models.py

from itertools import chain
from typing import List, Optional, Dict, Any, Set, Union, Tuple
from enum import Enum, auto
from pydantic import BaseModel, Field, HttpUrl, field_validator, computed_field, field_serializer, ConfigDict
import re
from datetime import datetime


class ReportFormat(str, Enum):
    """Report output formats supported by ClickGrab."""
    HTML = "html"
    JSON = "json"
    CSV = "csv"
    ALL = "all"


class CommandRiskLevel(str, Enum):
    """Risk level classification for detected commands."""
    LOW = "Low Risk"
    MEDIUM = "Medium Risk"
    HIGH = "High Risk"
    CRITICAL = "Critical Risk"


class CommandType(str, Enum):
    """Types of suspicious commands that can be detected."""
    POWERSHELL = "PowerShell"
    COMMAND_PROMPT = "Command Prompt"
    MSHTA = "MSHTA"
    DLL_LOADING = "DLL Loading"
    FILE_DOWNLOAD = "File Download"
    CERTIFICATE_UTILITY = "Certificate Utility"
    SCRIPT_ENGINE = "Script Engine"
    SYSTEM_CONFIG = "System Configuration"
    ENCODED_POWERSHELL = "Encoded PowerShell"
    MALICIOUS_BATCH = "Malicious Batch File"
    FAKE_MEDIA = "Fake Media/Document File"
    TEMP_SCRIPT = "Temporary Script File"
    FAKE_GOOGLE = "Fake Google Verification"
    HIDDEN_POWERSHELL = "Hidden PowerShell"
    FILE_WRITE = "File Write Operation"
    EXECUTION_POLICY_BYPASS = "Execution Policy Bypass"
    URL_WITH_COMMENT = "Command with URL and Comment"
    SUSPICIOUS = "Suspicious Command"
    JAVASCRIPT = "JavaScript Command Execution"
    VBSCRIPT = "VBScript Command"
    CLIPBOARD_MANIPULATION = "Clipboard Manipulation"
    CAPTCHA_ELEMENT = "CAPTCHA Element"
    OBFUSCATED_JS = "Obfuscated JavaScript"
    SUSPICIOUS_REDIRECT = "Suspicious JavaScript Redirect"
    # New types for Dec 2025 threats
    MACOS_TERMINAL = "macOS Terminal Command"
    CURL_BASH = "curl | bash Execution"
    WINHTTP_VBSCRIPT = "WinHttp VBScript Payload"
    STEGANOGRAPHY = "Steganography Payload"
    HEX_ENCODED_IP = "Hex-Encoded IP Address"
    SHARED_AI_CHAT = "Shared AI Chat Link"
    FAKE_GLITCH = "Fake Glitch/Broken Website"
    # New types for 2026 threats
    DNS_LOOKUP = "DNS Lookup Payload Delivery"
    WINDOWS_TERMINAL = "Windows Terminal Execution"
    WEBDAV_MOUNT = "WebDAV Share Mount"
    FINGER_EXE = "finger.exe Abuse"
    CONSENTFIX = "OAuth ConsentFix Token Theft"
    FAKE_SOFTWARE = "Fake Software Download"
    LLM_ARTIFACT = "LLM Artifact Abuse"


class AnalysisVerdict(str, Enum):
    """Analysis verdict classifications."""
    SUSPICIOUS = "Suspicious"
    LIKELY_SAFE = "Likely Safe"
    UNKNOWN = "Unknown"


# Shared constants and patterns
class CommonPatterns:
    """Central repository for patterns shared across the codebase.
    
    This class organizes all regex patterns and constants used for detection.
    These patterns are used in extractors.py for consistent pattern matching.
    """
    
    # Benign URL patterns for filtering (used in URL validation)
    BENIGN_URL_PATTERNS = [
        r'https?://www\.w3\.org/',
        r'https?://schemas\.microsoft\.com/',
        r'https?://fonts\.googleapis\.com/',
        r'https?://fonts\.gstatic\.com/',
        r'https?://ajax\.googleapis\.com/',
        r'https?://cdnjs\.cloudflare\.com/ajax/libs/',
        r'https?://maxcdn\.bootstrapcdn\.com/',
        r'https?://stackpath\.bootstrapcdn\.com/',
        r'https?://unpkg\.com/',
    ]
    
    # Simple strings for content matching (used in quick string checks)
    BENIGN_URL_STRINGS = [
        'www.w3.org',
        'schemas.microsoft.com',
        'fonts.googleapis.com',
        'fonts.gstatic.com',
        'ajax.googleapis.com',
        'cdnjs.cloudflare.com',
        'maxcdn.bootstrapcdn.com',
        'stackpath.bootstrapcdn.com',
        'unpkg.com'
    ]
    
    # Parking page and loader patterns
    PARKING_PAGE_PATTERNS = [
        r'window\.park\s*=\s*["\']([A-Za-z0-9+/=]+)["\']',
        r'<html[^>]*data-adblockkey\s*=\s*["\'][^"\']+["\']',
        r'<div[^>]*id\s*=\s*["\']target["\'][^>]*style\s*=\s*["\'][^"\']*opacity:\s*0[^"\']*["\']',
        r'<script[^>]*src\s*=\s*["\']\/[a-zA-Z0-9]{8,10}\.js["\']'
    ]
    
    # Fake Video Conferencing patterns (Google Meet, Teams, Zoom, WebEx)
    # These detect phishing pages impersonating video conferencing services
    FAKE_VIDEO_CONFERENCING_PATTERNS = [
        # Fake Google Meet indicators
        r'gogl-meet\.com',
        r'meet\.conference-web\.com',
        r'google-meet\.[a-z]{2,}',
        r'googlemeet\.[a-z]{2,}',
        r'g-meet\.[a-z]{2,}',
        r'meet\.google\.[a-z]{2,}(?!/)',  # Suspicious non-google TLD
        r'<title>[^<]*Google\s*Meet[^<]*</title>',
        r'class=["\'][^"\']*google-meet[^"\']*["\']',
        
        # Fake Microsoft Teams indicators
        r'teams-meeting\.[a-z]{2,}',
        r'ms-teams\.[a-z]{2,}',
        r'microsoft-teams\.[a-z]{2,}',
        r'teams\.microsoft\.[a-z]{2,}(?!/)',
        r'<title>[^<]*Microsoft\s*Teams[^<]*</title>',
        
        # Fake Zoom indicators
        r'zoom-meeting\.[a-z]{2,}',
        r'zoom-us\.[a-z]{2,}',
        r'us-zoom\.[a-z]{2,}',
        r'zoom\.us\.[a-z]{2,}',
        r'<title>[^<]*Zoom\s*Meeting[^<]*</title>',
        
        # Fake WebEx indicators
        r'webex-meeting\.[a-z]{2,}',
        r'cisco-webex\.[a-z]{2,}',
        
        # Generic video conferencing ClickFix patterns
        r'Can\'?t\s+join\s+the\s+meeting',
        r'Unable\s+to\s+join\s+(?:the\s+)?meeting',
        r'Meeting\s+connection\s+(?:failed|error)',
        r'Join\s+now\s*</button>',
        r'Ready\s+to\s+join\?',
        r'Permission\s+needed',
        r'No\s+camera\s+found',
        r'Camera\s+not\s+available',
    ]
    
    # ClickFix instruction patterns - social engineering instructions
    # Detects the "Win+R, Ctrl+V, Enter" instruction sequence
    CLICKFIX_INSTRUCTION_PATTERNS = [
        # Windows key combinations
        r'(?:Press|Hit|Hold)\s+(?:the\s+)?(?:Windows|Win)\s*(?:key)?\s*\+\s*R',
        r'Windows\s*key\s*\+\s*R',
        r'Win\s*\+\s*R',
        r'⊞\s*\+\s*R',  # Windows logo key symbol
        
        # Ctrl+V paste instructions
        r'(?:then|and)\s+(?:press\s+)?(?:CTRL|Ctrl)\s*\+\s*V',
        r'(?:press|hit)\s+(?:CTRL|Ctrl)\s*\+\s*V',
        r'paste\s+(?:the\s+)?(?:command|code|text)',
        
        # Enter key instructions
        r'(?:finally\s+)?(?:press|hit)\s+Enter',
        r'and\s+(?:press\s+)?Enter',
        
        # Full instruction sequences
        r'Press\s+(?:the\s+)?Windows\s*(?:key)?\s*\+\s*R.*?(?:CTRL|Ctrl)\s*\+\s*V.*?Enter',
        r'Win\s*\+\s*R.*?(?:CTRL|Ctrl)\s*\+\s*V.*?Enter',
        
        # Run dialog instructions
        r'(?:Open|Launch)\s+(?:the\s+)?Run\s+(?:dialog|window|box)',
        r'type\s+(?:in|into)\s+(?:the\s+)?(?:Run|command)\s+(?:dialog|window|box)',
        
        # Terminal/PowerShell instructions
        r'(?:Open|Launch)\s+(?:Windows\s+)?(?:PowerShell|Terminal|Command\s+Prompt)',
        r'paste\s+(?:this\s+)?(?:into|in)\s+(?:the\s+)?(?:terminal|PowerShell|command\s+prompt)',
        
        # Mac-specific ClickFix instructions
        r'(?:Press|Hit)\s+(?:Command|Cmd|⌘)\s*\+\s*Space',
        r'(?:Open|Launch)\s+Terminal',
        r'(?:Open|Launch)\s+Spotlight',
        r'(?:Command|Cmd|⌘)\s*\+\s*V',
        
        # Generic copy-paste instructions for malicious commands
        r'copy\s+(?:this|the)\s+(?:command|code|script)',
        r'paste\s+(?:this|the)\s+(?:command|code|script)',
        r'run\s+(?:this|the)\s+(?:command|code|script)',
        r'execute\s+(?:this|the)\s+(?:command|code|script)',

        # Win+X instructions (Windows Terminal ClickFix - 2026)
        r'(?:Press|Hit|Hold)\s+(?:the\s+)?(?:Windows|Win)\s*(?:key)?\s*\+\s*X',
        r'Win\s*\+\s*X.*?(?:then|and)\s+(?:press\s+)?I\b',
        r'⊞\s*\+\s*X',
    ]
    
    # Steganography and cache smuggling patterns
    # Detects image-based payload delivery and cache smuggling techniques
    STEGANOGRAPHY_PATTERNS = [
        # PowerShell image extraction
        r'Add-Type\s+-AssemblyName\s+System\.Drawing',
        r'New-Object\s+System\.Drawing\.Bitmap',
        r'\[System\.Drawing\.Bitmap\]::new\(',
        r'\.GetPixel\s*\(',
        r'\.LockBits\s*\(',
        r'BitmapData',
        r'PixelFormat',
        r'Marshal\.Copy',
        r'IntPtr',
        
        # Pixel-level extraction (color channel extraction)
        r'\.R\b',  # Red channel
        r'\.G\b',  # Green channel  
        r'\.B\b',  # Blue channel
        r'\.A\b',  # Alpha channel
        r'(?:pixel|color)(?:Data)?\.(?:red|green|blue|alpha)',
        r'(?:extract|read)(?:ing)?\s+(?:from\s+)?(?:red|green|blue|alpha)\s+channel',
        r'(?:rgb|rgba)\s*\[\s*\d+\s*\]',
        r'stride\s*\*\s*\w+\s*\+\s*\w+\s*\*\s*\d+',  # Pixel offset calculation
        
        # .NET reflection and assembly loading (steganography loaders)
        r'\[System\.Reflection\.Assembly\]::Load\(',
        r'Assembly\.Load\s*\(',
        r'LoadFrom\s*\(',
        r'Invoke\s*\(\s*\$null',
        r'GetMethod\s*\(["\']',
        r'CreateInstance\s*\(',
        r'EntryPoint\.Invoke',
        
        # Manifest resource extraction
        r'GetManifestResourceStream',
        r'GetManifestResourceNames',
        r'embedded\s+resource',
        
        # Image download and extraction patterns
        r'(?:iwr|Invoke-WebRequest|curl|wget)[^\n]*\.(?:jpg|jpeg|png|gif|bmp|webp)',
        r'-OutFile[^\n]*\.(?:jpg|jpeg|png|gif|bmp|webp)',
        r'DownloadFile[^\n]*\.(?:jpg|jpeg|png|gif|bmp|webp)',
        
