{ "ml": { "v": "7", "eng": "2.3.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.074019104, "rte": "az", "prob": 0.074019104 }, { "cls": 0, "raw": 0.0004002154, "rte": "az/tar", "prob": 0.0004002154 } ], "prob": 0.35465968, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.35465967655181885, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00009638071060180664, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0006590187549591064, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00003331899642944336, "type": "src_info" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.35465967655181885, "type": "gz" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.06035640835762024, "type": "elf" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.09119746088981628, "type": "rust" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.0002523362636566162, "type": "markdown" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00009638071060180664, "type": "shell" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.0006672143936157227, "type": "shell" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.0023692846298217773, "type": "text" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.12009364366531372, "type": "cargo.toml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "cargo.lock" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.00003331899642944336, "type": "src_info" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000014156103134155273, "type": "markdown" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.35465967655181885, "type": "gz" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.06035640835762024, "type": "elf" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.09119746088981628, "type": "rust" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.0002523362636566162, "type": "markdown" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.00009638071060180664, "type": "shell" }, { "id": 56, "lvl": -1, "conf": 0, "prob": 0.0006672143936157227, "type": "shell" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.0023692846298217773, "type": "text" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.12009364366531372, "type": "cargo.toml" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "cargo.lock" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.00003331899642944336, "type": "src_info" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.000014156103134155273, "type": "markdown" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-12T01:09:28Z" }, "path": "aura-emerge-1.23.0-1.src.tar.gz", "raw": { "fetched": [ { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/aura", "outcome": "unresolved", "fetched_at": 0, "source_offset": 10, "source_sha256": "d55702e44f0297fe5a1e83f60392fb9a239394f47d67439981beef548286c4ef" }, { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/rust", "outcome": "unresolved", "fetched_at": 0, "source_offset": 239, "source_sha256": "d55702e44f0297fe5a1e83f60392fb9a239394f47d67439981beef548286c4ef" }, { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/cargo", "outcome": "unresolved", "fetched_at": 0, "source_offset": 259, "source_sha256": "d55702e44f0297fe5a1e83f60392fb9a239394f47d67439981beef548286c4ef" }, { "kind": "dependency", "size": 28162801, "cached": false, "status": 200, "headers": [ [ "access-control-allow-origin", "https://render.githubusercontent.com" ], [ "content-disposition", "attachment; filename=aura-emerge-1.23.0.tar.gz" ], [ "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox" ], [ "content-type", "application/x-gzip" ], [ "cross-origin-resource-policy", "cross-origin" ], [ "etag", "\"76568ceb42793ef53845818322e2f2fb250d9a3bcad17ee72fd990aba38168c1\"" ], [ "strict-transport-security", "max-age=31536000" ], [ "vary", "Authorization,Accept-Encoding" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "deny" ], [ "x-xss-protection", "1; mode=block" ], [ "date", "Sun, 12 Jul 2026 01:09:24 GMT" ], [ "transfer-encoding", "chunked" ], [ "x-github-request-id", "B534:2BAACE:2F157:91365:6A52E944" ] ], "locator": "pkg:github/undercat037/aura-emerge@v1.23.0", "outcome": "ok", "final_url": "https://codeload.github.com/undercat037/aura-emerge/tar.gz/v1.23.0", "fetched_at": 