{
  "schema_version": 1,
  "pack_version": "1.3.1",
  "groups": {
    "url_shorteners": {
      "patterns": [
        {
          "id": "url_shortener",
          "regex": "(?:^|[\\s\"'(]|\\/{2})(?:bit\\.ly|t\\.co|tinyurl\\.com|goo\\.gl|ow\\.ly|buff\\.ly|is\\.gd|cutt\\.ly|lnkd\\.in|vk\\.cc|grabify\\.|iplogger\\.)",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "url_shortener",
            "category": "suspicious_urls",
            "severity": "suspicious",
            "confidence": 60
          }
        }
      ]
    },

    "hidden_external": {
      "lists": {
        "hiding_patterns": [
          "display\\s*:\\s*none",
          "visibility\\s*:\\s*hidden",
          "opacity\\s*:\\s*0(?:[;\\s\"']|$)",
          "font-size\\s*:\\s*0(?:px|em|rem|%)?(?:[;\\s\"']|$)",
          "left\\s*:\\s*-\\d{4,}px",
          "top\\s*:\\s*-\\d{4,}px",
          "text-indent\\s*:\\s*-\\d{4,}(?:px|em)",
          "clip\\s*:\\s*rect\\s*\\(\\s*0",
          "z-index\\s*:\\s*-\\d+",
          "max-height\\s*:\\s*0.*overflow\\s*:\\s*hidden",
          "height\\s*:\\s*0.*overflow\\s*:\\s*hidden",
          "width\\s*=\\s*[\"']?1\\b",
          "height\\s*=\\s*[\"']?1\\b",
          "color\\s*:\\s*transparent",
          "position\\s*:\\s*(?:absolute|fixed).*(?:left|top)\\s*:\\s*-\\d{3,}"
        ]
      },
      "patterns": [
        {
          "id": "hidden_external_link",
          "regex": "<(?:div|span|a|p|section|article)[^>]*(?:{{HIDING}})[^>]*>.*?<a[^>]+href=[\"'](https?:\\/\\/[^\"']+)",
          "delimiters": "/",
          "flags": "is",
          "placeholders": ["HIDING"],
          "finding": {
            "rule_id": "hidden_external_link",
            "category": "hidden_content",
            "base_confidence": 75,
            "base_severity": "suspicious"
          }
        }
      ]
    },

    "external_resources": {
      "patterns": [
        {
          "id": "external_script_iframe",
          "regex": "<(script|iframe)\\b[^>]+(?:src|data-src)=[\"'](https?:\\/\\/(?!{{ALLOWLIST}})[^\"']+)",
          "delimiters": "/",
          "flags": "i",
          "placeholders": ["ALLOWLIST"],
          "finding": {
            "category": "external_resources",
            "base_severity": "critical"
          }
        }
      ]
    },

    "obfuscation": {
      "lists": {
        "suspicious_words": ["script", "iframe", "eval", "document", "cookie", "location"]
      },
      "patterns": [
        {
          "id": "obfuscation_js",
          "regex": "fromCharCode\\s*\\(|atob\\s*\\(|btoa\\s*\\(|(?:eval|Function)\\s*\\(\\s*atob\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "obfuscation_js",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 80
          }
        },
        {
          "id": "obfuscation_base64_data_url",
          "regex": "data:\\s*text\\/html;\\s*base64,\\s*[A-Za-z0-9+\\/]{80,}={0,2}",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "obfuscation_base64_data_url",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 75
          }
        },
        {
          "id": "obfuscation_string_concat",
          "regex": "[\"'][a-z]{2,5}[\"']\\s*\\+\\s*[\"'][a-z]{2,5}[\"']",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "obfuscation_string_concat",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 65
          }
        }
      ]
    },