        # Stego Loader patterns (from recent attacks)
        r'Stego\s*Loader',
        r'steganography',
        r'hidden\s+(?:in|within)\s+(?:image|picture|photo)',
        r'extract(?:ed)?\s+from\s+(?:image|picture|photo)',
        
        # Shellcode patterns (often used with steganography)
        r'shellcode',
        r'\[Byte\[\]\]\s*\$',
        r'VirtualAlloc',
        r'VirtualProtect',
        r'CreateThread',
        r'NtCreateThreadEx',
        r'RtlMoveMemory',
        
        # Cache smuggling patterns
        r'cache\s*smuggl(?:ing|e)',
        r'browser\s+cache',
        r'ServiceWorker',
        r'caches\.open',
        r'cache\.put',
        r'cache\.match',
        
        # JavaScript image manipulation for payload extraction
        r'canvas\.getContext\s*\(\s*["\']2d["\']\s*\)',
        r'getImageData\s*\(',
        r'createImageData\s*\(',
        r'putImageData\s*\(',
        r'toDataURL\s*\(',
        r'FileReader.*?readAsDataURL',
        r'atob\s*\([^)]*\).*?(?:Uint8Array|ArrayBuffer)',
        r'data\[\s*\w+\s*\*\s*4\s*\]',  # RGBA pixel access pattern
        r'imageData\.data',
        
        # AES decryption (used with steganography)
        r'AES',
        r'CryptoJS',
        r'crypto\.subtle',
        r'decrypt',
        r'XOR',
        r'\^\s*0x[0-9a-fA-F]+',  # XOR with hex value
    ]
    
    # Fake Windows Update patterns
    FAKE_WINDOWS_UPDATE_PATTERNS = [
        r'Windows\s+Update',
        r'Updating\s+Windows',
        r'Installing\s+updates?',
        r'Update\s+in\s+progress',
        r'Do\s+not\s+turn\s+off',
        r'Please\s+wait\s+while\s+we\s+install',
        r'Your\s+(?:PC|computer)\s+will\s+restart',
        r'Configuring\s+Windows',
        r'Getting\s+Windows\s+ready',
        r'Working\s+on\s+updates',
        r'\d+%\s+complete',
        r'Update\s+failed',
        r'Update\s+error',
        r'KB\d{6,}',  # Fake KB article numbers
    ]
    
    # Fake Cloudflare verification patterns
    # Detects pages impersonating Cloudflare security checks with malicious JS
    FAKE_CLOUDFLARE_PATTERNS = [
        # Typosquatted Cloudflare domains
        r'cloudfarev\.', r'cloudflarev\.', r'cloudflre\.', r'cloudf1are\.',
        r'cl0udflare\.', r'cloudflaire\.', r'cloudflair\.', r'cloudflare-verify\.',
        r'cloudflare-check\.', r'cf-challenge\.', r'cloudflare-security\.',
        
        # Fake Cloudflare verification text patterns
        r'Verifying\s+you\s+are\s+human',
        r'Checking\s+your\s+browser',
        r'Checking\s+if\s+the\s+site\s+connection\s+is\s+secure',
        r'DDoS\s+protection\s+by\s+Cloudflare',
        r'This\s+process\s+is\s+automatic',
        r'Your\s+browser\s+will\s+redirect',
        r'Please\s+wait\s+while\s+we\s+verify',
        r'Security\s+check\s+required',
        r'One\s+more\s+step',
        r'Please\s+complete\s+the\s+security\s+check',
        r'This\s+may\s+take\s+a\s+few\s+seconds',
        
        # Fake Ray ID patterns (real Cloudflare uses specific format)
        r'Ray\s+ID:\s*[a-f0-9]{16}',
        r'data-ray\s*=\s*["\'][a-f0-9]{16}["\']',
        
        # Cloudflare branding with suspicious context
        r'Performance\s+&\s+security\s+by\s+Cloudflare',
        r'cf-assets\.www\.cloudflare\.com',
        
        # Suspicious external JS loading with Cloudflare-like names
        r'<script[^>]*src\s*=\s*["\'][^"\']*(?:cloudflare|newcloudflare|cfverify)[^"\']*\.js["\']',
        
        # Spinner/loading animation with verification text
        r'spinner.*verif(?:y|ication)',
        r'verif(?:y|ication).*spinner',
        
        # Redirect after fake verification
        r'setTimeout\s*\([^)]*redirect',
        r'window\.location\s*=.*after.*verif',
    ]
    
    # macOS Terminal attack patterns (AMOS stealer, curl|bash attacks)
    # Detects attacks targeting Mac users via Terminal commands
    MACOS_TERMINAL_PATTERNS = [
        # curl pipe to bash/sh patterns (very dangerous)
        r'curl\s+[^\|]+\|\s*(?:ba)?sh',
        r'curl\s+-[sSkLfO]+\s+[^\|]+\|\s*(?:ba)?sh',
        r'curl\s+(?:-[a-zA-Z]+\s+)*["\']?https?://[^\s"\']+["\']?\s*\|\s*(?:ba)?sh',
        r'/bin/(?:ba)?sh\s+-c\s+["\']curl',
        r'wget\s+[^\|]+\|\s*(?:ba)?sh',
        
        # osascript for macOS command execution
        r'osascript\s+-e',
        r'osascript\s+["\'][^"\']+["\']',
        r'do\s+shell\s+script',
        
        # Terminal.app specific
        r'open\s+-a\s+Terminal',
        r'Terminal\.app',
        
        # Homebrew abuse
        r'brew\s+install.*&&.*curl',
        r'/bin/bash\s+-c\s+["\'].*curl.*["\']',
        
        # macOS specific paths
        r'/Users/[^/]+/\.(?:zshrc|bash_profile|bashrc)',
        r'~/\.(?:zshrc|bash_profile|bashrc)',
        r'/tmp/[a-zA-Z0-9_]+\.sh',
        
        # ClickFix Mac instructions
        r'(?:Open|Launch)\s+Terminal',
        r'(?:Open|Launch)\s+Spotlight',
        r'(?:Command|Cmd|⌘)\s*\+\s*Space',
        r'type\s+Terminal',

        # Matryoshka/MacSync patterns (2026)
        r'curl\s+[^\|]*-H\s+["\']api-key:',       # API-gated C2
        r'curl\s+[^\|]*\|\s*osascript',             # curl piped to osascript
        r'curl\s+[^\|]*dynamic\?txd=',              # MacSync token parameter
        r'/tmp/osalogging',                          # MacSync staging path
        r'base64\s+-D\s*\|\s*gunzip',               # AMOS decode chain
        r'echo\s+[A-Za-z0-9+/=]+\s*\|\s*base64\s+-[dD]',  # Base64 decode on macOS
        # DriveSurge macOS execution forms (Silent Push, 2026)
        r'curl\s+[^|\n]*-o\s+[^\s&|;]+[^\n]*?&&\s*(?:ba)?sh\b',     # curl -o file && bash file (download-then-exec)
        r'curl\s+-[a-zA-Z]*[kfsSL]+[a-zA-Z]*\s+["\']?https?://[^\s"\']+["\']?\s+-o\b',  # curl -kfsSL "url" -o file
        r'base64\s+(?:-[dD]|--decode)\s*\|\s*(?:ba)?sh\b',          # base64 -D | bash decode-and-run
        r'(?:cd\s+/tmp\s*&&\s*)?curl\b[^\n]*&&\s*(?:ba)?sh\b[^\n]*&&\s*rm\b',  # cd /tmp && curl ... && bash ... && rm
    ]

    # DriveSurge / zTDS injection-script signatures (Silent Push, 2026).
    # These are the loader URLs a compromised site is injected with by the TDS.
    TDS_INJECTION_PATTERNS = [
        r'\bt\.js\?site=[A-Fa-f0-9]{16,}',               # t.js?site=<32-hex victim id>
        r'/t\.[A-Fa-f0-9]{12}\.js\b',                    # t.<first-12-of-sha256>.js
        r'/ext-?b?[._][A-Fa-f0-9]{8,}\.js\b',            # ext-b.<hex>.js / ext.<hex>.js
        r'\bjsrepo\?rnd=',                               # zTDS injection endpoint
        r'/jsrepo\b',
        r'/banner-js\.php\b',                            # banerpanel ADS loader
        r'/assets/snippets/droppers/',                   # zTDS dropper snippet path
        r'/banner-js\b',
    ]

    # Fake browser-update ("FakeUpdates") lure indicators. DriveSurge impersonates
    # 12 browser brands with "update required" overlays that hand the victim a payload.
    FAKE_BROWSER_UPDATE_PATTERNS = [
        r'(?:Chrome|Firefox|Mozilla|Edge|Safari|Opera|Brave|Yandex|Vivaldi|Samsung\s+Internet|UC\s+Browser)\s+(?:browser\s+)?(?:is\s+)?(?:out\s+of\s+date|needs?\s+(?:to\s+be\s+)?updated?|update\s+(?:required|available|needed))',
        r'(?:your\s+)?(?:browser|version\s+of\s+\w+)\s+is\s+(?:out\s+of\s+date|outdated|no\s+longer\s+supported)',
        r'(?:critical|important|recommended)\s+(?:browser\s+)?update',
        r'update\s+(?:your\s+)?(?:browser|chrome|firefox|edge)\s+(?:now|to\s+continue)',
        r'Browser[_\s-]?Update\.(?:exe|dmg|pkg|zip)',
        r'class=["\'][^"\']*(?:chrome|firefox|browser)[-_]?update[^"\']*["\']',
        r'(?:download|install)\s+(?:the\s+)?(?:latest|new)\s+version\s+of\s+(?:chrome|firefox|edge|your\s+browser)',
    ]

    # Shared AI chat patterns (ChatGPT, Grok poisoned conversations)
    # Detects shared AI conversations used to distribute malware
    SHARED_AI_CHAT_PATTERNS = [
        # ChatGPT share links
        r'chat\.openai\.com/share/[a-zA-Z0-9-]+',
        r'chatgpt\.com/share/[a-zA-Z0-9-]+',
        
        # Grok/X AI links
        r'grok\.x\.ai',
        r'x\.com/i/grok',
        
        # AI-generated instruction patterns often abused
        r'(?:follow|execute)\s+(?:these|the)\s+(?:steps|commands?)\s+(?:below|to)',
        r'(?:paste|run)\s+(?:this|the\s+following)\s+(?:in|into)\s+(?:your\s+)?(?:terminal|command|powershell)',
        r'(?:copy|paste)\s+(?:the\s+)?(?:following|this)\s+(?:command|code)\s+(?:into|in)\s+(?:your\s+)?Terminal',
        
        # Fake software installation guides
        r'install\s+(?:the\s+)?(?:latest|new)\s+(?:version|update)\s+(?:of|for)',
        r'download\s+(?:and\s+)?install\s+(?:the\s+)?(?:official|new)',
    ]
    
    # WinHttp VBScript patterns (ErrTraffic v2 toolkit)
    # Detects VBScript-based payload delivery via WinHttp
    WINHTTP_VBSCRIPT_PATTERNS = [
        # WinHttp.WinHttpRequest object creation
        r'CreateObject\s*\(\s*["\']WinHttp\.WinHttpRequest[^"\']*["\']',
        r'WinHttp\.WinHttpRequest\.\d+\.\d+',
        r'MSXML2\.XMLHTTP',
        r'MSXML2\.ServerXMLHTTP',
        r'Microsoft\.XMLHTTP',
        
        # VBScript download and execute pattern
        r'\.Open\s+["\']GET["\'][^;]*\.Send',
        r'Execute\s+\w+\.ResponseText',
        r'ExecuteGlobal\s+\w+\.ResponseText',
        r'\.ResponseText\s*>\s*["\']%temp%',
        
        # wscript execution with VBScript engine
        r'wscript\s+//E:VBScript',
        r'cscript\s+//E:VBScript',
        r'wscript\s+["\']?%temp%[^"\']*\.(?:vbs|tmp)["\']?',
        
        # Combined cmd/echo VBS pattern (from ErrTraffic)
        r'cmd\s*/c\s+echo\s+Set\s+\w+=CreateObject',
        r'echo\s+Set\s+\w+=CreateObject.*>\s*["\']?%temp%',
    ]
    
