{"service":"ThickClientStatic","no_auth":true,"rules":79,"checks":[{"code":"passwd-map-pass","title":"Hard-coded password assignment","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A password value assigned in an apparent assignment context."},{"code":"passwd-conf-file","title":"Password in config/property file","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A credential-like value appears where a config sets a password."},{"code":"hardcoded-username","title":"Hard-coded username","category":"Secrets & Credentials","severity":"medium","cwe":"CWE-798","description":"An account name is embedded in the binary."},{"code":"aws-access-key","title":"AWS Access Key ID detected","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"An AWS access key ID (AKIA/ASIA) is present."},{"code":"aws-secret-key","title":"AWS secret likely","category":"Secrets & Credentials","severity":"critical","cwe":"CWE-798","description":"An AWS-style secret access key value is embedded."},{"code":"azure-acct-key","title":"Azure storage account key","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"An Azure storage account key appears inline."},{"code":"gcp-sa-key","title":"GCP service-account key","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"Google service-account credential material is embedded."},{"code":"github-token","title":"GitHub token","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A GitHub personal access token pattern was found."},{"code":"openai-key","title":"OpenAI API key","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"An OpenAI-style API key (sk-...) was found."},{"code":"stripe-key","title":"Stripe API key","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Stripe API secret key was found."},{"code":"jwt-secret","title":"JWT token or HS256 secret","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A JSON Web Token signature structure was detected."},{"code":"rsa-private","title":"Embedded RSA/PEM private key","category":"Secrets & Credentials","severity":"critical","cwe":"CWE-798","description":"A private key material block is present in plaintext."},{"code":"pgp-private","title":"Embedded PGP private key","category":"Secrets & Credentials","severity":"critical","cwe":"CWE-798","description":"A PGP private key block is embedded."},{"code":"oauth-secret","title":"OAuth client secret","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"An OAuth client secret is hard-coded."},{"code":"sendgrid-key","title":"SendGrid API key","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A SendGrid API key was found."},{"code":"twilio-token","title":"Twilio auth token","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Twilio auth token was found."},{"code":"slack-token","title":"Slack token","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Slack workspace/bot/app token pattern was found."},{"code":"discord-token","title":"Discord bot token","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Discord-style bot token pattern was found."},{"code":"generic-api-key","title":"Generic high-entropy API key","category":"Secrets & Credentials","severity":"medium","cwe":"CWE-798","description":"A generic key named api-key/secret/token is assigned a long literal."},{"code":"mysql-creds","title":"MySQL/JDBC credentials in URI","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A database URI embeds a password before the @ host."},{"code":"mongo-creds","title":"MongoDB URI with credentials","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Mongo connection string includes credentials."},{"code":"redis-cred","title":"Redis URL with password","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"A Redis URL contains an embedded password."},{"code":"conn-string","title":"ADODB/ODBC connection string secret","category":"Secrets & Credentials","severity":"high","cwe":"CWE-798","description":"An ODBC/ADO connection string carries a password token."},{"code":"webhook-token","title":"Webhook URL with secret token","category":"Secrets & Credentials","severity":"medium","cwe":"CWE-798","description":"A webhook URL with a path-based secret was found."},{"code":"google-api-key","title":"Google API key","category":"Secrets & Credentials","severity":"medium","cwe":"CWE-798","description":"A Google Maps/API key was found."},{"code":"crypto-md5","title":"MD5 (weak hash)","category":"Weak Cryptography","severity":"medium","cwe":"CWE-327","description":"Use of the deprecated MD5 hash."},{"code":"crypto-sha1","title":"SHA-1 (weak hash)","category":"Weak Cryptography","severity":"medium","cwe":"CWE-327","description":"Use of the deprecated SHA-1 hash."},{"code":"crypto-rc4","title":"RC4 stream cipher","category":"Weak Cryptography","severity":"high","cwe":"CWE-327","description":"RC4 is cryptographically broken."},{"code":"crypto-des","title":"DES / 3DES block cipher","category":"Weak Cryptography","severity":"high","cwe":"CWE-327","description":"DES/3DES are unapproved legacy ciphers."