    "seo_spam": {
      "patterns": [
        {
          "id": "pharma_high",
          "regex": "\\b(viagra|cialis|levitra|tramadol|xanax|ambien|modafinil|phentermine|online\\s+pharmacy|buy\\s+(?:viagra|cialis|pills|medications?))\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_pharma_high",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 70
          }
        },
        {
          "id": "gambling",
          "regex": "\\b(casino|betting|poker|slot\\s*machine|blackjack|roulette|gambling|online\\s+casino|sports?\\s+betting|bet365|betway|bwin)\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_gambling",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 65
          }
        },
        {
          "id": "financial",
          "regex": "\\b(payday\\s+loans?|forex\\s+trading|binary\\s+options?|make\\s+money\\s+(?:fast|online|now)|work\\s+from\\s+home\\s+(?:scam|opportunity)|investment\\s+opportunity|get\\s+rich\\s+quick)\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_financial",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 60
          }
        },
        {
          "id": "adult",
          "regex": "\\b(porn(?:o|ography|hub|star|site|tube)?|p[o0]rn|xxx+|adult\\s+(?:dating|content|site|video|film)|escort\\s+(?:service|girl|agency)|webcam\\s+(?:girl|model|show)s?|hookups?|sex\\s+(?:video|chat|dating|cam|movie|tape|site)|live\\s+(?:sex|cam|nude))\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_adult",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 70
          }
        },
        {
          "id": "academic",
          "regex": "\\b(essay\\s+writing\\s+(?:service)?|term\\s+paper\\s+(?:help|service|writing)|dissertation\\s+(?:help|service|writing)|buy\\s+(?:essay|papers?|thesis)|homework\\s+(?:help|service)|write\\s+my\\s+(?:essay|paper))\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_academic",
            "category": "seo_spam",
            "severity": "review",
            "confidence": 50
          }
        },
        {
          "id": "counterfeit",
          "regex": "\\b(replica\\s+(?:watch|bag|rolex|handbag)|fake\\s+(?:designer|louis\\s+vuitton|gucci|rolex)|knockoff|cheap\\s+(?:gucci|prada|chanel|louis\\s+vuitton|designer))\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_counterfeit",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 65
          }
        },
        {
          "id": "crypto_scam",
          "regex": "\\b(bitcoin\\s+(?:giveaway|doubler|generator)|free\\s+(?:crypto|bitcoin|ethereum|btc)|wallet\\s+recovery\\s+(?:scam|service)?|crypto\\s+(?:investment|scam)|double\\s+your\\s+(?:bitcoin|crypto|btc))\\b",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "seo_spam_crypto_scam",
            "category": "seo_spam",
            "severity": "suspicious",
            "confidence": 70
          }
        }
      ]
    },

    "anomalous_links": {
      "patterns": [
        {
          "id": "anchor_href_extract",
          "regex": "<a[^>]+href=[\"'](https?:\\/\\/[^\"']+)",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "anomalous_link_profile",
            "category": "link_analysis",
            "severity": "review",
            "confidence": 60
          }
        }
      ]
    },