    # Fake glitch/broken website patterns (ErrTraffic v2 lures)
    # Detects fake "broken" website lures used to trick users
    FAKE_GLITCH_PATTERNS = [
        # Font/encoding corruption messages
        r'(?:missing|corrupt(?:ed)?)\s+(?:system\s+)?font',
        r'font\s+(?:not\s+)?(?:found|available|installed)',
        r'(?:install|download)\s+(?:the\s+)?(?:missing\s+)?font',
        r'font\s+(?:encoding|rendering)\s+(?:error|issue|problem)',
        r'character\s+encoding\s+(?:error|issue|problem)',
        
        # Browser update lures
        r'(?:your\s+)?browser\s+(?:needs?\s+(?:to\s+be\s+)?)?(?:update|upgrade)d?',
        r'browser\s+(?:is\s+)?out\s+of\s+date',
        r'(?:update|upgrade)\s+(?:your\s+)?browser\s+(?:to\s+)?(?:view|see|access)',
        r'(?:install|download)\s+(?:browser\s+)?update',
        
        # Refresh/reload lures  
        r'(?:page|site|website)\s+(?:failed\s+to\s+)?load\s+(?:correctly|properly)',
        r'(?:click|press)\s+(?:to\s+)?refresh',
        r'(?:something\s+)?went\s+wrong.*(?:refresh|reload)',
        
        # Display/rendering issues
        r'display\s+(?:error|issue|problem)',
        r'rendering\s+(?:error|issue|problem)',
        r'(?:page|content)\s+(?:not\s+)?(?:display(?:ed|ing)?|render(?:ed|ing)?)\s+(?:correctly|properly)',
        
        # CSS glitch effects (visual distortion)
        r'filter:\s*(?:blur|distort|glitch)',
        r'animation:\s*(?:glitch|shake|distort)',
        r'@keyframes\s+glitch',
        r'text-shadow:.*(?:red|cyan|magenta)',
    ]
    
    # Hex-encoded IP address patterns (mshta attacks)
    # Detects hex-encoded IP addresses used to evade detection
    HEX_ENCODED_IP_PATTERNS = [
        # mshta with hex-encoded IPs
        r'mshta\s+["\']?(?:https?://)?0x[0-9a-fA-F]+\.0x[0-9a-fA-F]+',
        r'mshta\s+["\']?(?:https?://)?(?:0x[0-9a-fA-F]+\.){3}0x[0-9a-fA-F]+',
        
        # Generic hex IP patterns
        r'(?:https?://)?(?:0x[0-9a-fA-F]{1,2}\.){3}0x[0-9a-fA-F]{1,2}',
        r'(?:https?://)?0x[0-9a-fA-F]{8}(?:/|:)',
        
        # Decimal encoded IPs (single large number)
        r'(?:https?://)?\d{8,10}(?:/|:)',
        
        # Octal encoded IPs
        r'(?:https?://)?(?:0[0-7]{1,3}\.){3}0[0-7]{1,3}',
    ]
    
    # DNS-based ClickFix patterns (nslookup to attacker-controlled DNS)
    # KongTuke campaign (Feb 2026) - uses nslookup to retrieve payload via DNS
    DNS_CLICKFIX_PATTERNS = [
        # nslookup with non-default DNS server (attacker-controlled resolver)
        r'nslookup\s+[^\s]+\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',
        r'nslookup\s+-type=\w+\s+[^\s]+\s+[^\s]+',
        r'nslookup\s+[^\s]+\s+[^\s]+\.[^\s]+',
        # Filtering nslookup output for payload
        r'nslookup[^|]*\|\s*(?:find|findstr|Select-String)',
        r'for\s+/f[^%]*%[^%]*in\s*\([^)]*nslookup',
        # cmd running nslookup from Run dialog
        r'cmd(?:\.exe)?\s+/c\s+.*nslookup',
    ]

    # Windows Terminal (wt.exe) ClickFix patterns
    # Lumma Stealer campaign (Feb/Mar 2026) - Win+X then I to launch terminal
    WINDOWS_TERMINAL_PATTERNS = [
        # Win+X, I shortcut instructions
        r'(?:Press|Hit|Hold)\s+(?:the\s+)?(?:Windows|Win)\s*(?:key)?\s*\+\s*X',
        r'Win\s*\+\s*X.*?(?:then|and)\s+(?:press\s+)?I\b',
        r'⊞\s*\+\s*X',
        # wt.exe execution
        r'wt\.exe',
        r'(?:Windows|Win)\s+Terminal',
        # Hex-encoded XOR commands (used in terminal campaign)
        r'[0-9a-fA-F]{100,}',  # Long hex strings (payload)
    ]

    # WebDAV ClickFix patterns (net use to mount remote shares)
    # Atos research (Mar 2026) - mounts WebDAV share, runs batch file
    WEBDAV_CLICKFIX_PATTERNS = [
        # net use to mount WebDAV share
        r'net\s+use\s+[A-Z]:\s+(?:https?://|\\\\)',
        r'net\s+use\s+[A-Z]:\s+https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/webdav',
        r'/persistent:no',
        # Execute from mounted share then unmount
        r'net\s+use\s+[A-Z]:\s+/delete',
        r'[A-Z]:\\[^"\']+\.(?:cmd|bat)',
        # .asar file modification (Electron app hijacking)
        r'\.asar\b',
    ]

    # finger.exe abuse patterns (CrashFix variant)
    # KongTuke campaign (Jan 2026) - copies finger.exe, renames, uses as C2 client
    FINGER_EXE_PATTERNS = [
        r'finger(?:\.exe)?\s+[^\s]+@[^\s]+',
        r'copy\s+[^"]*finger\.exe',
        r'rename\s+[^"]*finger\.exe',
        r'%temp%[^"]*\\(?:ct|finger)\.exe',
        # Browser extension crash patterns (CrashFix)
        r'browser\s+(?:has\s+)?(?:stopped|crashed)\s+(?:abnormally|unexpectedly)',
        r'NexShield',
    ]

    # ConsentFix patterns (OAuth token theft via copy-paste)
    # No malware execution - pure credential theft
    CONSENTFIX_PATTERNS = [
        # localhost URL with authorization tokens
        r'localhost:\d+/(?:redirect|callback|auth)\?code=',
        r'localhost:\d+[^\s]*access_token=',
        # Instructions to copy localhost URL
        r'(?:copy|paste)\s+(?:the\s+)?(?:URL|address|link)\s+(?:from|in)\s+(?:your\s+)?(?:browser|address\s+bar)',
        # Azure CLI / Microsoft token patterns
        r'az\s+login',
        r'device\s+code\s+flow',
        r'devicelogin',
    ]

    # Fake software download patterns
    # SHub Stealer, MacSync, Odyssey (2026) - impersonate popular apps
    FAKE_SOFTWARE_PATTERNS = [
        # Fake CleanMyMac
        r'cleanmymac[^.]*\.',
        # Fake Zoom/Teams download
        r'(?:download|install)\s+(?:the\s+)?(?:latest\s+)?(?:version\s+of\s+)?(?:zoom|teams|slack|discord)',
        # Fake messaging/video apps
        r'zkcall\b',
        r'zk-call-messenger',
        # Modified wallet apps
        r'(?:ledger|exodus|atomic)\s+(?:live|wallet)[^"]*(?:download|install|update)',
    ]

    # LLM/AI artifact abuse patterns
    # Claude artifacts, ChatGPT share links used for malware distribution (2025-2026)
    LLM_ARTIFACT_PATTERNS = [
        # Claude artifact URLs
        r'claude\.ai/artifacts?/',
        r'claude\.site/',
        # ChatGPT/Grok share links (extends SHARED_AI_CHAT_PATTERNS)
        r'chatgpt\.com/g/',
        # Suspicious "install" instructions from AI-generated content
        r'(?:copy|paste)\s+(?:this|the\s+following)\s+(?:command|code)\s+(?:into|in)\s+(?:your\s+)?Terminal\s+to\s+(?:install|fix|resolve)',
    ]

    # Heavy JS obfuscation indicators (beyond basic patterns)
    # Detects the specific obfuscation style used in attacks like cloudfarev
    HEAVY_OBFUSCATION_PATTERNS = [
        # RC4-style string decryption functions
        r'_0x[a-f0-9]{4,8}\s*=\s*function\s*\(\s*_0x[a-f0-9]+\s*,\s*_0x[a-f0-9]+\s*\)',
        
        # Large string arrays (common in obfuscated malware)
        r'const\s+_0x[a-f0-9]+\s*=\s*\[\s*[\'"][^\'"\]]{100,}',
        r'var\s+_0x[a-f0-9]+\s*=\s*\[\s*[\'"][^\'"\]]{100,}',
        
        # Array rotation/shuffling functions
        r'\(function\s*\(\s*_0x[a-f0-9]+\s*,\s*_0x[a-f0-9]+\s*\)\s*\{[^}]*push[^}]*shift',
        
        # Multiple nested function calls with hex names
        r'_0x[a-f0-9]+\s*\(\s*_0x[a-f0-9]+\s*\(\s*_0x[a-f0-9]+',
        
        # Anti-debugging patterns
        r'debugger\s*;',
        r'setInterval\s*\([^)]*debugger',
        r'constructor\s*\(\s*[\'"]debugger[\'"]\s*\)',
        
        # Self-defending code patterns
        r'function\s*\(\s*\)\s*\{\s*return\s*!!\[\]\s*;?\s*\}',
        r'function\s*\(\s*\)\s*\{\s*return\s*!\[\]\s*;?\s*\}',
        
        # Encoded string concatenation chains
        r'\+\s*_0x[a-f0-9]+\s*\(\s*0x[a-f0-9]+\s*,\s*0x[a-f0-9]+',
        
        # External JS file with obfuscated name
        r'<script[^>]*src\s*=\s*["\'][^"\']*[a-z]{8,12}\.js["\']',
    ]
    
    # Suspicious terms to check in content (used in keyword detection)
    SUSPICIOUS_TERMS = [
        'powershell',
        'cmd',
        'iex',
        'invoke',
        'eval(',
        'exec(',
        '.ps1',
        '.bat',
        '.exe',
        '.hta',
        'downloadstring',
        'invoke-expression',
        'invoke-webrequest',
        'webclient',
        'bypass',
        'hidden',
        'invoke-obfuscation',
        'out-file',
        'system.net.webclient',
        'get-content',
        'mshta',
        'certutil',
        'regsvr32',
        'rundll32',
        'bitsadmin',
        'wscript',
        'cscript',
        'add-type',
        'system.drawing',
        'bitmap',
        'getpixel',
        'lockbits',
        'memorystream',
        'image.fromstream',
        'exif',
        'steganography',
        # macOS related
        'osascript',
        'curl | bash',
        'curl | sh',
        '/bin/bash -c',
        'terminal.app',
        # WinHttp/VBScript
        'winhttprequest',
        'xmlhttp',
        'responsetext',
        'executeglobal',
        # Steganography/shellcode
        'shellcode',
        'virtualalloc',
        'createthread',
        'assembly.load',
        'reflection.assembly',
        'manifestresource',
        # Infostealer related
        'amos',
        'lumma',
        'lummac2',
        'redline',
        'vidar',
        'raccoon',
        # 2026 ClickFix variants
        'nslookup',
        'finger.exe',
        'wt.exe',
        'net use',
        'webdav',
        'modelorat',
        'mimicrat',
        'odyssey',
        'macsync',
        'shub',
        'crashfix',
        'consentfix',
        '.asar',
        'devicelogin',
        'conhost',
        'conhost.exe',
    ]
    
    # PowerShell dangerous indicators (used in risk assessment)
    DANGEROUS_PS_INDICATORS = [
        'iex', 
        'invoke-expression', 
        '-enc', 
        '-e ', 
        '-encodedcommand',
        '-ep',
        'executionpolicy bypass',
        'bypass', 
        'hidden',
        'system.net.webclient',
        'downloadstring',
        'downloadfile',
        'frombase64string',
        'invoke-webrequest',
        'invoke-restmethod',
        'webclient',
        'net.webclient',
        'bitstransfer'
    ]
    
