{ "ml": { "v": "7", "eng": "2.11.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000017613173, "rte": "az", "prob": 0.000017613173 }, { "cls": 0, "raw": 0.0035056174, "rte": "az/nupkg", "prob": 0.0035056174 } ], "prob": 0.000017613173, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00001761317253112793, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00001233816146850586, "type": "xml" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000015676021575927734, "type": "powershell" } ], "version": "v18.18", "analyzed_at": "2026-09-17T11:03:33Z" }, "path": "PSSailpoint.IaiRecommendations.2.1.40.nupkg", "raw": { "files": [ { "id": 0, "mol": "Th", "sha": "23bf2eb7403b8d56a0d9253307e0be0c26aa9fdd52fdeeeb92510d86d102fd93", "path": "PSSailpoint.IaiRecommendations.2.1.40.nupkg", "risk": 1, "size": 41709, "type": "nupkg", "facts": { "metrics": { "file": { "size": 41709, "entropy": 7.93 }, "binary": { "peak_region_bytes": 38912, "peak_region_entropy": 7.83 }, "archive": { "file_count": 29, "member_count": 29, "script_count": 23, "zip_bomb_ratio": 6.37, "compressed_size": 37635, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.27, "hidden_file_count": 1, "uncompressed_size": 140789, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 56, "rtlo_filename_count": 0, "format.regular_count": 29, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.03, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 29, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 29 } } }, "ident": { "name": { "value": "PSSailpoint.IaiRecommendations", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "OpenAPI Generator Team", "role": "author", "source": "nupkg.authors" }, { "name": "SailPoint Technologies", "role": "owner", "source": "nupkg.owners" } ], "version": { "value": "2.1.40", "source": "nupkg.version", "verified": false }, "identifier": { "value": "PSSailpoint.IaiRecommendations", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "third_party/SecuInfra/SUSP/Powershell/Base64/Decode", "conf": 0.9, "crit": 3, "desc": "Detects PowerShell code to decode Base64 data. This can yield many FP" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 493, "entropy": 5.08 }, "binary": { "peak_region_bytes": 493, "peak_region_entropy": 5.08 } } }, "id": 1, "path": "PSSailpoint.IaiRecommendations.2.1.40.nupkg!!