    "inline_event_handlers": {
      "lists": {
        "event_handlers": [
          "onclick", "ondblclick", "onmousedown", "onmouseup", "onmouseover", "onmouseout", "onmousemove",
          "onkeydown", "onkeypress", "onkeyup",
          "onload", "onerror", "onabort", "onunload", "onbeforeunload",
          "onfocus", "onblur", "onchange", "onsubmit", "onreset", "onselect",
          "ondragstart", "ondrag", "ondragend", "ondragenter", "ondragleave", "ondragover", "ondrop",
          "onscroll", "onresize", "oninput", "oninvalid",
          "onanimationstart", "onanimationend", "onanimationiteration",
          "ontransitionend", "ontouchstart", "ontouchmove", "ontouchend",
          "oncontextmenu", "oncopy", "oncut", "onpaste",
          "onafterprint", "onbeforeprint", "onhashchange", "onmessage", "onoffline", "ononline",
          "onpopstate", "onstorage", "onpagehide", "onpageshow"
        ],
        "tier1_deny_callees": ["alert", "prompt", "confirm", "debugger", "import", "export"],
        "strict_events": ["onerror", "onload"],
        "strict_tags": ["img", "svg", "body", "iframe"],
        "elementor_widget_hints": [
          "html", "button", "form", "price", "popup", "nav-menu", "accordion",
          "toggle", "slides", "carousel", "cta", "call-to-action", "hotspot",
          "animated-headline", "flip-box", "countdown"
        ],
        "elementor_fields": ["_elementor_data", "_elementor_page_settings"]
      },
      "patterns": {
        "main_match": {
          "regex": "\\b({{HANDLERS}})\\s*=\\s*[\"']([^\"']{1,500})",
          "delimiters": "/",
          "flags": "i",
          "placeholders": ["HANDLERS"]
        },
        "tier4_code_call": { "regex": "\\beval\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier4_new_function": { "regex": "\\bnew\\s+Function\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier4_document_write": { "regex": "document\\s*\\.\\s*write(?:ln)?\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier4_atob_btoa": { "regex": "\\b(?:atob|btoa)\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier4_fromcharcode": { "regex": "(?:fromCharCode|String\\s*\\.\\s*fromCharCode)", "delimiters": "/", "flags": "i" },
        "tier4_js_escape": { "regex": "\\\\x[0-9a-fA-F]{2}|\\\\u[0-9a-fA-F]{4}", "delimiters": "/", "flags": "" },
        "tier4_set_timer_string": { "regex": "set(?:Timeout|Interval)\\s*\\(\\s*[\"']", "delimiters": "/", "flags": "i" },
        "tier4_cookie_main": { "regex": "document\\s*\\.\\s*cookie", "delimiters": "/", "flags": "i" },
        "tier4_cookie_companion": { "regex": "https?:\\/\\/|\\/\\/[^\\s'\"]|\\.src\\s*=|src\\s*=|Image\\s*\\(\\s*\\)", "delimiters": "/", "flags": "i" },
        "tier4_innerhtml_main": { "regex": "\\binnerHTML\\s*=|\\bouterHTML\\s*=", "delimiters": "/", "flags": "i" },
        "tier4_innerhtml_companion": { "regex": "https?:\\/\\/|\\/\\/[^\\s'\"]|%3[cC]|&#x?\\d*58;|&#x?\\d*47;", "delimiters": "/", "flags": "i" },
        "tier1_return_bool": { "regex": "^return\\s+(false|true)\\s*;?$", "delimiters": "/", "flags": "i" },
        "tier1_return_empty": { "regex": "^return\\s*;?$", "delimiters": "/", "flags": "i" },
        "tier1_simple_call": { "regex": "^([a-zA-Z_$][\\w$]*)\\s*\\((.*)\\)$", "delimiters": "/", "flags": "s" },
        "arg_number": { "regex": "^[-+]?\\d+(?:\\.\\d+)?$", "delimiters": "/", "flags": "" },
        "arg_keyword": { "regex": "^(true|false|null)$", "delimiters": "/", "flags": "i" },
        "arg_this": { "regex": "^this$", "delimiters": "/", "flags": "i" },
        "arg_identifier": { "regex": "^[a-zA-Z_$][\\w$]*$", "delimiters": "/", "flags": "" },
        "obf_id_hex": { "regex": "^[_$]?(?:0x)?[0-9a-f]{3,}$", "delimiters": "/", "flags": "i" },
        "obf_id_underscore_hex": { "regex": "^_[0-9a-f]{4,}$", "delimiters": "/", "flags": "i" },
        "obf_id_letter_digits": { "regex": "^[a-zA-Z]\\d{3,}$", "delimiters": "/", "flags": "" },
        "primary_call_name": { "regex": "^([a-zA-Z_$][\\w$]*)\\s*\\(", "delimiters": "/", "flags": "" },
        "tier3_location": { "regex": "\\b(?:window\\s*\\.)?location\\b|\\blocation\\s*(?:\\.|(?:\\[[^\\]]+\\]\\s*=))", "delimiters": "/", "flags": "i" },
        "tier3_fetch_xhr": { "regex": "\\bfetch\\s*\\(|\\bXMLHttpRequest\\b|\\.open\\s*\\(\\s*[\"'][A-Za-z]+", "delimiters": "/", "flags": "i" },
        "tier3_websocket": { "regex": "\\bWebSocket\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier3_new_image": { "regex": "new\\s+Image\\s*\\(\\s*\\)", "delimiters": "/", "flags": "i" },
        "tier3_cookie": { "regex": "document\\s*\\.\\s*cookie", "delimiters": "/", "flags": "i" },
        "tier3_postmessage": { "regex": "\\b(?:postMessage|sendBeacon)\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier2_jquery": { "regex": "\\bjQuery\\s*\\(|[^.\\w$]\\$\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier2_dom_query": { "regex": "\\.(?:getElementById|getElementsByClassName|getElementsByTagName|querySelector|querySelectorAll)\\s*\\(", "delimiters": "/", "flags": "i" },
        "tier2_classlist": { "regex": "\\bclassList\\s*\\.", "delimiters": "/", "flags": "i" },
        "tier2_style_assign": { "regex": "\\bstyle\\s*\\.\\s*\\w+\\s*=", "delimiters": "/", "flags": "i" },
        "tier2_analytics": { "regex": "\\b(?:ga|gtag)\\s*\\(|\\bdataLayer\\b", "delimiters": "/", "flags": "i" },
        "tier2_jquery_anim": { "regex": "\\.(?:slideToggle|slideDown|slideUp|fadeIn|fadeOut|show|hide)\\s*\\(", "delimiters": "/", "flags": "i" }
      },
      "finding": {
        "rule_id": "inline_event_handler",
        "category": "javascript_injection"
      }
    },