    POWERSHELL_COMMAND_PATTERNS = [
        r'powershell(?:\.exe)?\s+(?:-\w+\s+)*.*',
        r'iex\s*\(.*\)',
        r'invoke-expression.*?',
        r'invoke-webrequest.*?',
        r'iwr\s+.*?',
        r'wget\s+.*?',  # This can be ambiguous in some contexts
        r'curl\s+.*?',  # This can be ambiguous in some contexts
        r'net\s+use.*?',
        r'new-object\s+.*?',
        r'powershell\s+-w\s+\d+\s+.*',
        r'powershell(?:\.exe)?\s+(?:-\w+\s+)*-ep\s+bypass(?:\s+|$).*',
        r'const\s+command\s*=\s*["\'\`]powershell.*?["\`]',
        r'const\s+text\s*=\s*["\'\`]powershell.*?["\`]',
        r'const\s+cmd\s*=\s*["\'\`]powershell.*?["\`]',
        r'var\s+command\s*=\s*["\'\`]powershell.*?["\`]',
        r'var\s+text\s*=\s*["\'\`]powershell.*?["\`]',
        r'var\s+cmd\s*=\s*["\'\`]powershell.*?["\`]',
        r'let\s+command\s*=\s*["\'\`]powershell.*?["\`]',
        r'let\s+text\s*=\s*["\'\`]powershell.*?["\`]',
        r'let\s+cmd\s*=\s*["\'\`]powershell.*?["\`]',
        r'cmd\s*/?c\s+start\s+/min\s+//\s*powershell.*',
        r'cmd\s+/c\s+start\s+/min\s+powershell.*',
        r'cmd\s*/c\s+start\s+powershell.*',
        r'cmd\s+/c\s+start\s+/min\s+powershell\s+-w\s+H\s+-c.*',
        r'cmd\s+/c\s+.*powershell.*',
        r'-OutFile\s+\$env:Temp[^;\n]*;\s*&\s*["\']?\$env:Temp\\[^"\']+',
        r'powershell\s+\-encodedcommand',
        r'powershell\s+\-enc',
        r'powershell\s+\-e',
        r'C:\\WINDOWS\\system32\\WindowsPowerShell\\v1\.0\\[pP]owerShell\.exe\s.*',
        r'C:\\Windows\\system32\\cmd.exe\s+/c\s+.*powershell.*',
        r'powershell\.exe\s+-w\s+hidden\s+(?:-\w+\s+)*.*',
        r'powershell\.exe\s+-w\s+1\s+(?:-\w+\s+)*.*',
        r'powershell\.exe\s+-noprofile\s+(?:-\w+\s+)*.*',
        r'powershell\.exe\s+-ExecutionPolicy\s+[Bb]ypass\s+(?:-\w+\s+)*.*',
        r'powershell\.exe\s+-hidden\s+(?:-\w+\s+)*.*',
        r'powershell\.exe\s+-Command\s+&\s*\{.*\}',
        r'\$env:TEMP.*\.(?:txt|ps1|bat)',
        r'Join-Path\s+\$env:TEMP.*',
        r'\$\([System\.IO\.Path\]::Combine\(\$env:TEMP.*\)\)',
        r'-OutFile\s+\(\[System\.IO\.Path\]::Combine.*',
        r'C:\\Users\\.*\\AppData\\Local\\Temp\\facedetermines\.bat',
        r'http://195\.82\.147\.86/jemmy/040625-id46/facedetermines\.bat',
        r'\\\\[^\s"\'<>\)\(]+\\[^\s"\'<>\)\(]+\.(?:mp3|bat|cmd|ps1|hta)',
        r'powershell -w hidden -c',
        r'DocumentElement\.innerHTML',
        r'DownloadString',
        r'\.DownloadString',
        r'\(New-Object\s+(?:System\.)?Net\.WebClient\)\.DownloadString',
        r'IEX\s+\(New-Object\s+(?:System\.)?Net\.WebClient\)\.DownloadString',
        r'\$\w+\s*=\s*New-Object\s+(?:System\.)?Net\.WebClient;\s*\$\w+\.DownloadString'
    ]
    
    # PowerShell download patterns (used in PowerShell download detection)
    POWERSHELL_DOWNLOAD_PATTERNS = [
        r'iwr\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*iex',
        r'Invoke-WebRequest\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*Invoke-Expression',
        r'curl\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*iex',
        r'wget\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*iex',
        r'irm\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*iex',
        r'Invoke-RestMethod\s+["\']?(https?://[^"\'\)\s]+)["\']?\s*\|\s*Invoke-Expression',
        r'\(New-Object\s+(?:System\.)?Net\.WebClient\)\.DownloadString\(["\']?(https?://[^"\'\)\s]+)["\']?\)',
        r'\$\w+\s*=\s*New-Object\s+(?:System\.)?Net\.WebClient;\s*\$\w+\.DownloadString\(["\']?(https?://[^"\'\)\s]+)["\']?\)',
        r'obj\.DownloadString\(["\']?(https?://[^"\'\)\s]+)["\']?\)',
        r'\.DownloadString\(["\']?(https?://[^"\'\)\s]+)["\']?\)',
        r'["\']?(https?://[^"\'\)\s]+\.ps1)["\']?',
        r'["\']?(https?://[^"\'\)\s]+\.hta)["\']?',
        r'Invoke-WebRequest\s+(?:-Uri\s+)?["\']?(https?://[^"\'\)\s]+)["\']?\s+-OutFile\s+[^\s;"\']+',
        r'iwr\s+["\']?(https?://[^"\'\)\s]+)["\']?\s+-OutFile\s+[^\s;"\']+',
        r'Invoke-(?:WebRequest|RestMethod)\s+[^\n]*\.(?:jpg|jpeg|png|gif)\b[^\n]*-OutFile\b',
        r'iwr\s+[^\n]*\.(?:jpg|jpeg|png|gif)\b[^\n]*-OutFile\b'
    ]
    
    # JavaScript obfuscation patterns (used in JS obfuscation detection)
    JS_OBFUSCATION_PATTERNS = [
        r'var\s+_0x[a-f0-9]{4,6}\s*=',
        r'_0x[a-f0-9]{4,6}\[.*?\]',
        r'_0x[a-f0-9]{2,6}\s*=\s*function',
        r'\(function\s*\(\s*_0x[a-f0-9]{2,6}\s*,\s*_0x[a-f0-9]{2,6}\s*\)',
        r'function\s+_0x[a-f0-9]{4,8}',
        r'var\s+_0x[a-f0-9]{2,8}\s*=',
        r'let\s+_0x[a-f0-9]{2,8}\s*=',
        r'const\s+_0x[a-f0-9]{2,8}\s*=',
        r'String\.fromCharCode\.apply\(null,',
        r'\[\]\["constructor"\]\["constructor"\]',
        r'\[\]\."filter"\."constructor"\(',
        r'atob\(.*?\)\."replace"\(',
        r'\[\(![!][""]\+[""]\)\[[\d]+\]\]',
        r'\("\\"\[\"constructor"\]\("return escape"\)\(\)\+"\\"\)\[\d+\]',
        r'function\s*\(\)\s*\{\s*return\s*function\s*\(\)\s*\{\s*',
        r'new Function\(\s*[\w\s,]+\,\s*atob\s*\(',
        r'["\']((?:[A-Za-z0-9+/]{4}){20,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=))["\']',
        r'[\'"`][a-zA-Z0-9_$]{1,3}[\'"`]\s*in\s*window',
        r'window\[[\'"`][a-zA-Z0-9_$]{1,3}[\'"`]\]',
        r'eval\(function\(p,a,c,k,e,(?:r|d)?\)',
        r'eval\(function\(p,a,c,k,e,r\)',
        r'\$=~\[\];\$=\{___:\+\$,\$\$\$\$',
        r'__=\[\]\[\'fill\'\]',
        r'var\s+[a-zA-Z0-9_$]+\s*=\s*\[\s*(?:[\'"`].*?[\'"`]\s*,\s*){10,}',
        r'for\s*\(\s*var\s+[a-zA-Z0-9_$]+\s*=\s*\d+\s*;\s*[a-zA-Z0-9_$]+\s*<\s*[a-zA-Z0-9_$]+\[[\'"`]length[\'"`]\]',
        r'var\s+[a-zA-Z0-9_$]+\s*=\s*[\'"`][^\'"`]{50,}[\'"`]',
        r'function\s+([a-zA-Z0-9_$]{1,3})\s*\(\s*\)\s*{\s*var\s+[a-zA-Z0-9_$]{1,3}\s*=\s*[\'"`][0-9a-fA-F]{20,}[\'"`]',
        r'window\[[\'"`][^\'"`]+[\'"`]\]\s*=\s*window\[[\'"`][^\'"`]+[\'"`]\]\s*\|\|\s*\{\}',
        r'[a-zA-Z0-9_$]{1,3}\s*\.\s*push\s*\(\s*[a-zA-Z0-9_$]{1,3}\s*\.\s*shift\s*\(\s*\)\s*\)',
        r'[a-zA-Z0-9_$]{1,3}\[[\'"`]push[\'"`]\]',
        r'[\'"`]\\x[0-9a-fA-F]{2}\\x[0-9a-fA-F]{2}[\'"`]',
        r"while\s*\(\s*!!\s*\[\s*\]\s*\)\s*\{[\s\S]*?(?:push|\['push'\]|\[\"push\"\])\s*\(\s*[\w$]+(?:\.shift|\['shift'\]|\[\"shift\"\])",
        r'function\s+_0x[a-f0-9]{4,6}\s*\(\)\s*\{\s*var\s+_0x[a-f0-9]{4,6}\s*=\s*\[',

    ]

    RPC_ENDPOINTS = [
        'https://polygon-bor-rpc.publicnode.com',
        'https://polygon.publicnode.com',
        'https://polygon-public.nodies.app',
        'https://tenderly.rpc.polygon.community',
        'https://polygon.rpc.subquery.network',
        'https://polygon-pokt.nodies.app',
        'https://polygon.drpc.org',
        'https://polygon.api.onfinality.io',
        'https://polygon.lava.build',
        'https://rpc-mainnet.matic.quiknode.pro',
        'https://poly.api.pocket.network',
        'https://1rpc.io',
        'https://bsc-testnet-rpc.publicnode.com',
        'https://rpc.ankr.com',
        'https://polygon.gateway.tenderly.co',
        'https://gateway.tenderly.co',
    ]

    COMMON_RPC_KEYWORDS = [
        'polygon',
        'publicnode',
        'bsc',
        'testnet',
        'drpc',
        'mainnet',
        'base',
        'lava',
        'blastapi',
        'tenderly'
    ]

    # Common Etherhiding function selectors (Keccak-256 hashes for get(), code(), etc.)
    COMMON_SELECTORS = [
        "0x6d4ce63c",  # get() - Most common in ClearFake/EtherHiding
        "0x711452e6",  # orchidABI() - Multi-stage variants
        "0x59211f8f",  # orchidAddress()
        "0x8420b126",  # merlionABI()
        "0x"  # fallback empty data
    ]

    KNOWN_SELECTOR_DB = {
        "0x6d4ce63c": "get() [EtherHiding Standard]",
        "0x38bcdc1c": "get() [Polygon/ClickFix Classic]",
        "0x2b2f6ef8": "getActiveScripts() [Base/CLEARSHORT Tier-1]",
        "0xc292d37c": "getDemoPage() [Base/NoChain Tier-2]",
        "0x05bf0e9b": "isGoalReached() [ClickFix Execution Validator]",
        "0x73d4a13a": "data() [Generic Storage Getter]",
        "0xc39bc6f6": "payload() [Direct Code Warehouse]",
        "0x5825ee38": "url() [TDS Endpoint Getter]",
        "0xf81309d5": "script() [Direct JS Injector]",
    }
    