_rels/.rels", "pid": 0, "sha": "a6142e0b3d4347d95dcdb277f7ef2e1ababf1d7746c8f8cf9d41f723b9791770", "size": 493, "type": "xml" }, { "ctx": [ { "b": "k$Jg%wN/T}zdNP}vruj4zGudfaxrF]aARpdB7DEWp!tZJBz\u0026pozGGDgvpKy4CwhejaARpdaw39PzGGPmC{33%v%8*aBA[#@y\u0026sDbaAhd9By]Diz6i}sayO+[x\u003eqE0aAz4jwNPW?vR/QbayPzmz/5{8wN({5A=kD0B8$]laA}KwxDQ@dwNPW(AV/BkvqGvY", "ln": 35, "col": 34, "line": 2 }, { "b": "yhW*7aARpdax8Y.y/24:zGE0?wP?T3z/xodavy6:zfo-gBA]0vz/P#qayPvmxMOunB2\u003e%cwmY{}y\u0026so7AXqAwx(4:bx(n2Bv@Diqwnc9{B-RQDBz\u0026piz/fD7v@@\u0026qx([2hz//V7AV![7C4CGdAaK6haA.:tzF78gB-FP\u003cp!tZX3l{V]wPz\u003caz/dPUB$\u003csGav*0XwPzj3wN(])C{2[4wO%!gnGZJmzE)\u0026%Bz(gXazt\u003esAc15[fk\u003e/vzEEG#eOwTjwPzj3z/NELwN/xXbmj=ubml54sX.:?q+o){arR^Hm}D^-aARpdazts{wmY!5azbLjav]Ehp-%*[xkRd1B-I4C3na.nq:TCOp/H1Zp6@9^arTf=BAnNDxK@r1wNPaXA=Svnz/M$xxK@r1BAzEAB7]o8vruTjwIarxp^E#Bo*@2IqxOXBBzbP63lQDl", "ln": 214, "col": 161, "line": 3 }, { "b": "z!6hcp^E#Bo*@2IqxO$Wx*M@Ry?d9$3lQDlaxrC@luN0UwmY^7w]zYjB-IpvvqYP#ADL\u0026kC{46mA:-/@By/F1e(j\u0026ik$%^Emn+l{z!ab2arR^HqE%\u0026\u003cwPI@ovSb!53nbaOr8uN]qWKS\u0026arTi-B7/V7vR/P.br=DDB-7Yhx(v(im}D=]now@)q!Y(ZwN[tyvpS}\u0026aBsCrarR!Cvrb^[c\u003c?7tarR^HarT)fBAh8kxi==SwPRQ7wgO6garR^HarR!hq*ACawO\u003c51A+N\u003c.x(4r\u003eA:o}\u003cA+N\u003c.x(4r\u003eAX4LuarR^HarR!hB98CpzF9l2lt{yWed9HxarR^Hao", "ln": 575, "col": 13, "line": 14 }, { "b": "xK@qLp!q^JwPz%9AV/Bpz/](baAz4dwN/*8nk@L+aAz4kB.bSoA%:3jarR)KBzb98azthbwGUMeAa%u7wg!iiarR^Lnjt*jmn^FYswRN!mn\u003er(aswNGCYmwqwPGpF3lQDlar@1dxK@qlnn\u0026M\u003ecM)8lvpS}\u0026e^-ZzarR}2ml%sgqEq%\u003cq=B(5asxY#B95=pao", "ln": 1059, "col": 50, "line": 33 }, { "b": "auZ?{l${pBB95=parR^HboP%0wGSu^B-.qnA+P\u0026dBzkVhcM)8lvpS}\u0026azC)tvrDWgzddK2v{%g\u0026C{3:hzE)\u0026%By!#9vTf8rxK@q@y?WD#Bs[XcBrCpnv@co#wPFh3arR^KaARpdaz++kBrCHlaAImfzE)u3xK$Q.wPz\u0026mvqYP#vix2/B7El^eOe*fz!9A\u0026aAImfzEETfA+c\u003cgarR^HbUgu\u0026l}70Xk#*(PpF%+/k#ZAKp9qXxcQz(%xM4{9Dsp]fz/c{f3lQDlar%A=B7=XrvpB4:aARJAB98tvwGV5dzF9J\u003eazts{wmY!53lQDlas6H1Bz$e)xkRo\u003eqE%\u0026\u003cwPI@:wNPaXAV^H/kZKS43lQDlas6H1Bz$e)xkRd1B-I4:wNPaXAV^H/kZKS43lQDlas6]{A+w%9nn\u0026M\u003eauY", "ln": 1437, "col": 19, "line": 42 }, { "b": "nmuNMl2pgLA+PSez6gAwAuDD7ni]0*hx\u003cN)DKp(rarR^HarR{$x\u003eI0#BrAZ?tt]S:x(mM?iYY-GA=2lbc)zOXk}K\u0026HhA=yvEiHi+tsisDC4CYot@\u003e2Cz:E(NwI#wzBAh8kxdb3mz!ab:vrl9hdgdguarV7PwO=B0x\u003ewFobXRpwA8QE-zFs03lVl\u003cOx\u003eINevruj4zz1E*B7^\u003cQxk.*8BzbIleOe]Ab2.2#h8c\u003cgdiJ%AarR^HarR^HbT=uVwPI@ojS)%cBAh8kxi^LVmSir:vrr[wq+fhah8c\u003cHDJ", "ln": 2025, "col": 35, "line": 56 }, { "b": "as7GaBy!A=zdLt0z=HW?C4CYnvqF[SzdLaAe(V:/BAh8kxda%Aa$i\u003caarR^Hw]zZ3vpJ%[c)SFqvpS}\u0026nPXJXazCZobXRpwA8QE-zFs03lVl\u003cOx\u003eINevruj4zz1F4Bz$e)xkRB3xgMPxwmY^gaBsC5arR^HarR^Hx\u003ewFobXQ:$wmY^MBy/qieOe]AbUgu\u0026l}70XqBKC.mn)e)r6:y", "ln": 2376, "col": 19, "line": 64 }, { "b": "x(mMajS(1vBAzF2x\u003eIr(BAIRnnm=juwPxy@wQetteOYirzxHbCa{]CnarR}ywNPaXA-MQ+B.bR/x(!wsjS)0rdgdguarUomA+eV?xDOYGx(){6azCZobUi30A8QE-zEETfA+d^MvpS}\u0026e\u003eoF{mq^l+wPzj3z/NlPdiJ%AarR^HarR^HbXQ:$wmY^ZvqH6$B4*p?BrA7%ax@]eA+PA7t@\u003e2oz/PY6BsntWfNU#8DOG{", "ln": 4146, "col": 20, "line": 95 }, { "b": "xMvK5wEoL5arTr*C#d{\u003cB5lK\u003cvrl05w]zYjBzbkdwO#0#D2N\u003epwftV0C)Vf1rA8^{r8TbDarR^[vrl0rg/FHpx(mL\u003cbr=DDB-7Yhx(v(im}D=]qD2\u003eWx\u003eIr(BAIRnaBsCrao", "ln": 6872, "col": 20, "line": 156 }, { "b": "3lQDlaARTHaBsC5arR^HarR^Hx\u003ewFobXQRcxHcDEz/PMlxL*HMzdK?wwPn?pB7!#qh8VTcaBsCrarR^HarR^HarR^LxKL%}l2pgLauZ\u0026Kq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][9e\u003exz(xHcDEz/PMlxL*HMzdN0li-wNngbQ@%arR^HarR^HEir9qB7G5$asFHGvrl9Fy?EWbx([39pgn0Jat4eAar\u003e(uvkP+{a$jTY3lQDlarR^HarR^Has7SeB7^\u003cQxkX[Qax}=\u0026B97#ge(Ms\u003eB-IhrC}IE8D2N\u003ezxl4B1xN8j3vrl9Fy?EWbx([39pgn0Jt@\u003e2Bni]9/g72cDarR^HarV7t3lQDlarR^HazCBgc)RR/r+lq)x(v(*vpB4:e(kFEwPz\u003caz/dg4vqo.3at4kqau7.(DKp(rarR^HarR^HarR}vv[QxUnm=juwPw[Rar\u0026x?eIeLvmmP{Aaw#c7aw+%crZxXNawkdaeIeLaeG$JAarR^HarR^HarR^LwN!wAC$8Z\u003cBy/FnjS\u003e}2eIeLamnuk[qD2\u003e7p/o\u003e=k#Zn}ogq#neIeLaa{]CnarR^HarR^HarR}BwQdi@AV^H/m}D=]lVl\u003c:wO#PjeL]\u003e$xDOM%A+PY9By!9RC$8H:wL=/SxDO)8vrS53arR^HarR^HarR^LwN!wAC%U}XwI#wzBAh8kxcotWbX{$pq/)4jqE%/-vpJ\u003c%bXpEUwQc*TvpS}\u0026efDbXdk1IfAbn@)wHF*nv[QxUmSii!wPxsAa%FD*rb#X\u0026c[bGCarR^HarR^HarR^LyH}=TD30RsauZ\u0026Kq*ACawO\u003c4!z/f-fA=+OFi.1ddz9?VLwI#wzBAh8kxdb3pv[QxUlsB}Dhz!uOA+PA7dgdguarR^HarR^HarR}IB73gOax}=\u0026B97#ge(Ms\u003eB-IhrC}IE8D2N\u003ezxl4B1xN8jdq:BXIiZW}0vru6edgdguarR^HarR^HarT)5zGGefvTi5.z/]@tauZ\u002633lQDlarR^HarR^Has7#Gvj\u003eb*AbP=sqD2\u003eTA+PY9By!9RC{\u003c}NwQcQ/By/IAax@\u003e$w)DJ8vTi5.z/]@tdgcz8arR^HarR^HarR!vw/@GEq!Y(Zx(mMHy?EWbx([39at4eAar\u003cYZk#QYFeL]wAa$jTY3lQDlarR^HarR^HarR^Has82xxkRo\u003elv0V:B09Q*bYW%me(ME%zB!hSxECb]vrt{Sz=pv.zy=[QxKL%}l2pgLefFd}D2[7sz7X:#v%8*aBA]GaA^qRCz!B90Aa\u003cIHqD2\u003eWx\u003eIr(BAIRnp*))Bx(mM?iYZ8UB14CsarR^HarR^HarR!Paz2wgwGVsbarR^HarR^HarR^HarR^HbY^WjzE)uBD30RsauZ?)A=UUwq!Y(ZnmuNMc)Rh?Bywc!q!Y(ZefDiKvrl9Fy?EVqax}=\u0026B97#ge(Ms\u003eB-IhrC}IE8D2N\u003ezxl4B1xN8jdq:Bt@xkRd1B-I4\u0026vpS[.zF9loi-6Q4B1]9JarR^HarR^HarR^HEf}8tarR^HarV7PwO=B0aBsCrarR^HarR^HarR^LA=UU@Ab](ux\u003eg^}uVoB}xDPCXn]FAYeL]\u003e$xDO)6vruf9bV4Arv@=p5Bw^3}BrAe5xLzo[p*[DVar\u003cYZk$bW3A^qRCx(v(=A=lbnwmY^lv@\u0026?3arR^HarR^HarR^HbYW%muVp47C4\u003eF#A:J)aB-H#6lVlHDauZ\u0026qwPPH\u003ez/fVdzGE0Mp*[DVas7#Gvp9$]z*2\u00269wPzc%vruf9eMc233lQDlarR^HarR^HavfKGeMv1mwGSN7D2Ns.wObT]x([6czxHiBB75A{A=lbnwmY^*B8Mhwv}w2CwmV8ParR^HarR^HarR^Htt]/*By/qwq!oDYA+PSve\u003c\u003cV8Acc2hA:-{2C}I#[l0U:RB73gOax}-xk$bW3A^qRCx(v(wqD2\u003eIzEWZjAcb/jzCUv(C4\u003eF#A:pZ!m}D^uq:Bl2zV", "ln": 