    "document_write": {
      "patterns": [
        {
          "id": "document_write",
          "regex": "document\\s*\\.\\s*write(?:ln)?\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "document_write",
            "category": "javascript_injection",
            "severity": "suspicious",
            "confidence": 75
          }
        }
      ]
    },

    "javascript_uris": {
      "patterns": [
        {
          "id": "javascript_uri",
          "regex": "(?:href|src|action|formaction|data)\\s*=\\s*[\"']?\\s*javascript\\s*:",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "javascript_uri",
            "category": "javascript_injection",
            "severity": "critical",
            "confidence": 90
          }
        }
      ]
    },

    "embed_objects": {
      "patterns": [
        {
          "id": "embed_external",
          "regex": "<(object|embed|applet)\\b[^>]+(?:data|src|code|codebase)\\s*=\\s*[\"']?(https?:\\/\\/(?!{{ALLOWLIST}})[^\"'\\s>]+)",
          "delimiters": "/",
          "flags": "i",
          "placeholders": ["ALLOWLIST"],
          "finding": {
            "category": "external_resources",
            "base_severity": "critical",
            "base_confidence": 85
          }
        }
      ]
    },

    "meta_refresh": {
      "patterns": [
        {
          "id": "meta_refresh_redirect",
          "regex": "<meta[^>]+http-equiv\\s*=\\s*[\"']?refresh[\"']?[^>]+content\\s*=\\s*[\"']?\\d+\\s*;\\s*url\\s*=\\s*([^\"'\\s>]+)",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "meta_refresh_redirect",
            "category": "redirects",
            "base_severity": "critical",
            "base_confidence": 80
          }
        }
      ]
    },

    "php_patterns": {
      "lists": {
        "unambiguous_functions": [
          "eval", "assert", "create_function", "call_user_func", "call_user_func_array",
          "exec", "shell_exec", "passthru", "popen", "proc_open", "pcntl_exec",
          "file_get_contents", "file_put_contents", "fwrite", "fputs",
          "base64_decode", "gzinflate", "gzuncompress", "str_rot13", "convert_uudecode"
        ],
        "ambiguous_functions": ["system"],
        "code_exec_subset": ["eval", "assert", "exec", "shell_exec", "passthru", "popen", "proc_open"]
      },
      "patterns": [
        {
          "id": "serialized_object",
          "regex": "O:\\d+:\"[^\"]+\"",
          "delimiters": "/",
          "flags": "",
          "finding": {
            "rule_id": "php_serialized_object",
            "category": "code_injection",
            "severity": "review",
            "confidence": 50
          }
        }
      ],
      "finding_unambiguous": {
        "rule_id": "php_dangerous_function",
        "category": "code_injection"
      },
      "finding_ambiguous": {
        "rule_id": "php_dangerous_function",
        "category": "code_injection",
        "severity": "critical",
        "confidence": 85
      }
    },