    # Clipboard manipulation patterns (used in clipboard manipulation detection)
    CLIPBOARD_PATTERNS = [
        r'navigator\.clipboard\.writeText\s*\(',
        r'document\.execCommand\s*\(\s*[\'"]copy[\'"]',
        r'clipboardData\.setData\s*\(',
        r'addEventListener\s*\(\s*[\'"]copy[\'"]',
        r'addEventListener\s*\(\s*[\'"]cut[\'"]',
        r'addEventListener\s*\(\s*[\'"]paste[\'"]',
        r'onpaste\s*=',
        r'oncopy\s*=',
        r'oncut\s*=',
        r'\$\s*\(.*\)\.clipboard\s*\(',
        r'new\s+ClipboardJS',
        r'clipboardjs',
        r'preventDefault\s*\(\s*\)\s*.*\s*copy',
        r'preventDefault\s*\(\s*\)\s*.*\s*cut',
        r'preventDefault\s*\(\s*\)\s*.*\s*paste',
        r'return\s+false\s*.*\s*copy',
        r'document\.getSelection\s*\(',
        r'window\.getSelection\s*\(',
        r'createRange\s*\(',
        r'selectNodeContents\s*\(',
        r'select\s*\(\s*\)',
        r'navigator\.clipboard\.writeText\(command\)',
        r'const\s+command\s*=.*?clipboard',
        r'const\s+commandToRun\s*='
    ]
    
    # CAPTCHA related patterns (used in CAPTCHA element detection)
    CAPTCHA_PATTERNS = [
        r'<div[^>]*class=["\']\s*(?:g-recaptcha|recaptcha|captcha-container|verification-container)["\'][^>]*>.*?</div>',
        r'<iframe[^>]*src=["\']\s*https?://(?:[^"\'>\s]*\.)?google\.com/recaptcha[^"\'>\s]*["\'][^>]*>',
        r'<iframe[^>]*src=["\']\s*[^"\'>\s]*captcha[^"\'>\s]*["\'][^>]*>',
        r'<img[^>]*src=["\']\s*[^"\'>\s]*captcha[^"\'>\s]*["\'][^>]*>',
        r'<img[^>]*src=["\']\s*[^"\'>\s]*verification[^"\'>\s]*["\'][^>]*>',
        r'<button[^>]*id=["\']\s*(?:captcha-submit|verify-captcha|human-check|verification-button)["\'][^>]*>.*?</button>',
        r'<div[^>]*id=["\']\s*(?:captcha|recaptcha|captcha-container|captcha-box|verification-box)["\'][^>]*>.*?</div>',
        r'<div[^>]*class=["\']\s*[^"\'>\s]*(?:recaptcha|captcha|verify)[^"\'>\s]*["\'][^>]*>.*?</div>',
        r'<div[^>]*class=["\']\s*(?:verify-human|robot-check|captcha-wrapper|captcha-challenge)["\'][^>]*>.*?</div>',
        r'function\s+(?:verifyCaptcha|verifyHuman|checkHuman|captchaCallback|onCaptchaSuccess)\s*\([^)]*\)\s*\{',
        r'const\s+captcha(?:Token|ID|Key|Response)\s*=',
        r'var\s+captcha(?:Token|ID|Key|Response)\s*=',
        r'function\s+on(?:Captcha|Verification)(?:Success|Complete|Done)',
        r'<[^>]*>\s*(?:I\'m not a robot|I am not a robot|Verify you are human|Human verification|Complete verification|CAPTCHA verification)\s*</[^>]*>',
        r'<[^>]*>\s*(?:Click to verify|Press to verify|Solve this CAPTCHA|Complete this challenge|Prove you\'re human)\s*</[^>]*>',
        r'<input[^>]*type=["\']\s*checkbox["\'][^>]*id=["\']\s*(?:captcha-checkbox|robot-checkbox|verification-check)["\'][^>]*>',
        r'<input[^>]*type=["\']\s*checkbox["\'][^>]*class=["\']\s*(?:captcha-checkbox|robot-checkbox|verification-check)["\'][^>]*>',
        r'<div[^>]*class=["\']\s*g-recaptcha\s*["\'][^>]*data-sitekey=["\']\s*[^"\'>\s]*["\'][^>]*></div>',
        r'data-callback=["\'](?:verifyCaptcha|captchaCallback|onCaptchaVerify|onSuccessfulCaptcha)["\']',
        r'var\s+captchaResponse\s*=\s*grecaptcha\.getResponse\(\)',
        r'function\s+[^(]*\([^)]*\)\s*\{\s*grecaptcha\.reset\(\);\s*\}'
    ]
    
    # Bot detection and sandbox evasion patterns
    BOT_DETECTION_PATTERNS = [
        r'turnstile\.js',
        r'cf-turnstile',
        r'data-sitekey=["\'].*?["\']',
        r'cloudflare-static',
        r'hcaptcha\.com',
        r'grecaptcha\.execute',
        r'cf_chl_(?:rc|prog|opt)',
        r'one-time(?:token|link|access)',
        r'function\s+detect(?:Bot|Crawler|Automation)',
        r'navigator\.webdriver',
        r'(?:document|window)\.automated',
        r'selenium',
        r'puppeteer',
        r'phantom',
        r'headless',
        r'wait\s*\(\s*[1-9][0-9]{3,}\s*\)',
        r'setTimeout\s*\(\s*function\s*\(\)\s*\{.{10,}\}\s*,\s*[1-9][0-9]{3,}\s*\)',
        # DriveSurge / zTDS victim-profiling & site-owner evasion (Silent Push, 2026)
        r'/wordpress_logged_in_/',                       # skip infecting logged-in WP admins
        r'wordpress_logged_in_[^"\'\s]*["\']?\s*\)?\s*\.test',
        r'__performance_optimizer_v\d+',                 # injected cloaking guard flag
        r'/\\?bMacintosh\\?b/i?\s*\.\s*test\s*\(\s*(?:navigator\s*\.\s*)?userAgent',  # OS-gated payload delivery
        r'if\s*\(\s*!\s*is(?:Mac|Windows)\b[^)]*\)\s*return',   # bail unless target OS
        r'is(?:Mobile|iPad|iPhone|iPod)\b[^)]*\)\s*return'      # bail on mobile (desktop-only payload)
    ]
    
    # Session hijacking and cookie theft patterns
    SESSION_HIJACKING_PATTERNS = [
        r'document\.cookie',
        r'localStorage\[[\'"](?:token|session|auth)[\'"]',
        r'sessionStorage\.',
        r'getAuthToken',
        r'__Secure-',
        r'OAuth.*token',
        r'(?:access|refresh|id)Token',
        r'extractTokens',
        r'fetch\([\'"].*?token',
        r'cookie\s*=\s*document\.cookie',
        r'new\s+Image\(\)\.src\s*=\s*["\']https?://[^"\']+["\'].*?cookie',
        r'XMLHttpRequest\(\).*?POST.*?cookie',
        r'fetch\([^)]*\)\s*.\s*then',
        r'navigator\.sendBeacon\(["\']https?://',
        r'WebSocket\(["\']wss?://'
    ]
    
    # Proxy and security tool evasion techniques
    PROXY_EVASION_PATTERNS = [
        r'\.onion',
        r'tor',
        r'proxychains',
        r'cloudfront',
        r'hxxp',
        r'\.top\/',
        r'\.xyz\/',
        r'redirect\?url=',
        r'google\.translate\.com',
        r'archive\.is',
        r'web\.archive\.org',
        r'cloudfronts?\.com',
        r'amazonaws\.com',
        r'document\.referrer\.split\(\/\/\)',
        r'navigator\.userAgent\.indexOf\(["\'](?:headless|phantom|selenium|puppeteer)',
        r'window\[btoa\(["\'](document|window|location)["\']',
        r'RegExp\(["\'](chrome|hasOwnProperty|Sequentum|webdriver)["\']',
        r'while\s*\(\s*1\s*\)\s*\{\s*debugger\s*;',
        r'debugger;for\(let \w=0;\w<\d+;\w\+\+\)',
        r'eval\(function\(\w\){return \w\[\d+\]}'
    ]
    
    # OAuth phishing detection - these patterns focus on the technique, not specific IOCs
    OAUTH_PATTERNS = [
        # OAuth endpoints with authorization flows
        (r'https?://login\.microsoftonline\.com/(?:[^/]+|common)/oauth2/(?:v2\.0/)?authorize', 'OAuth Authorization Flow'),
        
        # Any OAuth URL with suspicious state parameter (typically contains a URL)
        (r'state=https?://', 'OAuth with URL in State Parameter'),
        
        # Microsoft Graph API scope (common in OAuth phishing)
        (r'scope=https?://graph\.microsoft\.com', 'Microsoft Graph API OAuth Scope'),
        
        # OAuth Code Flow - common in phishing for capturing auth codes
        (r'response_type=code', 'OAuth Code Flow'),
        
        # Suspicious redirect URIs - focus on the pattern, not specific URLs
        (r'redirect_uri=https?://[^&]+\.(dev|net)/redirect', 'Suspicious OAuth Redirect URI'),
        
        # Visual Studio-related OAuth flows - technique, not specific client IDs
        (r'client_id=[0-9a-f-]{36}.*vscode', 'Potential Visual Studio OAuth Abuse'),
        
        # Pattern showing full OAuth URL with both code flow and redirection
        (r'https?://login\.microsoftonline\.com/.*response_type=code.*redirect_uri', 'Full OAuth Code Redirection Flow'),
        
        # Suspicious combinations in the same URL  
        (r'oauth2.*response_type=code.*state=https?', 'OAuth Code Flow with URL State'),
    ]
    
    # PowerShell standalone download patterns (without URL extraction)
    POWERSHELL_STANDALONE_DOWNLOAD_PATTERNS = [
        r'DownloadString',
        r'\.DownloadString',
        r'\(New-Object\s+(?:System\.)?Net\.WebClient\)\.DownloadString',
        r'IEX\s+\(New-Object\s+(?:System\.)?Net\.WebClient\)\.DownloadString',
        r'\$\w+\s*=\s*New-Object\s+(?:System\.)?Net\.WebClient;\s*\$\w+\.DownloadString'
    ]
    
    # HTA path patterns for detecting HTA file deployment
    HTA_PATH_PATTERNS = [
        r'const\s+htaPath\s*=\s*["\'](.+?\.hta)["\']',
        r'var\s+htaPath\s*=\s*["\'](.+?\.hta)["\']',
        r'let\s+htaPath\s*=\s*["\'](.+?\.hta)["\']'
    ]

    # conhost.exe abuse patterns (headless/proxy execution variants)
    CONHOST_EXECUTION_PATTERNS = [
        r'conhost(?:\.exe)?\s+--headless',
        r'conhost(?:\.exe)?\s+(?:--headless\s+)?(?:cmd|powershell|pwsh|curl|mshta|certutil|bitsadmin)',
        r'conhost(?:\.exe)?\s+.*?\bcmd(?:\.exe)?\s+/(?:c|k|v)',
        r'conhost(?:\.exe)?\s+.*?(?:curl|iwr|Invoke-WebRequest|DownloadString|bitsadmin)',
        r'(?:const|let|var)\s+(?:command|cmd|text)\s*=\s*["\'`].*?conhost.*?[`\'"]',
        r'navigator\.clipboard\.writeText\s*\(\s*["\'`].*?conhost.*?[`\'"]\s*\)',
        r'(?:%temp%|%appdata%|%public%|C:\\Users\\Public)\\[^\s"\'<>]+\bconhost(?:\.exe)?',
    ]
    
    # JavaScript command execution patterns
    JS_COMMAND_EXECUTION_PATTERNS = [
        r'WScript\.Shell',
        r'new\s+ActiveXObject\s*\(\s*[\'"]WScript\.Shell[\'"]',
        r'process\.spawn',
        r'child_process',
        r'exec\s*\(',
        r'execSync\s*\(',
        r'subprocess\.',
        r'system\s*\(',
        r'popen\s*\(',
        r'cmd\.exe',
        r'command\.com',
        r'powershell\.exe',
        r'\.exec\(["\'].*?[cmd|powershell]',
        r'ActiveXObject.*?wscript\.shell',
        r'Function\s*\("return.*?process'
    ]
    
    # VBScript command execution patterns
    VBS_COMMAND_PATTERNS = [
        r'Set\s+\w+\s*=\s*CreateObject\s*\(\s*"WScript\.Shell"\s*\)',
        r'<script\s+language\s*=\s*[\'"]vbscript[\'"].*?>.*?</script>',
        r'<script\s+type\s*=\s*[\'"]text/vbscript[\'"].*?>.*?</script>',
        r'\.run\s*\(',
        r'WScript\.Shell.*?\.Run',
        r'WScript\.CreateObject',
        # WinHttp VBScript patterns (ErrTraffic v2 style)
        r'CreateObject\s*\(\s*["\']WinHttp\.WinHttpRequest',
        r'CreateObject\s*\(\s*["\']MSXML2\.(?:Server)?XMLHTTP',
        r'CreateObject\s*\(\s*["\']Microsoft\.XMLHTTP',
        r'\.Open\s+["\']GET["\'].*\.Send',
        r'Execute\s+\w+\.ResponseText',
        r'ExecuteGlobal\s+\w+\.ResponseText',
        r'wscript\s+//E:VBScript',
        r'cscript\s+//E:VBScript',
    ]
    