7165, "col": 6, "line": 168 }, { "b": "arR!hB7F\u003c7A+frlA+PA7t{J6OC#d{\u003cB5lK\u003cvrk#!arR^HdgdguarUxgasFxYraQb)eL]\u003e$xDO)6vruf9bT\u003e6[wQc:Vy?lBKBz99LaBsCrarR^HarR!GxMw3nar\u003ePjC{3Zky?j-dvruf9wn=42az#ataz2!iB962U3lQDlaBKO7arR^Hx\u003ewFobV4AuwPz\u003cazV", "ln": 9926, "col": 6, "line": 239 }, { "b": "Cow7#lQT\u003csazULlazC)tzF%RtB9hCvz/P@hwft/daw^02wPyZ.wO=f9C4CYnx(v(ibQ:{mq=WEIB7]MgraflLwIc!Tr+lq)x(v(refE@lwGT//Cv+![xK#0@aA/W@fD:!wwftq\u0026", "ln": 10123, "col": 13, "line": 246 }, { "b": "arR^HbXpEUwQc:-z//MhauZ?\u003eeIeLaeK-A5avOTup/o\u003e=k#Zn}ogq#neIeLaa{]CnarR}BwQdi@AV^H/m}D=]lVl\u003c:wO#PjeL]\u003e$xDOM?lRz0omRMWIp*[DVat3G1Cm2DnarR}vv[QxUlsB}Dhz!uOA+PA7auZ?)yH}=\u0026BAf0iwPhD]v}v5lwN!wAC$qHPwmY^jar\u00260Ue(Dn1y***+c)Swloj-xrz/o-eAX5sSa$kczA+PwsdgdguarR}BwQcQ/By/IojS)%cD2[7sz7Xg]zGYPiBx{{*mSJA:lsB}Dhz!uOA+PA7c)Swloj-xnvrl0rg/FHpx(mMj3lQDlas7Jdwohf4jS)%cD2[7sz7X:#v%8*aBA]GaA^qRCz!B90Aa\u003cIHmmfE:vo\u003e]PlVM:DBy=\u003cH3jm)#arT)5zGGefvTi5.z/]@tau.y=arR^Hx\u003ewFoaZo2fA+PA7t@\u003e2rB53\u003c]y!]7uze:Pxc)RC%C#d{\u003cB5lK\u003cvrl0ediJ%AarR^HarR^HbXpE@B73W)ze:AlBvy7SA^qRCwN[RMv@\u003cRaA+PY9By!9RC{\u003c}hwQd9XB8$e\u003eA::32ef]1xC%V^#wPGzbA+e\u0026*bW#4vlVm9+BsvLtarR!Paz2wgwGVsbarR^HarR^HbXpE@B73W)ze:AlBwM:.B2W0px)9{bwLlPWc)SOtC%V^#wPGzbA+e\u0026*bW#4vlVm9+BsvLtarR!P3jm)#arR}Jx\u003eIr{wi$M-wPF$Sas7Jdwohfiq!Y(ZnmuNMc)Rh?Bywc!q!Y(ZdgdguarR}uwPya.By/IojS\u003e\u003emz/f-fA=+o0eK-2{q:AYAq.Z:WA=2lbat3G1Cs3N%wPF$tB7]o8wN[bMBy/I2arR^HbY^WjzE)uSBAh8kxcotWtt]/*By/qwlVl\u003c=wPz(#iYZkUlsB}Dhz!uOA+PA7c)StmAZC4[wPGpcarR^HA+funA=90BB7]o8wN[.YA+PA73vJl*jr\u003eg=q*An0Ac2-m3lQDlav*0+B0bNrwGUU{B7=Xmw/#epA+PA7e^:j0wPIv4x(Ffdz/b[8arR^%wPR#oBzbkdxKL%}aA7\u003cmB98CpzF6qep*[xM", "ln": 10295, "col": 1, "line": 250 }, { "b": "A^qRCz!B90Aa\u003cIHnmuNMl2pgLA+PSezcYg-lVM:DBy=\u003cCnmuNMpgn0JdgdguarR}yvrl9Fy?EWbx([39e\u003c\u003cL]AclnlnmuNMc%GR}B97#ge(VzbBs{11v@C)(zF9loi-PcGi4^ZjBv7m{wPGmBq/)4]zF7yE3vJl*jr\u003eg=q*An0Ac2-m3lQDlav*0+B0bNrwGT#\u003cx)p+xx(dAl3na.TB7ol8Acb/jzvdHearTf=BAnNDxK@q^zFstrBzkP63nbd-A:-/@By/Fnl$7gG3lQDlax9k\u003cv}/K?wPF#oxK@q%vru66Bz\u0026o", "ln": 11707, "col": 40, "line": 291 }, { "b": "Bz8^GatEdAeP1{rv}V#gwN!LSx)9{bwLlPWmSii!wPxjxDKp(rarR^HarS=\u003eBzbxfaAR)FwGU]6azULlay!?$aztXfwft.