    "svg_scripts": {
      "patterns": [
        {
          "id": "svg_event_handler",
          "regex": "<svg[^>]*\\bon(?:load|error|click|mouseover)[^>]*>",
          "delimiters": "/",
          "flags": "is",
          "finding": {
            "rule_id": "svg_event_handler",
            "category": "javascript_injection",
            "severity": "critical",
            "confidence": 90
          }
        },
        {
          "id": "svg_embedded_script",
          "regex": "<svg[^>]*>.*?<script[^>]*>.*?<\\/script>.*?<\\/svg>",
          "delimiters": "/",
          "flags": "is",
          "finding": {
            "rule_id": "svg_embedded_script",
            "category": "javascript_injection",
            "severity": "critical",
            "confidence": 95
          }
        },
        {
          "id": "svg_foreign_object",
          "regex": "<svg[^>]*>.*?<foreignObject[^>]*>.*?<\\/foreignObject>.*?<\\/svg>",
          "delimiters": "/",
          "flags": "is",
          "finding": {
            "rule_id": "svg_foreign_object",
            "category": "javascript_injection",
            "severity": "suspicious",
            "confidence": 70
          }
        }
      ]
    },

    "crypto_miners": {
      "lists": {
        "miner_patterns": [
          "coinhive\\.com",
          "coin-hive\\.com",
          "cryptoloot\\.pro",
          "crypto-loot\\.com",
          "jsecoin\\.com",
          "authedmine\\.com",
          "minero\\.cc",
          "webmine\\.pro",
          "ppoi\\.org",
          "monerominer\\.rocks",
          "coinhive\\.min\\.js",
          "cryptonight\\.wasm",
          "deepMiner\\.js",
          "miner\\.start\\s*\\(",
          "CoinHive\\.Anonymous",
          "CoinHive\\.User",
          "CryptoLoot\\.Anonymous",
          "cryptonight",
          "stratum\\+tcp://"
        ]
      },
      "patterns": [
        {
          "id": "crypto_miner",
          "regex": "({{MINERS}})",
          "delimiters": "#",
          "flags": "i",
          "placeholders": ["MINERS"],
          "finding": {
            "rule_id": "crypto_miner",
            "category": "cryptojacking",
            "severity": "critical",
            "confidence": 95
          }
        }
      ]
    },

    "js_redirects": {
      "lists": {
        "redirect_patterns": [
          "window\\.location\\s*=",
          "window\\.location\\.href\\s*=",
          "window\\.location\\.replace\\s*\\(",
          "window\\.location\\.assign\\s*\\(",
          "document\\.location\\s*=",
          "document\\.location\\.href\\s*=",
          "top\\.location\\s*=",
          "parent\\.location\\s*=",
          "self\\.location\\s*="
        ]
      },
      "patterns": [
        {
          "id": "js_redirect",
          "regex": "({{REDIRECTS}})\\s*[\"']?(https?:\\/\\/[^\"'\\s;]+)",
          "delimiters": "/",
          "flags": "i",
          "placeholders": ["REDIRECTS"],
          "finding": {
            "rule_id": "js_redirect",
            "category": "redirects",
            "base_severity": "suspicious",
            "base_confidence": 75
          }
        }
      ]
    },