    # Clipboard command execution patterns
    CLIPBOARD_COMMAND_PATTERNS = [
        r'navigator\.clipboard\.writeText\s*\(\s*["\']powershell',
        r'navigator\.clipboard\.writeText\s*\(\s*command\s*\)',
        r'const\s+command\s*=\s*["\']powershell[^"\']*["\']\s*;.*\s*navigator\.clipboard\.writeText',
        r'const\s+commandToRun\s*=\s*[`\'\"]powershell[^`\'\"]*[`\'\"]',
        r'commandToRun\s*;?\s*navigator\.clipboard\.writeText\s*\(',
        r'navigator\.clipboard\.writeText\s*\(\s*["\']conhost',
        r'const\s+command\s*=\s*["\']conhost[^"\']*["\']\s*;.*\s*navigator\.clipboard\.writeText',
        r'const\s+commandToRun\s*=\s*[`\'\"]conhost[^`\'\"]*[`\'\"]',
    ]
    
    # Command execution patterns for suspicious keyword detection
    SUSPICIOUS_COMMAND_PATTERNS = [
        # Command execution patterns
        r'cmd(?:\.exe)?\s+(?:/\w+\s+)*.*',
        r'command(?:\.com)?\s+(?:/\w+\s+)*.*',
        r'bash\s+-c\s+.*',
        r'sh\s+-c\s+.*',
        r'exec\s+.*',
        r'system\s*\(.*\)',
        r'exec\s*\(.*\)',
        r'eval\s*\(.*\)',
        r'execSync\s*\(.*\)',
        # Image steganography extraction hints in PowerShell/.NET
        r'Add-Type\s+-Assembly(?:Name)?\s+System\.Drawing',
        r'New-Object\s+System\.Drawing\.Bitmap',
        r'\[System\.Drawing\.Bitmap\]::new\(',
        r'GetPixel\s*\(',
        r'LockBits\s*\(',
        r'New-Object\s+System\.IO\.MemoryStream',
        r'(Get-Content|ReadAllBytes)\s+[^\n]*\.(jpg|jpeg|png)',
        r'conhost(?:\.exe)?\s+--headless.*',
        r'conhost(?:\.exe)?\s+cmd(?:\.exe)?\s+/c.*',
        r'conhost(?:\.exe)?\s+powershell.*',
    ]
    
    # CAPTCHA and human verification patterns
    CAPTCHA_VERIFICATION_PATTERNS = [
        # CAPTCHA verification patterns
        r'verification successful',
        r'human verification complete',
        r'verification code',
        r'captcha verification',
        r'verification hash',
        r'verification id',
        r'ray id',
        r'i am not a robot',
        r'i am human',
        r'verification session',
        r'verification token',
        r'security verification required',
        r'anti-bot verification',
        r'solve this captcha',
        r'complete verification',
        r'bot detection bypassed',
        r'copy this command',
        r'paste in command prompt',
        r'paste in powershell',
        r'start -> run',
        r'press\s+ctrl\s*\+\s*s',
        r'press ctrl\+c to copy',
        r'press ctrl\+v to paste',
        r'press\s+ctrl\s*\+\s*v',
        r'press\s+enter',
        r'(?:win|windows)\s*(?:key|button)\s*\+\s*r',
        r'click to verify',
        r'cloud identification',
        r'cloud identifier',
        r'complete these verification steps',
        r'follow the instructions below',
        r'recaptcha\s+id',
        r'mandatory\s+re?captcha\s+system',
        r'you will\s+(?:observe|accept)',

        # More general captcha-related patterns
        r'captcha[a-zA-Z0-9_-]*',
        r'robot(?:OrHuman)?',
        r'verification[a-zA-Z0-9_-]*',
        r'press the key combination',
        
        # Fake CAPTCHA verification keywords
        r'checking if you are human',
        r'verify you are human',
        r'cloudflare verification',
        r'to better prove you are not a robot',
        r'navigator\.clipboard\.writeText',
        r'const command =',
        r'powershell -w 1'
    ]
    
    # Suspicious JavaScript redirect patterns
    SUSPICIOUS_JS_REDIRECT_PATTERNS = [
        r'window\.location\s*=\s*["\'](https?://|\.\./|/)[^"\']+["\']',
        r'window\.location\.href\s*=\s*["\'](https?://|\.\./|/)[^"\']+["\']',
        r'window\.location\.replace\s*\(\s*["\'](https?://|\.\./|/)[^"\']+["\']\s*\)',
        r'document\.location\s*=\s*["\'](https?://|\.\./|/)[^"\']+["\']',
        r'document\.location\.href\s*=\s*["\'](https?://|\.\./|/)[^"\']+["\']',
        r'document\.location\.replace\s*\(\s*["\'](https?://|\.\./|/)[^"\']+["\']\s*\)',
        r'location\.href\s*=\s*["\'](https?://|\.\./|/)[^"\']+["\']',
        r'location\.replace\s*\(\s*["\'](https?://|\.\./|/)[^"\']+["\']\s*\)',
        r'top\.location\s*=\s*["\']https?://[^"\']+["\']',
        r'self\.location\s*=\s*["\']https?://[^"\']+["\']',
        r'parent\.location\s*=\s*["\']https?://[^"\']+["\']',
        r'window\.park\s*=',
        r'window\.__park\s*=',
        r'atob\(\s*["\'][A-Za-z0-9+/=]+["\']\s*\)',
        r'<script[^>]*src\s*=\s*["\'][^"\']*\.[a-zA-Z0-9]{5,}\.js["\']',
        r'<iframe[^>]*src\s*=\s*["\']about:blank["\'][^>]*></iframe>',
        r'<meta[^>]*http-equiv\s*=\s*["\']refresh["\'][^>]*content\s*=\s*["\']0;\s*URL=',
        r'function\s*redirect\s*\([^\)]*\)\s*{\s*(?:window|document|self|top|parent)\.location',
        r'setTimeout\s*\(\s*function\s*\(\s*\)\s*{\s*(?:window|document)\.location',
        r'decodeURIComponent\(escape\(atob\(',
        r'\.exec\s*\(\s*atob\s*\(',
        r'JSON\.parse\s*\(\s*atob\s*\(',
        r'\.split\s*\(\s*["\'][^"\']+["\']\s*\)\.join\s*\(\s*["\'][^"\']*["\']\s*\)',
        r'fromCharCode\.apply\s*\(\s*null',
        r'charCodeAt\s*\(\s*\d+\s*\)\s*\^\s*\d+',
        r'charCodeAt\s*\(\s*\d+\s*\)\s*[+-]\s*\d+',
        r'\[\s*["\']\w+["\']\s*\]\s*\[\s*["\']\w+["\']\s*\]',
        r'</body>\s*<script[^>]*></script>$',
        r'eval\s*\(\s*\w+\[\s*["\']\w+["\']\s*\]\s*\+\s*\w+\[\s*["\']\w+["\']\s*\]\s*\)'
    ]

    @classmethod
    def combine_patterns_with_risk(cls, pattern_list: List[str], default_risk: str = CommandRiskLevel.MEDIUM.value) -> List[Tuple[str, str]]:
        """Combine patterns and assign risk levels dynamically based on content.
        
        Args:
            pattern_list: List of regex patterns
            default_risk: Default risk level to assign
            
        Returns:
            List of tuples containing (pattern, risk_level)
        """
        result = []
        
        for pattern in pattern_list:
            # Assign HIGH risk for dangerous PowerShell indicators
            if any(indicator in pattern.lower() for indicator in cls.DANGEROUS_PS_INDICATORS):
                result.append((pattern, CommandRiskLevel.HIGH.value))
            # Assign HIGH risk for evasion techniques
            elif any(evasion in pattern.lower() for evasion in ['hidden', 'bypass', '-w 1', '-noprofile']):
                result.append((pattern, CommandRiskLevel.HIGH.value))
            # Assign CRITICAL risk for certain dangerous commands
            elif any(critical in pattern.lower() for critical in ['iex', 'invoke-expression', 'frombase64string', 'downloadstring']):
                result.append((pattern, CommandRiskLevel.CRITICAL.value))
            else:
                result.append((pattern, default_risk))
                
        return result


class Base64Result(BaseModel):
    """A decoded Base64 string with both original and decoded content."""
    Base64: str = Field(..., description="The original Base64 encoded string")
    Decoded: str = Field(..., description="The decoded content of the Base64 string")
    
    model_config = ConfigDict(frozen=True)
    
    @computed_field
    def Length(self) -> int:
        """Get the length of the Base64 string."""
        return len(self.Base64)

    @computed_field
    def ContainsEtherhiding(self) -> bool:
        """Check if the decoded content contains Etherhiding indicators."""
        return any(indicator.lower() in self.Decoded.lower()
                   for indicator in chain(CommonPatterns.RPC_ENDPOINTS, CommonPatterns.KNOWN_SELECTOR_DB)
        )

    @computed_field
    def ContainsPowerShell(self) -> bool:
        """Check if the decoded content contains PowerShell indicators."""
        return any(indicator.lower() in self.Decoded.lower() 
                   for indicator in ["powershell", "iex", "invoke-expression", "-enc"])
    
    @computed_field
    def ContainsBenignURL(self) -> bool:
        """Check if the decoded content contains only benign URLs."""
        decoded_lower = self.Decoded.lower()
        
        # Check if any benign URL is present in the decoded content
        has_benign_url = any(pattern in decoded_lower for pattern in CommonPatterns.BENIGN_URL_STRINGS)
        
        # Check for absence of suspicious patterns
        has_suspicious = any(term in decoded_lower for term in CommonPatterns.SUSPICIOUS_TERMS)
        
        # Return true if has benign URL and no suspicious patterns
        return has_benign_url and not has_suspicious


class PowerShellDownload(BaseModel):
    """A PowerShell download command with context and target information."""
    FullMatch: str = Field(..., description="The full matching text that was detected")
    URL: Optional[str] = Field(None, description="The URL being downloaded from, if found")
    Context: str = Field(..., description="Context surrounding the download command")
    HTAPath: Optional[str] = Field(None, description="Path to HTA file, if applicable")
    
    @computed_field
    def IsPotentiallyDangerous(self) -> bool:
        """Check if this download appears particularly dangerous."""
        return any(indicator in self.FullMatch.lower() 
                   for indicator in CommonPatterns.DANGEROUS_PS_INDICATORS)
    
    @computed_field
    def RiskLevel(self) -> str:
        """Determine risk level based on content."""
        if self.URL and any(ext in self.URL.lower() for ext in ['.ps1', '.exe', '.bat', '.hta']):
            return CommandRiskLevel.HIGH.value
        elif self.IsPotentiallyDangerous:
            return CommandRiskLevel.HIGH.value
        else:
            return CommandRiskLevel.MEDIUM.value


class SuspiciousCommand(BaseModel):
    """A suspicious command detected in the analysis."""
    Command: str = Field(..., description="The suspicious command that was detected")
    CommandType: str = Field(..., description="Classification of the command type")
    Source: Optional[str] = Field(None, description="Where the command was found")
    RiskLevel: str = Field(CommandRiskLevel.MEDIUM.value, description="Risk level of the command")
    
    @field_validator('CommandType', mode='before')
    @classmethod
    def convert_command_type(cls, v):
        """Convert CommandType enum to string value if needed."""
        if isinstance(v, CommandType):
            return v.value
        return v
    
    @field_validator('RiskLevel', mode='before')
    @classmethod
    def convert_risk_level(cls, v):
        """Convert RiskLevel enum to string value if needed."""
        if isinstance(v, CommandRiskLevel):
            return v.value
        return v
    