},{"code":"crypto-ecb-mode","title":"ECB cipher mode","category":"Weak Cryptography","severity":"high","cwe":"CWE-327","description":"ECB mode leaks patterns and is discouraged."},{"code":"crypto-hard-iv","title":"Hard-coded IV/nonce","category":"Weak Cryptography","severity":"high","cwe":"CWE-329","description":"A fixed initialization vector is likely reused."},{"code":"crypto-hard-key","title":"Hard-coded encryption key","category":"Weak Cryptography","severity":"critical","cwe":"CWE-321","description":"An encryption key literal is embedded."},{"code":"crypto-weak-random","title":"Insecure PRNG (java.util.Random/Math.random/rand)","category":"Weak Cryptography","severity":"medium","cwe":"CWE-338","description":"Predictable pseudo-random generator used for security decisions."},{"code":"crypto-md5-unsalted-hash","title":"Unsalted fast hash for passwords","category":"Weak Cryptography","severity":"high","cwe":"CWE-916","description":"A password is hashed with a fast, unsalted algorithm."},{"code":"pe-virtualprotect","title":"VirtualProtect (RWX / page hardening bypass)","category":"Dangerous Functions","severity":"high","cwe":"CWE-749","description":"VirtualProtect can mark memory executable."},{"code":"pe-virtualalloc-exec","title":"VirtualAllocExec style self-modification","category":"Dangerous Functions","severity":"high","cwe":"CWE-749","description":"Dynamic memory allocation; executable if combined with exec."},{"code":"pe-injection","title":"Process injection APIs","category":"Dangerous Functions","severity":"critical","cwe":"CWE-749","description":"Snippets indicative of process/thread injection."},{"code":"pe-rundll-loadlibrary","title":"Dynamic LoadLibrary / GetProcAddress resolution","category":"Dangerous Functions","severity":"medium","cwe":"CWE-426","description":"Runtime dynamic loading of libraries."},{"code":"pe-win-exec","title":"WinExec command execution","category":"Dangerous Functions","severity":"critical","cwe":"CWE-78","description":"WinExec executes a shell command."},{"code":"pe-createprocess","title":"CreateProcess with unknown security context","category":"Dangerous Functions","severity":"high","cwe":"CWE-78","description":"Process creation; verify child process argument integrity."},{"code":"pe-urldownload","title":"URLDownloadToFile (remote payload)","category":"Dangerous Functions","severity":"critical","cwe":"CWE-494","description":"Downloads a remote file to disk (payload dropper)."},{"code":"pe-powershell","title":"PowerShell invocation path","category":"Dangerous Functions","severity":"medium","cwe":"CWE-78","description":"Spawns a PowerShell shell."},{"code":"pe-wscript","title":"Windows Script Host / mshta execution","category":"Dangerous Functions","severity":"high","cwe":"CWE-78","description":"Executes a scripting host or HTML application."},{"code":"pe-isdebugger","title":"Anti-debugging API (IsDebuggerPresent)","category":"Dangerous Functions","severity":"low","cwe":"CWE-749","description":"Debugger detection present (common in packed/malicious)."},{"code":"dotnet-system-exec","title":".NET system shell execution","category":"Dangerous Functions","severity":"high","cwe":"CWE-78","description":"Initiates an OS process from .NET."},{"code":"dotnet-remoting","title":".NET Remoting deserialization sink","category":"Dangerous Functions","severity":"high","cwe":"CWE-502","description":"Use of a .NET deserializer with known gadget risk."},{"code":"dotnet-cmd","title":".NET cmd /c style","category":"Dangerous Functions","severity":"high","cwe":"CWE-78","description":"Shell command launcher string present."},{"code":"java-runtime-exec","title":"java.lang.Runtime.exec","category":"Dangerous Functions","severity":"critical","cwe":"CWE-78","description":"Direct OS command execution from Java."},{"code":"java-processbuilder","title":"ProcessBuilder usage","category":"Dangerous Functions","severity":"high","cwe":"CWE-78","description":"Command execution via ProcessBuilder."},{"code":"java-deserialization","title":"Unsafe Java deserialization","category":"Dangerous Functions","severity":"critical","cwe":"CWE-502","description":"Deserializing untrusted input can lead to RCE."},{"code":"java-jndi-exec","title":"JNDI lookup (Log4Shell-adjacent)","category":"Dangerous Functions","severity":"critical","cwe":"CWE-94","description":"JNDI/LDAP lookup can trigger remote code from Log4j2 (CVE-2021-44228)."},{"code":"java-reflection-misc","title":"Dangerous reflection / dynamic loading","category":"Dangerous Functions","severity":"medium","cwe":"CWE-470","description":"Dynamic class loading / reflection can be abused."},{"code":"java-native","title":"JNI native library load","category":"Dangerous Functions","severity":"low","cwe":"CWE-111","description":"Loads a native library."},{"code":"java-external-xml","title":"XML External Entity potential","category":"Dangerous Functions","severity":"high","cwe":"CWE-611","description":"FAX/FB bindings may allow XXE if not hardened."