a952fe3fee
- Layer 4 EntropyScanner: Shannon entropy, Base32/Base64 detection, CVE-2025-55284 ping/nslookup exfil, EchoLeak markdown pattern, DNS tunneling (iodine/dnscat) - Layer 5 UnicodeScanner: ASCII Smuggling (U+E0000 Tags Block), Variant Selectors, Zero-Width steganography, CamoLeak image-ordering (CVE-2025-53773), homoglyphs, BiDi override, high-entropy URL params - 30 DNS covert channel rules (dns-001 to dns-030) - ATLASMapper: 29 techniques (ATLAS v5.4.0 Feb 2026), added AML.T0062 (Agent Tool Invocation), AML.TA0015 (C2 tactic), memory poisoning, multi-agent trust, CamoLeak, Unicode steganography mappings - Rule count: 72 → 102 - Build: tsup 316ms, zero TypeScript errors
41 lines
1.0 KiB
TypeScript
41 lines
1.0 KiB
TypeScript
'use client'
|
|
|
|
import { Badge } from './Badge'
|
|
import type { BadgeVariant } from './Badge'
|
|
import type { KillChainPhase } from '../types'
|
|
|
|
const PHASE_VARIANTS: Record<KillChainPhase, BadgeVariant> = {
|
|
none: 'default',
|
|
initial_access: 'blue',
|
|
privilege_escalation: 'orange',
|
|
reconnaissance: 'yellow',
|
|
persistence: 'violet',
|
|
command_and_control: 'red',
|
|
lateral_movement: 'orange',
|
|
actions_on_objective: 'red',
|
|
}
|
|
|
|
const PHASE_LABELS: Record<KillChainPhase, string> = {
|
|
none: 'None',
|
|
initial_access: 'Initial Access',
|
|
privilege_escalation: 'Priv Escalation',
|
|
reconnaissance: 'Recon',
|
|
persistence: 'Persistence',
|
|
command_and_control: 'C2',
|
|
lateral_movement: 'Lateral Move',
|
|
actions_on_objective: 'Objective',
|
|
}
|
|
|
|
export interface PhaseBadgeProps {
|
|
readonly phase: KillChainPhase
|
|
readonly className?: string
|
|
}
|
|
|
|
export function PhaseBadge({ phase, className }: PhaseBadgeProps) {
|
|
return (
|
|
<Badge variant={PHASE_VARIANTS[phase]} className={className}>
|
|
{PHASE_LABELS[phase]}
|
|
</Badge>
|
|
)
|
|
}
|