    "chained_encoding": {
      "patterns": [
        {
          "id": "chained_decode_exec",
          "regex": "(?:eval|exec|assert|system|passthru|shell_exec)\\s*\\(\\s*(?:base64_decode|str_rot13|urldecode|html_entity_decode|gzinflate|gzuncompress)\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "chained_decode_exec",
            "category": "code_injection",
            "severity": "critical",
            "confidence": 90,
            "extra": { "description": "Chained encoding and execution functions detected" }
          }
        },
        {
          "id": "triple_nested_decode",
          "regex": "(?:eval|exec|assert)\\s*\\(\\s*base64_decode\\s*\\(\\s*(?:str_rot13|urldecode|base64_decode|gzinflate)\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "triple_nested_decode",
            "category": "code_injection",
            "severity": "critical",
            "confidence": 95,
            "extra": { "description": "Triple-nested decoding detected (highly suspicious)" }
          }
        },
        {
          "id": "rot13_base64_chain",
          "regex": "(?:str_rot13|base64_decode)\\s*\\(\\s*(?:base64_decode|str_rot13)\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "dedup_against": { "rule_id": "triple_nested_decode", "distance": 50 },
          "finding": {
            "rule_id": "rot13_base64_chain",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 80,
            "extra": { "description": "ROT13 and Base64 chained encoding" }
          }
        },
        {
          "id": "eval_hex_string",
          "regex": "(?:eval|exec|assert)\\s*\\(\\s*[\"']\\\\x[0-9a-f]{2}",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "eval_hex_string",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 75,
            "extra": { "description": "Hexadecimal-encoded string in eval()" }
          }
        },
        {
          "id": "eval_octal_string",
          "regex": "(?:eval|exec|assert)\\s*\\(\\s*[\"']\\\\[0-7]{3}",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "eval_octal_string",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 75,
            "extra": { "description": "Octal-encoded string in eval()" }
          }
        },
        {
          "id": "double_base64_decode",
          "regex": "base64_decode\\s*\\(\\s*base64_decode\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "double_base64_decode",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 85,
            "extra": { "description": "Double Base64 decoding detected" }
          }
        },
        {
          "id": "gzinflate_base64",
          "regex": "(?:gzinflate|gzuncompress)\\s*\\(\\s*base64_decode\\s*\\(",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "gzinflate_base64",
            "category": "obfuscation",
            "severity": "suspicious",
            "confidence": 85,
            "extra": { "description": "Compression and Base64 chained encoding" }
          }
        },
        {
          "id": "preg_replace_e_modifier",
          "regex": "preg_replace\\s*\\(\\s*[\"'][^\"']*\\/[imsxADSUXJu]*e[imsxADSUXJu]*[\"']",
          "delimiters": "/",
          "flags": "i",
          "finding": {
            "rule_id": "preg_replace_e_modifier",
            "category": "code_injection",
            "severity": "critical",
            "confidence": 90,
            "extra": { "description": "preg_replace with /e modifier (code execution)" }
          }
        }
      ]
    },

    "decoder_markers": {
      "lists": {
        "base64_code_markers": ["<?php", "eval", "base64_decode", "function", "http://", "https://", "<script", "$_", "exec(", "system("],
        "rot13_code_keywords": ["eval", "exec", "base64", "http", "https", "script", "function", "<?php", "system", "shell", "passthru", "curl", "file_get"]
      }
    },

    "help_examples": {
      "lists": {
        "multi_layer_encoding": [
          { "code": "eval(base64_decode(str_rot13(\"...\")))", "suffix": "— 3 layers deep" },
          { "code": "eval(\"\\x65\\x76\\x61\\x6c(...)\")", "suffix": "— Hex-encoded JavaScript" },
          { "code": "gzinflate(base64_decode(\"...\"))", "suffix": "— Compressed + encoded" }
        ],
        "serialized_data": [
          { "code": "a:1:{s:10:\"custom_css\";s:50:\"</style><script>eval(...);</script>\";}", "suffix": "— Malware in Elementor CSS" },
          { "code": "a:2:{s:8:\"callback\";s:6:\"system\";s:7:\"command\";s:5:\"ls -la\";}", "suffix": "— Command injection" },
          { "code": "a:1:{s:8:\"raw_html\";s:100:\"<iframe src='http://evil.com'></iframe>\";}", "suffix": "— Hidden iframe" }
        ],
        "dangerous_keys": ["custom_css", "callback", "eval", "raw_html", "exec"]
      },
      "strings": {
        "feat_chained": "Chained encoding attacks (eval + base64_decode, triple nesting)",
        "feat_obf_js": "Obfuscated JavaScript (fromCharCode, eval, compressed payloads)",
        "serialized_inspection_blurb": "Content Guard Pro safely unserializes this data and recursively scans all nested arrays up to 10 levels deep. It identifies \"dangerous keys\" like {{KEYS}} — automatically boosting confidence by 15 points for threats found in these high-risk locations. The system tracks the exact path in the array (e.g., \"settings.advanced.code\") to help you locate and remove the threat.",
        "examples_unavailable": "Examples temporarily unavailable."
      }
    }
  }
}