},{"code":"java-systemporary","title":"Temp files (insecure path)","category":"Dangerous Functions","severity":"low","cwe":"CWE-7","description":"Use of temp files in predictable locations."},{"code":"js-eval","title":"eval( / Function( )","category":"Dangerous Functions","severity":"high","cwe":"CWE-95","description":"Dynamic JS evaluation is an injection sink."},{"code":"js-child-exec","title":"child_process / shell exec","category":"Dangerous Functions","severity":"critical","cwe":"CWE-78","description":"Spawns a shell command."},{"code":"electron-unsafe-ipc","title":"Electron nodeIntegration / unsandboxed","category":"Dangerous Functions","severity":"high","cwe":"CWE-829","description":"Electron renderer exposes Node or disables sandboxing."},{"code":"csp-missing","title":"No Content-Security-Policy directive","category":"Dangerous Functions","severity":"medium","cwe":"CWE-1021","description":"CSP referenced (present = good; missing in web view = risk)."},{"code":"ipv4-hardcoded","title":"Hard-coded IPv4 address","category":"Network","severity":"low","cwe":"CWE-200","description":"An IPv4 literal is present (verify if sensitive)."},{"code":"url-http","title":"Plaintext HTTP URL","category":"Network","severity":"medium","cwe":"CWE-319","description":"Plaintext HTTP endpoint (unencrypted) referenced."},{"code":"url-ws","title":"WebSocket (ws://) endpoint","category":"Network","severity":"medium","cwe":"CWE-319","description":"Unencrypted WebSocket endpoint."},{"code":"url-ftp","title":"FTP endpoint","category":"Network","severity":"medium","cwe":"CWE-319","description":"FTP URI present."},{"code":"local-bind","title":"Localhost / 0.0.0.0 bind","category":"Network","severity":"low","cwe":"CWE-200","description":"Loopback binding or localhost reference."},{"code":"temp-dir","title":"Temp directory usage","category":"Filesystem & Registry","severity":"low","cwe":"CWE-377","description":"Temporary files/dirs may be world-writable."},{"code":"reg-write","title":"Registry write surface","category":"Filesystem & Registry","severity":"low","cwe":"CWE-1239","description":"Writes/reads the Windows registry."},{"code":"file-path","title":"Hard-coded filesystem path","category":"Filesystem & Registry","severity":"low","cwe":"CWE-200","description":"Absolute filesystem path embedded."},{"code":"credit-card","title":"Credit card number (Luhn)","category":"PII & Payment-Card Data","severity":"high","cwe":"CWE-359","description":"A potential payment card number was found. Run Luhn on it."},{"code":"ssn","title":"US SSN pattern","category":"PII & Payment-Card Data","severity":"medium","cwe":"CWE-359","description":"A US Social Security-number-shaped value is present."},{"code":"email","title":"Email address","category":"PII & Payment-Card Data","severity":"low","cwe":"CWE-200","description":"An email-like address is embedded."},{"code":"phone-cc-id","title":"International phone number","category":"PII & Payment-Card Data","severity":"low","cwe":"CWE-200","description":"An international phone-format value is present."},{"code":"packed-UPX","title":"UPX compressed data","category":"Packing & Obfuscation","severity":"medium","cwe":"CWE-749","description":"UPX packer signatures present."},{"code":"obfusc-base64","title":"Long Base64 blobs (obfuscated strings)","category":"Packing & Obfuscation","severity":"medium","cwe":"CWE-749","description":"A very long base64 buffer may hide obfuscated strings/strings tables."},{"code":"obf-xor","title":"XOR obfuscation loop","category":"Packing & Obfuscation","severity":"medium","cwe":"CWE-749","description":"Inline XOR loop over data — decoded-at-runtime string."},{"code":"pe-no-aslr","title":"ASLR not enabled (PE)","category":"PE Hardening","severity":"medium","cwe":"CWE-1260","description":"Image does not set DYNAMIC_BASE (ASLR)."},{"code":"pe-no-dep","title":"DEP/NX not enforced (PE)","category":"PE Hardening","severity":"medium","cwe":"CWE-1260","description":"Image does not mark NX_COMPAT (DEP)."},{"code":"pe-unsigned","title":"Unsigned / unauthenticated binary (PE)","category":"PE Hardening","severity":"high","cwe":"CWE-347","description":"No Authenticode certificate signature directory detected."},{"code":"pe-wx-section","title":"Writable + executable PE section","category":"PE Hardening","severity":"critical","cwe":"CWE-749","description":"A PE section is both writable and executable (W+X) — code-write primitive."},{"code":"section-high-entropy","title":"High-entropy executable section (packed)","category":"Packing & Obfuscation","severity":"high","cwe":"CWE-749","description":"A code/data section exceeds entropy threshold (~7.5), strong packing/encryption signal."}],"severity":["critical","high","medium","low","info"],"categories":["Dangerous Functions","Filesystem & Registry","Network","PE Hardening","PII & Payment-Card Data","Packing & Obfuscation","Secrets & Credentials","Weak Cryptography"],"supported":["exe","dll","pe","jar","war","ear","zip","class","elf"]}