    @computed_field
    def is_high_risk(self) -> bool:
        """Check if this is a high-risk command."""
        return CommandRiskLevel.HIGH.value in self.RiskLevel or CommandRiskLevel.CRITICAL.value in self.RiskLevel

class EtherhidingResult(BaseModel):
    MaliciousUrls: Set[str] = Field(..., description="Malicious URLs detected")
    RawScript: str = Field(..., description="Raw deobfuscated and decoded script containing Etherhiding")
    Stage: int = Field(..., description="Clickfix stage levels")
    SmartContract: str = Field(..., description="Smart contract detected")
    RPC: str = Field(..., description="RPC endpoint detected")
    FunctionSelector: str = Field(..., description="Function selector detected")
    Payload: str = Field(..., description="Encoded payload identified")
    DecodedPayload: str = Field(..., description="Decoded payload identified")

class EncodedPowerShellResult(BaseModel):
    """An encoded PowerShell command with its decoded content."""
    EncodedCommand: str = Field(..., description="The Base64 encoded command")
    DecodedCommand: str = Field(..., description="The decoded PowerShell command")
    FullMatch: str = Field(..., description="The full text match containing the encoded command")
    
    @computed_field
    def HasSuspiciousContent(self) -> bool:
        """Check if the decoded command has suspicious content."""
        decoded_lower = self.DecodedCommand.lower()
        return any(term in decoded_lower for term in CommonPatterns.DANGEROUS_PS_INDICATORS) or \
               any(term in decoded_lower for term in ["http", "ftp", "url", ".exe", ".ps1", ".bat", ".hta"])
    
    @computed_field
    def RiskLevel(self) -> str:
        """Determine risk level of the encoded PowerShell."""
        if self.HasSuspiciousContent:
            return CommandRiskLevel.HIGH.value
        return CommandRiskLevel.MEDIUM.value


class ClickGrabConfig(BaseModel):
    """Configuration for ClickGrab URL analyzer."""
    analyze: Optional[str] = Field(None, description="URL to analyze or path to a file containing URLs")
    limit: Optional[int] = Field(None, description="Limit the number of URLs to process")
    debug: bool = Field(False, description="Enable debug output")
    output_dir: str = Field("reports", description="Directory for report output")
    format: str = Field(ReportFormat.ALL.value, description="Report format")
    tags: List[str] = Field(default_factory=lambda: ["FakeCaptcha", "ClickFix", "click"], 
                                     description="List of tags to filter by")
    download: bool = Field(False, description="Download and analyze URLs from URLhaus")
    otx: bool = Field(False, description="Download and analyze URLs from AlienVault OTX")
    days: int = Field(30, description="Number of days to look back in AlienVault OTX")
    export_intel: bool = Field(False, description="Generate focused threat intel exports (clipboard commands, download cradles, lure variants)")
    include_raw_html: bool = Field(False, description="Include full RawHTML in JSON report. Off by default — adds ~1-2 MB per scanned site and the static site never reads it. Streamlit live scans get RawHTML from in-memory results regardless.")
    clickfix_gist: bool = Field(False, description="Download and analyze domains from the ClickFix gist feed")
    clickfix_gist_id: Optional[str] = Field(
        None,
        description="Override the GitHub Gist ID for the ClickFix feed (default: 9f563dfb78a06fad5db794f33ba93a3f)"
    )

    @field_validator('limit')
    @classmethod
    def check_limit(cls, v):
        """Validate the URL limit."""
        if v is not None and v <= 0:
            raise ValueError("Limit must be greater than 0")
        return v
    
    @field_validator('days')
    @classmethod
    def check_days(cls, v):
        """Validate the number of days."""
        if v <= 0:
            raise ValueError("Days must be greater than 0")
        if v > 90:
            raise ValueError("Days cannot exceed 90")
        return v

    @field_validator('clickfix_gist_id')
    @classmethod
    def validate_clickfix_gist_id(cls, v):
        """Ensure the ClickFix gist ID is valid if provided."""
        if v is None:
            return v
        # Basic validation: gist IDs are hexadecimal strings
        if not v or not all(c in '0123456789abcdef' for c in v.lower()):
            raise ValueError("ClickFix gist ID must be a valid hexadecimal string")
        return v
    
    @field_validator('tags', mode='before')
    @classmethod
    def parse_tags(cls, v):
        """Parse tags from string or list."""
        if v is None:
            return ["FakeCaptcha", "ClickFix", "click"]
        if isinstance(v, str):
            return [t.strip() for t in v.split(',')]
        return v
    
    @field_validator('format', mode='before')
    @classmethod
    def validate_format(cls, v):
        """Validate and convert the report format."""
        if isinstance(v, ReportFormat):
            return v.value
        
        if isinstance(v, str):
            try:
                return ReportFormat(v.lower()).value
            except ValueError:
                raise ValueError(f"Invalid format: {v}. Must be one of: {', '.join([f.value for f in ReportFormat])}")
        return v

class Base64XoredJavaScriptResult(BaseModel):
    ScriptContent: str = Field(..., description="Script tag extracted from HTML")
    MatchedBase64: str = Field(..., description="Base64 encoded string extracted from JS script")
    MatchedXOROperation: str = Field(..., description="XOR operation extracted from JS script")
    XORKey: str = Field(..., description="XOR key extracted from JS script")
    DecodedBase64: str = Field(..., description="Decoded Base64")
    DecryptedText: str = Field(..., description="Decoded Base64 XOR-decrypted by using XOR key")


class JavaScriptRedirectChain(BaseModel):
    """Details about a detected JavaScript redirect chain."""
    ScriptURL: str = Field(..., description="URL of the JavaScript file containing the redirect")
    RedirectType: str = Field(..., description="Type of redirect construct that was detected")
    DestinationURL: str = Field(..., description="Destination URL extracted from the redirect chain")
    Evidence: str = Field(..., description="Snippet of code or decoded payload illustrating the redirect")


class RedirectFollow(BaseModel):
    """A redirect captured via the redirect follower."""
    Source: str = Field(..., description="Location where the redirect was found (inline, external, meta)")
    Method: str = Field(..., description="Type of redirect pattern detected")
    OriginalURL: str = Field(..., description="Original URL referenced in the content")
    FinalURL: Optional[str] = Field(None, description="Final URL after a shallow follow attempt")
    RedirectChain: List[str] = Field(default_factory=list, description="Intermediate URLs captured during follow")
    ScriptURL: Optional[str] = Field(None, description="Script or element that referenced the URL")
    Evidence: str = Field(..., description="Snippet of code or markup containing the redirect")
    Status: str = Field(..., description="Status of the follow attempt")
    FetchedSnippet: Optional[str] = Field(None, description="Small snippet of the fetched content when available")


class AnalysisResult(BaseModel):
    """Results of analyzing a URL for malicious content."""
    URL: str = Field(..., description="The analyzed URL")
    RawHTML: str = Field(..., description="Raw HTML content from the URL")
    Base64Strings: List[Base64Result] = Field(default_factory=list, description="Base64 encoded strings found")
    URLs: List[str] = Field(default_factory=list, description="URLs found in the content")
    PowerShellCommands: List[str] = Field(default_factory=list, description="PowerShell commands found")
    MshtaCommands: List[str] = Field(default_factory=list, description="mshta commands found")
    ConhostCommands: List[str] = Field(default_factory=list, description="Conhost commands found")
    EncodedPowerShell: List[EncodedPowerShellResult] = Field(default_factory=list, description="Encoded PowerShell commands found")
    IPAddresses: List[str] = Field(default_factory=list, description="IP addresses found in the content")
    ClipboardCommands: List[str] = Field(default_factory=list, description="Commands related to clipboard manipulation")
    SuspiciousKeywords: List[str] = Field(default_factory=list, description="Suspicious keywords found")
    ClipboardManipulation: List[str] = Field(default_factory=list, description="JavaScript code manipulating clipboard")
    PowerShellDownloads: List[PowerShellDownload] = Field(default_factory=list, description="PowerShell download commands")
    CaptchaElements: List[str] = Field(default_factory=list, description="CAPTCHA-related HTML elements")
    ObfuscatedJavaScript: List[str] = Field(default_factory=list, description="Potentially obfuscated JavaScript")
    EtherhidingJavaScript: List[EtherhidingResult] = Field(default_factory=list, description="Potentially JavaScript that contacts BlockChains")
    SuspiciousCommands: List[SuspiciousCommand] = Field(default_factory=list, description="Suspicious commands detected")
    BotDetection: List[str] = Field(default_factory=list, description="Bot detection and sandbox evasion techniques")
    SessionHijacking: List[str] = Field(default_factory=list, description="Session token or cookie theft attempts")
    ProxyEvasion: List[str] = Field(default_factory=list, description="Proxy/security tool evasion techniques")
    JavaScriptRedirects: List[str] = Field(default_factory=list, description="Suspicious JavaScript redirects and loaders")
    Base64XoredJavaScript: List[Base64XoredJavaScriptResult] = Field(default_factory=list, description="Base64 and XOR JavaScript detected")
    JavaScriptRedirectChains: List[JavaScriptRedirectChain] = Field(
        default_factory=list,
        description="Redirect chains identified from external JavaScript files",
    )
    RedirectFollows: List[RedirectFollow] = Field(
        default_factory=list,
        description="Redirects resolved via redirect follower including inline scripts",
    )
    ParkingPageLoaders: List[str] = Field(default_factory=list, description="Parking page loaders with window.park patterns")
    FakeVideoConferencing: List[str] = Field(default_factory=list, description="Fake video conferencing indicators (Google Meet, Teams, Zoom)")
    ClickFixInstructions: List[str] = Field(default_factory=list, description="ClickFix social engineering instructions (Win+R, Ctrl+V, Enter)")
    SteganographyIndicators: List[str] = Field(default_factory=list, description="Steganography and cache smuggling indicators")
    FakeWindowsUpdate: List[str] = Field(default_factory=list, description="Fake Windows Update indicators")
    FakeCloudflare: List[str] = Field(default_factory=list, description="Fake Cloudflare verification page indicators")
    HeavyObfuscation: List[str] = Field(default_factory=list, description="Heavy JavaScript obfuscation indicators")
    # New Dec 2025 threat indicators
    MacOSTerminalCommands: List[str] = Field(default_factory=list, description="macOS Terminal commands (curl|bash, osascript)")
    SharedAIChatLinks: List[str] = Field(default_factory=list, description="Shared AI chat links (ChatGPT, Grok) used for malware distribution")
    WinHttpVBScript: List[str] = Field(default_factory=list, description="WinHttp VBScript payload patterns (ErrTraffic style)")
    FakeGlitchLures: List[str] = Field(default_factory=list, description="Fake glitch/broken website lure patterns")
    HexEncodedIPs: List[str] = Field(default_factory=list, description="Hex-encoded IP addresses used to evade detection")
    # New 2026 threat indicators
    DNSClickFix: List[str] = Field(default_factory=list, description="DNS-based ClickFix patterns (nslookup to attacker DNS)")
    WindowsTerminalClickFix: List[str] = Field(default_factory=list, description="Windows Terminal (wt.exe) ClickFix patterns")
    WebDAVClickFix: List[str] = Field(default_factory=list, description="WebDAV net use ClickFix patterns")
    FingerExeAbuse: List[str] = Field(default_factory=list, description="finger.exe abuse (CrashFix variant)")
    ConsentFixIndicators: List[str] = Field(default_factory=list, description="ConsentFix OAuth token theft patterns")
    FakeSoftwareDownloads: List[str] = Field(default_factory=list, description="Fake software download site indicators")
    LLMArtifactAbuse: List[str] = Field(default_factory=list, description="LLM/AI artifact abuse for malware distribution")
    # 2026 additions (DriveSurge / zTDS — Silent Push)
    TDSInjection: List[str] = Field(default_factory=list, description="Traffic Distribution System (zTDS/DriveSurge) injected-loader signatures")
    FakeBrowserUpdate: List[str] = Field(default_factory=list, description="Fake browser update (FakeUpdates) lure indicators")

    @field_validator('URLs')
    @classmethod
    def validate_urls(cls, v):
        """Filter out common benign URLs."""
        return [url for url in v if not any(re.match(pattern, url) for pattern in CommonPatterns.BENIGN_URL_PATTERNS)]

    # Note: We don't truncate data in the model to preserve full analysis in JSON/CSV
    # Truncation for HTML display happens in the template rendering
    