$zH0vDD2NsqwnbT/wPzv1BrCWJAaK8kz!pbhA+PY9By=OgwQb*HvS==nxK#i}ay]Raaz+E@yANLcaAg[eazts{wmY=*", "ln": 14449, "col": 69, "line": 376 } ], "depth": 1, "facts": { "imp": [ [ "", "Get-ConfigurationHttpSigning" ], [ "", "Get-StringHash" ], [ "", "Get-Date" ], [ "", "Get-UnixTime" ], [ "", "Get-UnixTime" ], [ "", "Get-StringHash" ], [ "", "Get-KeyTypeFromFile" ], [ "", "Get-RSASignature" ], [ "", "Get-ECDSASignature" ], [ "", "Get-Content" ], [ "", "Join-Path" ], [ "", "Get-Content" ], [ "", "Add-Type" ], [ "", "Test-Path" ], [ "", "Get-Content" ], [ "", "ConvertTo-ECDSAANS1Format" ], [ "", "Get-Date" ], [ "", "New-TimeSpan" ], [ "", "Test-Path" ], [ "", "Get-Content" ] ], "tgt": [ "Add-Type", "ConvertTo-ECDSAANS1Format", "Get-ConfigurationHttpSigning", "Get-Content", "Get-Date", "Get-ECDSASignature", "Get-KeyTypeFromFile", "Get-RSASignature", "Get-StringHash", "Get-UnixTime", "Join-Path", "New-TimeSpan", "Test-Path" ], "funcs": [ [ "anonymous", 702 ], [ "anonymous", 6947 ], [ "anonymous", 9625 ], [ "anonymous", 11425 ], [ "anonymous", 12148 ], [ "anonymous", 12844 ], [ "anonymous", 13579 ], [ "anonymous", 15092 ] ], "metrics": { "ast": { "max_depth": 49, "call_count": 20, "node_count": 7301, "max_array_len": 2 }, "file": { "size": 16077, "entropy": 5.03 }, "text": { "lines": 436, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.02, "space_count": 3129, "char_entropy": 5.03, "unique_chars": 87, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.15, "top_char_ratio": 0.08, "avg_line_length": 35.88, "max_line_length": 296, "empty_line_ratio": 0.1, "last_line_length": 1, "whitespace_ratio": 0.22, "identifier_density": 1.05, "line_length_stddev": 32.98, "normalized_string_count": 3.11, "repeated_char_sequences": 49, "suspicious_string_ratio": 0.05, "suspicious_comment_ratio": 0.02, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 16.54 }, "binary": { "peak_region_bytes": 15360, "peak_region_entropy": 5.07 }, "source": { "function_count": 8 }, "strings": { "bytes": 1018, "count": 65, "shell": 3, "avg_length": 15.66, "max_length": 108, "avg_entropy": 2.84, "empty_count": 4, "entropy_stddev": 1 }, "comments": { "chars": 1593, "count": 51, "empty": 9, "lines": 42, "base64": 1, "todo_count": 1, "to_code_ratio": 0.11, "url_in_comments": 2 }, "functions": { "count": 8 }, "identifiers": { "count": 459, "unique": 145, "avg_length": 12.06, "max_length": 30, "min_length": 2, "avg_entropy": 3.05, "reuse_ratio": 0.32, "length_stddev": 5.94, "has_digit_ratio": 0.09, "base64_like_names": 5, "high_entropy_count": 37, "high_entropy_ratio": 0.26, "numeric_suffix_count": 5 } } }, "id": 24, "mol": "H₆(CmCr₄Db₃FOsPo)Th", "path": "PSSailpoint.IaiRecommendations.2.1.40.nupkg!!Private/HttpSignatureAuth.ps1", "pid": 0, "risk": 9, "sha": "57cedc6f2781694a805dcaa6ed356e92a19c52c22be81a7f96142b256d424ef4", "size": 16077, "traits": [ { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "spans": [ [ 1485, 0 ] ] }, { "id": "metadata/lang/generated::openapi-generator-source-banner", "conf": 0.95, "crit": 2, "desc": "OpenAPI Generator source banner", "spans": [ [ 367, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 88, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 623, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 1107, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 1112, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 467, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 83, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 14497, 0 ] ] }, { "id": "metadata/lang/scripted::add-type-definition", "conf": 0.85, "crit": 2, "desc": "PowerShell Add-Type TypeDefinition syntax marker", "spans": [ [ 8582, 0 ] ] }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "spans": [ [ 2073, 0 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "spans": [ [ 1606, 22 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdsa::dotnet-ecdsa-create", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET ECDSA object creation", "spans": [ [ 10573, 45 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdsa::dotnet-ecdsa-private-key-import", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET ECDSA private key import", "spans": [ [ 10703, 38 ], [ 10803, 29 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdsa::dotnet-ecdsa-sign-hash", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET ECDSA SignHash call", "spans": [ [ 10884, 16 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::dotnet-rsa-create", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET RSA object creation", "spans": [ [ 7886, 43 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::dotnet-rsa-private-key-import", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET RSA private key import", "spans": [ [ 7978, 21 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::dotnet-rsa-sign-hash", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET RSA SignHash call", "spans": [ [ 8113, 14 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::dotnet-rsa-signature-padding", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET RSA signature padding selection", "spans": [ [ 8151, 55 ], [ 8298, 57 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::pem-rsa-key-header", "conf": 0.9, "crit": 3, "desc": "References RSA private-key PEM header", "spans": [ [ 7531, 31 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::dotnet-computehash", "conf": 0.86, "crit": 3, "desc": "PowerShell .NET ComputeHash call", "spans": [ [ 11771, 13 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::dotnet-hashalgorithmname-sha256", "conf": 