0.3.5: persistence AV engine, host persistence targets, Security removal, 153 recipes

.github/workflows/ci.yml

@@ -85,6 +85,19 @@ jobs:
           path: packaging/dist/
           if-no-files-found: error
 
+  copy:
+    name: User-visible copy (no em dashes)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Reject em dashes in rendered copy
+        run: python3 scripts/check-ui-copy.py
+
   audit:
     name: cargo audit (required)
     runs-on: ubuntu-latest

Cargo.toml

@@ -15,7 +15,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.3.4"
+version = "0.3.5"
 edition = "2024"
 rust-version = "1.99.1"
 license = "MIT OR Apache-2.0"

crates/cleanton-antivirus/src/engines/binary_indicators.rs

@@ -442,7 +442,7 @@ fn check_windows_apis(strings: &[Vec<u8>], path: &str) -> Vec<Finding> {
                 Severity::High,
                 Confidence::High,
                 "LoadLibrary + GetProcAddress pairing",
-                "Binary uses LoadLibrary paired with GetProcAddress — common for runtime import \
+                "Binary uses LoadLibrary paired with GetProcAddress: common for runtime import \
                  hiding and reflective DLL injection.",
             )
             .with_rule_id("BIN_WIN_LOADLIB_GETPROC")
@@ -548,7 +548,7 @@ fn check_reverse_shell_triad(strings: &[Vec<u8>], path: &str) -> Option<Finding>
                 Severity::High,
                 Confidence::Medium,
                 "Reverse-shell function triad",
-                "Binary contains socket/connect/dup2 — the canonical POSIX reverse-shell triad.",
+                "Binary contains socket/connect/dup2: the canonical POSIX reverse-shell triad.",
             )
             .with_rule_id("BIN_POSIX_REVERSE_SHELL_TRIAD")
             .with_location(FileLocation::file(path))

crates/cleanton-antivirus/src/engines/entropy.rs

@@ -752,7 +752,7 @@ module.exports = { greet };
             .collect();
         // Pad the source above MIN_FILE_SIZE (512) with a realistic-looking
         // preamble so the size gate is cleared.
-        let preamble = "# Shellcode loader — extracted from malware sample\n\
+        let preamble = "# Shellcode loader: extracted from malware sample\n\
                         import struct\nimport ctypes\nimport sys\n\
                         # Decode and run embedded shellcode\n\
                         # fmt: off\n";

crates/cleanton-antivirus/src/engines/ioc.rs

@@ -357,7 +357,7 @@ impl IocEngine {
                     Confidence::High,
                     "ICP blockchain canister C2 endpoint",
                     "A reference to an Internet Computer Protocol (ICP) canister gateway \
-(*.icp0.io / *.ic0.app) was found. These endpoints are censorship-resistant — \
+(*.icp0.io / *.ic0.app) was found. These endpoints are censorship-resistant: \
 no domain takedown is possible. Used by CanisterWorm and CanisterSprawl as C2.",
                 )
                 .with_rule_id("IOC_ICP_CANISTER")
@@ -451,7 +451,7 @@ exfil endpoint.",
                     "Hardcoded Telegram bot token or SMTP exfil credential",
                     "A hardcoded Telegram bot token (long-form) or Mailtrap SMTP address \
 was found. In supply-chain packages these are always attacker-controlled exfil \
-channels — used by Flashbots typosquats, SeedSweep, WhiteSnake, and W4SP.",
+channels: used by Flashbots typosquats, SeedSweep, WhiteSnake, and W4SP.",
                 )
                 .with_rule_id("IOC_HARDCODED_SMTP_TELEGRAM")
                 .with_location(FileLocation::at_line(file.rel_path.clone(), line))
@@ -587,7 +587,7 @@ key used to authenticate DNS beacons, or the anti-re-execution env var `__ntw`."
                     Severity::Critical,
                     Confidence::High,
                     "CanisterSprawl exfil endpoint",
-                    "An exfil endpoint from the CanisterSprawl campaign was found — the \
+                    "An exfil endpoint from the CanisterSprawl campaign was found: the \
 first cross-ecosystem npm to PyPI worm. Either the secondary exfil domain \
 `telemetry.api-monitor.com` or the specific ICP canister URL were matched.",
                 )
@@ -809,7 +809,7 @@ and clipboard-hijack malware targeting USDT/USDC.",
                     Confidence::High,
                     "Clipboard wallet-hijack pattern",
                     "Code reads clipboard content (or uses pyperclip.paste/copy) and \
-replaces it with a hardcoded wallet address — a defining pattern of \
+replaces it with a hardcoded wallet address: a defining pattern of \
 clipboard-hijacking crypto-stealers.",
                 )
                 .with_rule_id("IOC_CLIPBOARD_HIJACK")
@@ -2001,7 +2001,7 @@ if looks_like_wallet(addr):
 
     #[test]
     fn fp2_patreon_url_not_flagged() {
-        let content = "https://www.patreon.com/myproject — become a patron!";
+        let content = "https://www.patreon.com/myproject: become a patron!";
         let findings = scan_single("FUNDING.md", content, FileKind::Text);
         let concerning: Vec<_> = findings
             .iter()

crates/cleanton-antivirus/src/engines/mcp_descriptor.rs

@@ -881,7 +881,7 @@ impl McpDescriptorEngine {
                     ThreatCategory::Exfiltration,
                     Severity::Critical,
                     Confidence::High,
-                    "MCP description poison combination — multiple attack signals co-present (MCP_DESC_POISON_COMBO)",
+                    "MCP description poison combination: multiple attack signals co-present (MCP_DESC_POISON_COMBO)",
                     "Two or more high-confidence MCP attack markers co-occur in the same content: \
                      override/imperative language AND (credential exfil directive OR approval/config \
                      disable). This combination is the definitive indicator of MCP tool description \

crates/cleanton-antivirus/src/engines/mod.rs

@@ -8,6 +8,7 @@ pub mod entropy;
 pub mod hashdb;
 pub mod ioc;
 pub mod mcp_descriptor;
+pub mod persistence;
 pub mod rules;
 pub mod script_behavior;
 pub mod supply_chain;
@@ -19,6 +20,7 @@ pub use entropy::EntropyEngine;
 pub use hashdb::HashSignatureEngine;
 pub use ioc::IocEngine;
 pub use mcp_descriptor::McpDescriptorEngine;
+pub use persistence::PersistenceEngine;
 pub use rules::RuleEngine;
 pub use script_behavior::ScriptBehaviorEngine;
 pub use supply_chain::SupplyChainEngine;
@@ -35,6 +37,7 @@ pub fn default_engines() -> Vec<Box<dyn crate::engine::DetectionEngine>> {
         Box::new(RuleEngine),
         Box::new(McpDescriptorEngine),
         Box::new(WormPropagationEngine),
+        Box::new(PersistenceEngine),
         Box::new(EntropyEngine),
         Box::new(IocEngine),
         Box::new(ScriptBehaviorEngine),