ],
    tags: ['cryptominer', 'wasm', 'high'],
    enabled: true
  }
];

// ============================================================================
// POOL CONNECTION DETECTION RULES
// ============================================================================

export const poolConnectionRules: MalwareRule[] = [
  {
    id: 'MAL-MINE-010',
    name: 'Mining Pool Connection - Stratum Protocol',
    description: 'Detects Stratum mining pool protocol connections.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.PYTHON],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 85,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'stratum-protocol',
        pattern: 'stratum\\+(?:tcp|ssl):\\/\\/[^\\s"\']+',
        flags: 'gi',
        weight: 1.0,
        description: 'Stratum mining pool URL'
      },
      {
        type: PatternType.REGEX,
        patternId: 'pool-domains',
        pattern: '(?:pool|mining|mine|hashrate)\\.[a-z0-9-]+\\.(?:com|net|org|io)(?::\\d+)?',
        flags: 'gi',
        weight: 0.85,
        description: 'Common mining pool domain pattern'
      },
      {
        type: PatternType.REGEX,
        patternId: 'mining-json-rpc',
        pattern: '(?:mining\\.subscribe|mining\\.authorize|mining\\.submit)',
        flags: 'gi',
        weight: 1.0,
        description: 'Stratum JSON-RPC methods'
      }
    ],
    maliciousExamples: [
      {
        code: `connectPool('stratum+tcp://pool.monero.hashrate.io:3333');`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Mining pool connection'
      }
    ],
    impact: {
      technical: 'Connects to mining pool infrastructure.',
      business: 'Unauthorized resource usage.',
      affectedAssets: ['Network bandwidth', 'CPU'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove mining pool connections.',
      steps: ['Remove connection code', 'Block pool domains']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.IMPACT,
        tacticName: 'Impact',
        techniqueId: 'T1496',
        techniqueName: 'Resource Hijacking',
        url: 'https://attack.mitre.org/techniques/T1496/'
      }
    ],
    tags: ['cryptominer', 'pool', 'stratum', 'high'],
    enabled: true
  }
];

// ============================================================================
// WALLET DETECTION RULES
// ============================================================================

export const walletDetectionRules: MalwareRule[] = [
  {
    id: 'MAL-MINE-020',
    name: 'Hardcoded Cryptocurrency Wallet',
    description: 'Detects hardcoded cryptocurrency wallet addresses.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.PYTHON, SupportedLanguage.PHP],
    severity: MalwareSeverity.MEDIUM,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 75,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'monero-wallet',
        pattern: '(?:[48])[0-9AB][1-9A-HJ-NP-Za-km-z]{93}',
        flags: 'g',
        weight: 1.0,
        description: 'Monero wallet address'
      },
      {
        type: PatternType.REGEX,
        patternId: 'bitcoin-wallet',
        pattern: '(?:bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}',
        flags: 'g',
        weight: 0.9,
        description: 'Bitcoin wallet address'
      },
      {
        type: PatternType.REGEX,
        patternId: 'ethereum-wallet',
        pattern: '0x[a-fA-F0-9]{40}',
        flags: 'g',
        weight: 0.8,
        description: 'Ethereum wallet address'
      }
    ],
    maliciousExamples: [
      {
        code: `const wallet = '0x742d35Cc6634C0532925a3b844Bc9e7595f';`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Hardcoded ETH wallet'
      }
    ],
    impact: {
      technical: 'Funds mining proceeds to specific wallet.',
      business: 'Resource theft.',
      affectedAssets: ['Computing resources'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove wallet addresses.',
      steps: ['Remove hardcoded wallet', 'Investigate mining code']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.IMPACT,
        tacticName: 'Impact',
        techniqueId: 'T1496',
        techniqueName: 'Resource Hijacking',
        url: 'https://attack.mitre.org/techniques/T1496/'
      }
    ],
    tags: ['cryptominer', 'wallet', 'medium'],
    enabled: true
  }
];