1783818565, "resolved_url": "https://codeload.github.com/undercat037/aura-emerge/tar.gz/v1.23.0", "source_offset": 494, "source_sha256": "d55702e44f0297fe5a1e83f60392fb9a239394f47d67439981beef548286c4ef", "content_sha256": "c86c5d9eaddd6a6fe3c6d72aa855fcbfc6855905bd26f9687326bb2c5b80a6e7" }, { "kind": "dependency", "size": 28162716, "cached": false, "status": 200, "headers": [ [ "access-control-allow-origin", "https://render.githubusercontent.com" ], [ "content-disposition", "attachment; filename=aura-emerge-main.tar.gz" ], [ "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox" ], [ "content-type", "application/x-gzip" ], [ "cross-origin-resource-policy", "cross-origin" ], [ "etag", "\"76568ceb42793ef53845818322e2f2fb250d9a3bcad17ee72fd990aba38168c1\"" ], [ "strict-transport-security", "max-age=31536000" ], [ "vary", "Authorization,Accept-Encoding" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "deny" ], [ "x-xss-protection", "1; mode=block" ], [ "date", "Sun, 12 Jul 2026 01:09:26 GMT" ], [ "transfer-encoding", "chunked" ], [ "x-github-request-id", "B534:2BAACE:2F18B:913F1:6A52E945" ] ], "locator": "https://github.com/Undercat037/aura-emerge/archive/refs/heads/main.tar.gz", "outcome": "ok", "final_url": "https://codeload.github.com/Undercat037/aura-emerge/tar.gz/refs/heads/main", "redirects": [ "https://github.com/Undercat037/aura-emerge/archive/refs/heads/main.tar.gz" ], "fetched_at": 1783818567, "resolved_url": "https://github.com/Undercat037/aura-emerge/archive/refs/heads/main.tar.gz", "source_offset": 475, "source_sha256": "2116fe1191a50e7761f0c50a3cf2198d77b2b29e0644afad14ec9a58e2809f2f", "content_sha256": "6545f64c138592e8cf088227ed6bb6b7836c2d777d81228dcb803a190e2169a2" } ], "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQ\u0026tw@mO6WA=Pd*R#ILmt99/cV(tRa?Zdo//4nPaa$#wfEbmL2q{m/NI/aeTvb:x:cVsr^/Hb}rmrM:?#BxXU1NgO0e99PV0:Qz$zrQWRYa6FC}Huh1@t.Ua7.]/T.gQId#kFuBUX\u003e9?:c9\u0026OY\u003ePMh", "n": [ { "c": 1, "d": "Gzip-compressed tar archive", "i": "metadata/package/files/system-package::tar-gz-archive-format", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(S)Md(Bk)", "sha": "25c9885798705d9713e33eb5f28ceb7a5064fa8dc6de8a5fe45f355533da3971", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aura-emerge/aura-emerge-1.23.0-1.src.tar.gz", "risk": 2, "size": 1088, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 1088.0, "entropy": 7.81, "size_bytes": 1088.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.81, "peak_region_bytes": 1024.0, "peak_region_entropy": 7.8 } } }, "traits": [ { "id": "objectives/supply-chain/install-hook/distro-scriptlet::pacman-scriptlet-hook", "atk": "T1195.002", "conf": 0.8500000238418579, "crit": 3, "desc": "pacman install scriptlet hook function", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.699999988079071, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "AbP/tuUKz0Byx04c[co=3lQEczxHJLw/@:HB8\u0026{Iz!0i(fjFTkfj/0iA+w@aflItRfkLMpvqEPax(kOyz/P@dxjV5\u0026Ef{s2z/Z2cB-p#lvpS{$diJ%AarUSwB97=6zGx]dy?%Db3jp-)wNxE?zeTPec[co=3lQEiz6gAxatm\u003eUAXzlEv{%gbvRGZkAbP=svp%d\u003e3vI", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "ln" ], [ "", "post_install" ], [ "", "rm" ] ], "tgt": [ "ln", "post_install", "rm" ], "funcs": [ [ "post_install", 0 ], [ "post_upgrade", 75 ], [ "pre_remove", 110 ] ], "metrics": { "ast": { "max_depth": 5, "call_count": 3, "node_count": 36 }, "file": { "size": 158, "entropy": 4.52 }, "text": { "lines": 11, "top_char": 47, "max_ws_run": 1, "space_count": 14, "char_entropy": 4.52, "unique_chars": 28, "top_char_null": 0, "top_char_ratio": 0.08, "avg_line_length": 13.45, "max_line_length": 54, "empty_line_ratio": 0.18, "last_line_length": 1, "whitespace_ratio": 0.15, "identifier_density": 1.27, "line_length_stddev": 15.93, "normalized_unique_identifiers": 2.6 }, "binary": { "peak_region_bytes": 158, "peak_region_entropy": 4.52 }, "source": { "function_count": 3 }, "functions": { "count": 3, "density": 27.27, "avg_params": 1, "code_ratio": 