    @computed_field
    def TotalIndicators(self) -> int:
        """Calculate the total number of indicators found."""
        return (
            len(self.Base64Strings) +
            len(self.URLs) +
            len(self.PowerShellCommands) +
            len(self.MshtaCommands) +
            len(self.ConhostCommands) +
            len(self.EncodedPowerShell) +
            len(self.IPAddresses) +
            len(self.ClipboardCommands) +
            len(self.SuspiciousKeywords) +
            len(self.ClipboardManipulation) +
            len(self.PowerShellDownloads) +
            len(self.CaptchaElements) +
            len(self.ObfuscatedJavaScript) +
            len(self.EtherhidingJavaScript) +
            len(self.SuspiciousCommands) +
            len(self.BotDetection) +
            len(self.SessionHijacking) +
            len(self.ProxyEvasion) +
            len(self.JavaScriptRedirects) +
            len(self.Base64XoredJavaScript) +
            len(self.JavaScriptRedirectChains) +
            len(self.RedirectFollows) +
            len(self.ParkingPageLoaders) +
            len(self.FakeVideoConferencing) +
            len(self.ClickFixInstructions) +
            len(self.SteganographyIndicators) +
            len(self.FakeWindowsUpdate) +
            len(self.FakeCloudflare) +
            len(self.HeavyObfuscation) +
            # Dec 2025 additions
            len(self.MacOSTerminalCommands) +
            len(self.SharedAIChatLinks) +
            len(self.WinHttpVBScript) +
            len(self.FakeGlitchLures) +
            len(self.HexEncodedIPs) +
            # 2026 additions
            len(self.DNSClickFix) +
            len(self.WindowsTerminalClickFix) +
            len(self.WebDAVClickFix) +
            len(self.FingerExeAbuse) +
            len(self.ConsentFixIndicators) +
            len(self.FakeSoftwareDownloads) +
            len(self.LLMArtifactAbuse) +
            len(self.TDSInjection) +
            len(self.FakeBrowserUpdate)
        )
    
    @computed_field
    def Verdict(self) -> str:
        """Determine if the URL is suspicious based on indicators."""
        # Check for PowerShell commands (filtered to remove false positives)
        filtered_powershell_commands = [
            cmd for cmd in self.PowerShellCommands 
            if not (cmd.startswith('http') and 
                   not any(term in cmd.lower() for term in ['powershell', 'cmd', 'iex', 'iwr', 'invoke', '.ps1', '.bat', '.hta']))
        ]
        
        if filtered_powershell_commands:
            return AnalysisVerdict.SUSPICIOUS.value

        # Check for Mshta commands
        if self.MshtaCommands:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.ConhostCommands:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for suspicious Base64 strings
        suspicious_base64 = [
            b64 for b64 in self.Base64Strings 
            if b64.ContainsPowerShell and not b64.ContainsBenignURL
        ]
        if suspicious_base64:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for clipboard manipulation with commands
        if self.ClipboardManipulation and self.ClipboardCommands:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for PowerShell downloads
        if self.PowerShellDownloads:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for encoded PowerShell
        if self.EncodedPowerShell:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for suspicious commands
        if self.SuspiciousCommands:
            # Specifically check for high-risk commands
            high_risk_commands = [cmd for cmd in self.SuspiciousCommands 
                                 if cmd.is_high_risk]
            if high_risk_commands:
                return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for obfuscated JavaScript
        if self.ObfuscatedJavaScript:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.EtherhidingJavaScript:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for fake video conferencing (Google Meet, Teams, Zoom ClickFix)
        if self.FakeVideoConferencing:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for ClickFix instructions (Win+R, Ctrl+V, Enter)
        if self.ClickFixInstructions:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for steganography/cache smuggling indicators
        if self.SteganographyIndicators:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for fake Windows Update screens
        if self.FakeWindowsUpdate and len(self.FakeWindowsUpdate) >= 2:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for fake Cloudflare verification pages
        if self.FakeCloudflare and len(self.FakeCloudflare) >= 2:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for heavy JS obfuscation (strong indicator of malicious intent)
        if self.HeavyObfuscation and len(self.HeavyObfuscation) >= 3:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for macOS terminal commands (curl|bash is extremely dangerous)
        if self.MacOSTerminalCommands:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for shared AI chat links (common in AMOS distribution)
        if self.SharedAIChatLinks:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for WinHttp VBScript patterns (ErrTraffic toolkit)
        if self.WinHttpVBScript:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for fake glitch lures
        if self.FakeGlitchLures and len(self.FakeGlitchLures) >= 2:
            return AnalysisVerdict.SUSPICIOUS.value
        
        # Check for hex-encoded IPs
        if self.HexEncodedIPs:
            return AnalysisVerdict.SUSPICIOUS.value

        # Check for 2026 ClickFix variants
        if self.DNSClickFix:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.WindowsTerminalClickFix:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.WebDAVClickFix:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.FingerExeAbuse:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.ConsentFixIndicators:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.FakeSoftwareDownloads and len(self.FakeSoftwareDownloads) >= 2:
            return AnalysisVerdict.SUSPICIOUS.value

        if self.LLMArtifactAbuse:
            return AnalysisVerdict.SUSPICIOUS.value

        # DriveSurge / zTDS injection-loader signatures are specific enough to flag on one hit
        if self.TDSInjection:
            return AnalysisVerdict.SUSPICIOUS.value

        # Fake browser-update lures need corroboration to avoid flagging legit update notices
        if self.FakeBrowserUpdate and len(self.FakeBrowserUpdate) >= 2:
            return AnalysisVerdict.SUSPICIOUS.value

        # Check for at least 2 of the following:
        indicators = 0
        
        if self.CaptchaElements:
            indicators += 1
        
        if any("captcha" in kw.lower() for kw in self.SuspiciousKeywords):
            indicators += 1
        
        if any("robot" in kw.lower() for kw in self.SuspiciousKeywords):
            indicators += 1
        
        if any("verify" in kw.lower() for kw in self.SuspiciousKeywords):
            indicators += 1
        
        if self.ClipboardManipulation:
            indicators += 1
        
        if indicators >= 2:
            return AnalysisVerdict.SUSPICIOUS.value
            
        return AnalysisVerdict.LIKELY_SAFE.value
    
    @computed_field
    def HighRiskCommands(self) -> List[SuspiciousCommand]:
        """Get only high-risk commands."""
        return [cmd for cmd in self.SuspiciousCommands if cmd.is_high_risk]
    
    @computed_field
    def ThreatScore(self) -> int:
        """Calculate a threat score based on the indicators found."""
        score = 0
        
        # Add points for Base64 strings, with extra for those containing PowerShell
        for b64 in self.Base64Strings:
            score += 5
            if b64.ContainsPowerShell:
                score += 15
                
        # Add points for PowerShell commands
        score += len(self.PowerShellCommands) * 10

        # Add points for Mshta commands
        score += len(self.MshtaCommands) * 10
        
        # Add points for encoded PowerShell
        for encoded_ps in self.EncodedPowerShell:
            base_points = 15
            if encoded_ps.HasSuspiciousContent:
                base_points += 15
            if CommandRiskLevel.HIGH.value in encoded_ps.RiskLevel:
                base_points += 20
            elif CommandRiskLevel.MEDIUM.value in encoded_ps.RiskLevel:
                base_points += 10
            score += base_points
        
        # Add points for PowerShell downloads
        for download in self.PowerShellDownloads:
            base_points = 15
            if CommandRiskLevel.HIGH.value in download.RiskLevel:
                base_points += 15
            elif CommandRiskLevel.MEDIUM.value in download.RiskLevel:
                base_points += 10
            score += base_points
        
        # Add points for SuspiciousCommands
        for cmd in self.SuspiciousCommands:
            if cmd.RiskLevel == CommandRiskLevel.HIGH.value:
                score += 20
            elif cmd.RiskLevel == CommandRiskLevel.MEDIUM.value:
                score += 10
            else:
                score += 5
        
        # Add points for various other indicators
        score += len(self.ClipboardManipulation) * 15
        score += len(self.ClipboardCommands) * 15
        score += len(self.CaptchaElements) * 5
        score += len(self.ObfuscatedJavaScript) * 10
        score += len(self.EtherhidingJavaScript) * 10
        score += len(self.SuspiciousKeywords) * 3
        score += len(self.IPAddresses) * 2
        score += len(self.URLs) * 1
        
        # Add points for newer extraction types
        score += len(self.BotDetection) * 5
        score += len(self.SessionHijacking) * 15
        score += len(self.ProxyEvasion) * 10
        score += len(self.JavaScriptRedirects) * 15
        score += len(self.Base64XoredJavaScript) * 10
        score += len(self.JavaScriptRedirectChains) * 20
        score += len(self.RedirectFollows) * 20
        score += len(self.ParkingPageLoaders) * 25  # Add high score for parking page loaders
        
        # Add points for new November 2025 threat indicators
        score += len(self.FakeVideoConferencing) * 30  # High score - strong ClickFix indicator
        score += len(self.ClickFixInstructions) * 35   # Very high - direct ClickFix evidence
        score += len(self.SteganographyIndicators) * 25  # High - advanced technique
        score += len(self.FakeWindowsUpdate) * 20  # Medium-high - common ClickFix variant
        score += len(self.FakeCloudflare) * 35  # Very high - impersonating security service
        score += len(self.HeavyObfuscation) * 30  # High - indicates malicious intent
        
        # Add points for December 2025 threat indicators
        score += len(self.MacOSTerminalCommands) * 40  # Very high - curl|bash is extremely dangerous
        score += len(self.SharedAIChatLinks) * 35  # High - common AMOS distribution vector
        score += len(self.WinHttpVBScript) * 40  # Very high - ErrTraffic toolkit patterns
        score += len(self.FakeGlitchLures) * 25  # Medium-high - social engineering lure
        score += len(self.HexEncodedIPs) * 35  # High - evasion technique

        # Add points for 2026 threat indicators
        score += len(self.DNSClickFix) * 40          # Very high - novel C2 channel
        score += len(self.WindowsTerminalClickFix) * 35  # High - elevated execution context
        score += len(self.WebDAVClickFix) * 45       # Very high - fileless execution from remote share
        score += len(self.FingerExeAbuse) * 40       # Very high - LOLBin abuse
        score += len(self.ConsentFixIndicators) * 35  # High - credential theft
        score += len(self.FakeSoftwareDownloads) * 25  # Medium-high - social engineering
        score += len(self.LLMArtifactAbuse) * 30     # High - AI platform abuse

        # DriveSurge / zTDS (2026)
        score += len(self.TDSInjection) * 30         # High - compromised-site TDS loader injection
        score += len(self.FakeBrowserUpdate) * 20    # Medium-high - FakeUpdates social engineering

        return score


class AnalysisReport(BaseModel):
    """Consolidated report from multiple URL analyses."""
    timestamp: str = Field(..., description="Time the report was generated")
    total_sites_analyzed: int = Field(..., description="Total number of sites analyzed")
    summary: Dict[str, int] = Field(..., description="Summary statistics of findings")
    sites: List[AnalysisResult] = Field(..., description="Analysis results for each site")
    
    @field_validator('timestamp', mode='before')
    @classmethod
    def validate_timestamp(cls, v):
        """Ensure timestamp is in the correct format."""
        if isinstance(v, datetime):
            return v.strftime("%Y-%m-%d %H:%M:%S")
        return v
    
    @computed_field
    def suspicious_sites_percentage(self) -> float:
        """Calculate percentage of suspicious sites."""
        if self.total_sites_analyzed == 0:
            return 0.0
        suspicious_count = sum(1 for site in self.sites if site.Verdict == AnalysisVerdict.SUSPICIOUS.value)
        return round((suspicious_count / self.total_sites_analyzed) * 100, 2)
    
    @computed_field
    def report_date(self) -> str:
        """Get the report date in YYYY-MM-DD format."""
        if '-' in self.timestamp and ' ' in self.timestamp:
            return self.timestamp.split(' ')[0]
        return self.timestamp.split(' ')[0] 
    
    @computed_field
    def high_risk_commands_count(self) -> int:
        """Get the total count of high-risk commands across all sites."""
        return sum(len(site.HighRiskCommands) for site in self.sites)


class ProxyUrl(BaseModel):
    proxies: Dict[str, str]