0.86, "crit": 3, "desc": "PowerShell .NET SHA256 hash algorithm selection", "spans": [ [ 7248, 56 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::dotnet-hashalgorithmname-sha512", "conf": 0.86, "crit": 3, "desc": "PowerShell .NET SHA512 hash algorithm selection", "spans": [ [ 7382, 56 ] ] }, { "id": "micro-behaviors/data/decode/base64::powershell-frombase64string", "conf": 0.95, "crit": 3, "desc": "PowerShell decodes Base64 with Convert", "spans": [ [ 7812, 35 ] ] }, { "id": "micro-behaviors/data/encode/base64::to-base64-string", "conf": 0.9, "crit": 3, "desc": "Encodes base64 in PowerShell", "spans": [ [ 2105, 25 ], [ 10999, 32 ] ] }, { "id": "micro-behaviors/data/encode/charset::powershell-utf8-getbytes", "conf": 0.94, "crit": 3, "desc": "PowerShell converts text to UTF-8 bytes", "spans": [ [ 11805, 17 ] ] }, { "id": "micro-behaviors/fs/read/file/full::get-content-raw", "conf": 0.94, "crit": 3, "desc": "PowerShell reads a whole file", "spans": [ [ 7645, 42 ], [ 8528, 41 ], [ 10359, 37 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/version::os-version", "conf": 0.8, "crit": 3, "desc": "Queries OS version info", "spans": [ [ 7462, 25 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::powershell-add-type", "atk": "T1059.001", "mbc": "E1059", "conf": 0.75, "crit": 3, "desc": "PowerShell Add-Type compilation", "spans": [ [ 8582, 24 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Authorization header-name literal", "spans": [ [ 1630, 13 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "spans": [ [ 7531, 31 ] ] }, { "id": "micro-behaviors/data/decode/base64::dotnet-frombase64string-text", "conf": 0.9, "crit": 3, "desc": ".NET FromBase64String method reference", "spans": [ [ 7830, 16 ] ] }, { "id": "micro-behaviors/fs/read/file/full::get-content", "conf": 0.86, "crit": 3, "desc": "PowerShell reads file content", "spans": [ [ 7645, 11 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdsa::powershell-ecdsa-signature", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET ECDSA signature generation", "uses": [ 12, 14 ], "spans": [ [ 10573, 45 ], [ 10884, 16 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::powershell-rsa-signature", "mbc": "C0059", "conf": 0.88, "crit": 3, "desc": "PowerShell .NET RSA signature generation", "uses": [ 15, 17 ], "spans": [ [ 7886, 43 ], [ 8113, 14 ] ] }, { "id": "third_party/SecuInfra/SUSP/Powershell/Base64/Decode", "conf": 0.9, "crit": 3, "desc": "Detects PowerShell code to decode Base64 data. This can yield many FP", "spans": [ [ 7812, 35 ] ] } ], "type": "powershell" } ], "rev": "e86a6", "v": "8" } }