terminal-mcp 0.1.5

Model Context Protocol (MCP) server for long-lived shell execution.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

// src/security/detect/bash/rules/mod.rs

mod reverse_shell;
mod remote_exec;
mod obfuscation;
mod destructive_rm;
mod sensitive_read;
mod cron_persistence;
mod bind_shell;
mod ssh_backdoor;
mod destructive_disk;

pub use reverse_shell::RuleBashTcpUdpReverseShell1;
pub use remote_exec::RuleRemoteExecution;
pub use obfuscation::RuleBashObfuscationEvidence;
pub use destructive_rm::RuleDestructiveRm;
pub use sensitive_read::RuleSensitiveFileRead;
pub use cron_persistence::RuleCronPersistence;
pub use bind_shell::RuleBindShell;
pub use ssh_backdoor::RuleSshBackdoor;
pub use destructive_disk::RuleDestructiveDisk;

use crate::security::detect::Rule;
use std::sync::Arc;

/// 集中暴露所有 Bash 规则，供探测器启动时加载
pub fn get_all_rules() -> Vec<Arc<dyn Rule>> {
    vec![
        Arc::new(RuleBashTcpUdpReverseShell1),
        Arc::new(RuleRemoteExecution),
        Arc::new(RuleBashObfuscationEvidence),
        Arc::new(RuleDestructiveRm),
        Arc::new(RuleSensitiveFileRead),
        Arc::new(RuleCronPersistence),
        Arc::new(RuleBindShell),
        Arc::new(RuleSshBackdoor),
        Arc::new(RuleDestructiveDisk),
    ]
}