terminal-mcp 0.1.5

// src/security/detect/bash/rules/remote_exec.rs

use crate::sec_bash_detector_rule_impl_base;
use crate::security::detect::bash::utils::detect_remote_execution;
use crate::security::detect::utils::{url_analyze, UrlAnalysisResult};
use crate::security::detect::{EvaluateResult, Severity};

sec_bash_detector_rule_impl_base!(
    RuleRemoteExecution,
    name: "remote_execution",
    desc: "Detects remote execution payload via HTTP/HTTPS/IP",
    default_severity: Severity::Low,
    query: r#"
[
  (pipeline) @target
  (command) @target
]
"#,
    capture: |node, source| {
        if let Some(url) = detect_remote_execution(node, source) {
            match url_analyze(&url) {
                Ok(UrlAnalysisResult::HttpIp) => {
                    return Ok(EvaluateResult::hit_with_severity(
                        format!("High threat download & execute (Direct IP): {}", url),
                        Severity::High,
                    ));
                }
                Ok(UrlAnalysisResult::HttpDomain) => {
                    return Ok(EvaluateResult::hit_with_severity(
                        format!("Medium threat download & execute (HTTP Domain): {}", url),
                        Severity::Medium,
                    ));
                }
                Ok(UrlAnalysisResult::Https) => {
                    return Ok(EvaluateResult::hit(
                        format!("Low threat download & execute (HTTPS): {}", url)
                    ));
                }
                _ => {}
            }
        }
        Ok(EvaluateResult::Miss)
    }
);