// ============================================================================
// MINING SOFTWARE DETECTION RULES
// ============================================================================

export const miningSoftwareRules: MalwareRule[] = [
  {
    id: 'MAL-MINE-030',
    name: 'Mining Software References',
    description: 'Detects references to known mining software.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.PYTHON, SupportedLanguage.SHELL],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.CONFIRMED,
    baseScore: 90,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'known-miners',
        pattern: '(?:xmrig|xmr-stak|cpuminer|cgminer|bfgminer|nicehash|minergate|claymore)',
        flags: 'gi',
        weight: 1.0,
        description: 'Known mining software names'
      },
      {
        type: PatternType.REGEX,
        patternId: 'miner-execution',
        pattern: '(?:exec|system|subprocess\\.run).*(?:xmrig|cpuminer)',
        flags: 'gi',
        weight: 1.0,
        description: 'Mining software execution'
      }
    ],
    maliciousExamples: [
      {
        code: `subprocess.run(['./xmrig', '-o', 'pool.com:3333']);`,
        language: SupportedLanguage.PYTHON,
        isMalicious: true,
        description: 'XMRig execution'
      }
    ],
    impact: {
      technical: 'Executes cryptocurrency mining software.',
      business: 'Resource abuse.',
      affectedAssets: ['CPU', 'GPU'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove mining software references.',
      steps: ['Remove binaries', 'Remove execution code']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.EXECUTION,
        tacticName: 'Execution',
        techniqueId: 'T1204',
        techniqueName: 'User Execution',
        url: 'https://attack.mitre.org/techniques/T1204/'
      }
    ],
    tags: ['cryptominer', 'software', 'high'],
    enabled: true
  }
];

// ============================================================================
// RESOURCE ABUSE DETECTION RULES
// ============================================================================

export const resourceAbuseRules: MalwareRule[] = [
  {
    id: 'MAL-MINE-040',
    name: 'Resource Abuse - Intensive CPU Loops',
    description: 'Detects patterns that abuse CPU resources for mining.',
    version: '2.0.0',
    threatType: MalwareThreatType.CRYPTOMINER,
    category: MalwareCategory.CRYPTOMINER,
    languages: [SupportedLanguage.JAVASCRIPT],
    severity: MalwareSeverity.MEDIUM,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 70,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'webworker-intensive',
        pattern: 'new\\s+Worker.*(?:while\\s*\\(\\s*true\\s*\\)|for\\s*\\(\\s*;\\s*;\\s*\\))',
        flags: 'gis',
        weight: 0.85,
        description: 'Web Worker with infinite loop'
      },
      {
        type: PatternType.REGEX,
        patternId: 'high-cpu-pattern',
        pattern: '(?:navigator\\.hardwareConcurrency|performance\\.now).*(?:Worker|postMessage)',
        flags: 'gis',
        weight: 0.7,
        description: 'Hardware concurrency check with workers'
      }
    ],
    maliciousExamples: [
      {
        code: `for(let i=0; i<navigator.hardwareConcurrency; i++) new Worker(mineScript);`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Multi-worker mining'
      }
    ],
    impact: {
      technical: 'High CPU usage for mining.',
      business: 'Resource drain.',
      affectedAssets: ['CPU'],
      dataAtRisk: []
    },
    remediation: {
      summary: 'Remove intensive computation code.',
      steps: ['Remove workers', 'Audit compute patterns']
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.IMPACT,
        tacticName: 'Impact',
        techniqueId: 'T1496',
        techniqueName: 'Resource Hijacking',
        url: 'https://attack.mitre.org/techniques/T1496/'
      }
    ],
    tags: ['cryptominer', 'resource-abuse', 'medium'],
    enabled: true
  }
];

// ============================================================================
// EXPORTS
// ============================================================================

export const cryptominerRules: MalwareRule[] = [
  ...browserMinerRules,
  ...poolConnectionRules,
  ...walletDetectionRules,
  ...miningSoftwareRules,
  ...resourceAbuseRules
];

export default cryptominerRules;