0.82, "max_params": 1, "avg_name_length": 11.33, "avg_length_lines": 3, "max_length_lines": 3, "min_length_lines": 3, "avg_param_name_length": 5.33 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 14, "unique": 9, "avg_length": 9.67, "max_length": 23, "min_length": 2, "avg_entropy": 2.35, "reuse_ratio": 0.64, "length_stddev": 7.73, "high_entropy_count": 2, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.56 } } }, "id": 1, "mol": "Md₂(Bk)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aura-emerge/aura-emerge-1.23.0-1.src.tar.gz!!aura-emerge/aura-emerge.install", "pid": 0, "risk": 2, "sha": "d63dff760e1f9e62567cf81cf46a7e1299c715445c31ea677f2e2692e928bb26", "size": 158, "traits": [ { "id": "metadata/build/package/maintainer-scripts::pacman-lifecycle-hook-fn", "conf": 0.9, "crit": 3, "desc": "Lifecycle-style shell function declaration", "spans": [ [ 0, 16 ], [ 74, 17 ], [ 109, 15 ] ] }, { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "metadata/build/package/maintainer-scripts::pacman-scriptlet-hook-fn", "conf": 0.9, "crit": 1, "desc": "Non-PKGBUILD lifecycle-style shell function", "spans": [ [ 0, 0 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV}BuwmY^\u003evrsgVhY$j[wO=D%v{%E\u0026wP?T3z/xodkXB}xx(2ziz/4V", "n": [ { "c": 3, "d": "Recognized OS-specific execution marker", "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker", "o": 0, "z": 8, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPNsvrDQ0eOe^gA+w}", "ln": 2, "addr": 56 }, { "b": "Abf9fwPx{*e\u00262jnfA", "ln": 3, "addr": 76 }, { "b": "Abf9bwO:H:", "ln": 4, "addr": 90 }, { "b": "Abf8%wPIuAb2Ah#Byw/[eO]cpwGVhqvq{f%AV!$jAV^U*v}V#Ux(n6raA.:tzF77TB-H[m", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 108, "z": 46, "cf": 0.6000000238418579 } ], "ln": 5, "addr": 99 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 6, "addr": 156 }, { "b": "B-IpYb4#7uAc15[fk20vxMW=pv@DiqrC(tUA:@K1fF+TvvrDQ0eOe^gA+w@c", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 177, "z": 8, "cf": 0.8999999761581421 }, { "c": 1, "d": "GitHub or Google platform domain", "i": "metadata/file/catalog/identity::platform-domain", "o": 185, "z": 10, "cf": 0.8999999761581421 } ], "ln": 7, "addr": 172 }, { "b": "y?Wx\u003czGxwLc)}IYoF54MfEFp", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 231, "z": 3, "cf": 0.699999988079071 } ], "ln": 8, "addr": 221 }, { "b": "wmYZ\u003ezE^/Kc)@CCA:ZsA", "ln": 9, "addr": 241 }, { "b": "z/x/ewPhi#wof)ZcT?7niV@3MAV=}=vpBp2B9hCvz/P}xc$msky?aV2A=k!qk%!G)B8Mhwv}v8p", "ln": 10, "addr": 258 }, { "b": "bwg.jaAR48at41AB$\u003eQ8gCgv7eO#QOe?O+2asnATxk8DgAclknaA8pmxk8laB$\u003eQ8gCgu", "ln": 17, "addr": 509 }, { "b": "B8Mhwv}v!Ka%.byxkRc{wJz\u003e+x(\u003e\u003esBAzFyiXJd0x([3hvLheez7![bwmY^\u003evrsgVh.OPZA:ZLhzdN:2wIdRfBr+)oxfyz-Abf9fwPw$z", "ln": 18, "addr": 565 }, { "b": "B7!#qh8YI#zf4\u0026*cSrVfp:WW", "n": [ { "c": 3, "d": "PKGBUILD skips source checksum verification", "i": "metadata/build/package::pkgbuild-checksum-skip", "o": 650, "z": 17, "cf": 0.699999988079071 } ], "ln": 19, "addr": 650 }, { "b": "", "n": [ { "c": 1, "d": "PKGBUILD defines a build() function", "i": "metadata/build/package::pkgbuild-build-fn", "o": 670, "z": 8, "cf": 0.8999999761581421 } ], "ln": 20, "addr": 670 }, { "b": "vS=y3wge(HDJ", "ln": 21, "addr": 671 }, { "b": "arUf8ar\u00267IyIdJ[zdK)", "ln": 22, "addr": 681 }, { "b": "Aa9l(vp%d1diJ%", "ln": 26, "addr": 724 }, { "b": "arUf8ar\u00267IyIdJ[zdK)", "ln": 27, "addr": 736 }, { "b": "arUxoB97\u0026by-\u003eq$z8TsfaAR4jxjVfrA+f5#vrl0kvrDQ0eOe^gA+w@aa%.byxjLZ%flItRfkLMpvqEPax(kOnzdN:2wG?", "n": [ { "c": 2, "d": "Reference to /usr/local binaries", "i": "micro-behaviors/fs/path/binary::binary-usr-local", "o": 804, "z": 21, "cf": 0.6600000262260437 }, { "c": 2, "d": "coreutils install stages a file", "i": "micro-behaviors/fs/write/copy::coreutils-install-file", "o": 753, "z": 11, "cf": 0.699999988079071 } ], "ln": 28, "addr": 752 }, { "b": "arUxoB97\u0026by-\u003eq$z8Kjcawtu]mnu=Iar\u00267IyIdf(AXzMRAXzGEvrb{jy?Wx\u003czGxxgfc\u003eHLxkRc{wIl.GlQ::GmiR", "ln": 29, "addr": 827 }, { "b": "arUxoB97\u0026by-\u003eq$z8Kjcaw$S]l}{95o**9FbYEKiwnc6qB-RNRB7/05wImOjv\u003eP9DyIdJ[zdLv#ml%somj@B/a]", "ln": 30, "addr": 898 } ], "depth": 1, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "cargo" ], [ "", "cargo" ], [ "", "cd" ], [ "", "cd" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "cargo", "cd", "install" ], "metrics": { "ast": { "max_depth": 6.0, "bind_count": 15.0, "call_count": 8.0, "node_count": 212.0, "identifier_count": 31.0, "string_literal_count": 21.0, "array_literal_max_length": 3.0 }, "file": { "size": 1066.0, "entropy": 5.26, "size_bytes": 1066.0 }, "text": { "digit_ratio": 0.06, "space_count": 83.0, "total_lines": 33.0, "char_entropy": 5.26, "unique_chars": 68.0, "string_density": 0.64, "avg_line_length": 31.3, "max_line_length": 84.0, "empty_line_ratio": 0.09, "last_line_length": 1.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.08, "identifier_density": 1.76, "line_length_stddev": 24.83, "normalized_string_count": 3.66, "repeated_char_sequences": 1.0, "suspicious_string_ratio": 0.05, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 6.15 }, "binds": { "count": 15.0 }, "calls": { "count": 8.0 }, "binary": { "overall_entropy": 5.26, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.27 }, "source": { "function_count": 2.0 }, "strings": { "total": 21.0, "url_count": 1.0, "avg_length": 23.62, "max_length": 73.0, "path_count": 3.0, "avg_entropy": 3.29, "sql_strings": 1.0, "total_bytes": 496.0, "entropy_stddev": 0.99 }, "comments": { "chars": 108.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.06 }, "functions": { "count": 2.0, "avg_params": 4.0, "max_params": 6.0, "length_stddev": 2.0, "avg_name_length": 6.0, "avg_length_lines": 6.0, "max_length_lines": 8.0, "min_length_lines": 4.0, "avg_param_name_length": 5.5, "density_per_100_lines": 6.06, "code_in_functions_ratio": 0.36 }, "identifiers": { "count": 31.0, "total": 58.0, "avg_length": 7.9, "max_length": 26.0, "min_length": 2.0, "avg_entropy": 2.5, "reuse_ratio": 0.53, "unique_count": 31.0, "length_stddev": 4.45, "has_digit_ratio": 0.16, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.61, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 3.0 } } }, "id": 2, "mol": "Md(Bk)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aura-emerge/aura-emerge-1.23.0-1.src.tar.gz!!aura-emerge/PKGBUILD", "pid": 0, "risk": 1, "sha": "8426687c7d2ef55b6e775905cbe783d41437de08c9c25bef1e43bbd49a85da2d", "size": 1066, "traits": [ { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.699999988079071, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "spans": [ [ 650, 17 ] ] } ], "type": "shell" }, { "id": 3, "sha": "d55702e44f0297fe5a1e83f60392fb9a239394f47d67439981beef548286c4ef", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aura-emerge/aura-emerge-1.23.0-1.src.tar.gz!!aura-emerge/.SRCINFO", "size": 612, "type": "src_info", "depth": 1 }, { "id": 4, "mol": "Md", "sha": "77b6508638ee34641b9740ff53b9ef7650ad5ba8854798951cbc2abb9751edb7", "path": "rust@1.97.0-1.registry.json", "risk": 1, "size": 842, "type": "registry", "depth": 2 }, { "id": 5, "sha": "0aff70d198dbd5feb1ce39530b04221820dc70c4010233223a6c0212a107e390", "path": "git@2.55.0-1.registry.json", "size": 804, "type": "registry", "depth": 2 }, { "id": 6, "mol": "Md", "sha": "56289f697e46ca4b3c04e084772eb1407e2504f0f1a7d5bc6f4eba650d100775", "path": "undercat037_aura-emerge.registry.json", "risk": 1, "size": 929, "type": "registry", "depth": 2 }, { "ctx": [ { "b": "abZy80000000zN(zi9C\u003eDC9Xgu+#2RXcY:EOF=FyK#t-H-%HLjJU9ULd1Ym4sby4pr7H=QO1/}@\u003envf3)xi*t0OG^chdp.QAYAW6OAA1EbX\u003cErY\u003coc\u0026r}Ujzq}u8vi@M)lwlxYE\u0026\u003c/187T\u003eP*dmtT%=xns[C}60{^/", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "depth": 2, "facts": { "metrics": { "file": { "size": 28162801.0, "entropy": 8.0, "size_bytes": 28162801.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 28162801.0, "peak_region_entropy": 7.86 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "id": 7, "mol": "O(S)H₆(Cm₄F₂MgOsPo₄U)Md₄(BiBkPa)", "path": "v1.23.0", "risk": 19, "sha": "c86c5d9eaddd6a6fe3c6d72aa855fcbfc6855905bd26f9687326bb2c5b80a6e7", "size": 28162801, "traits": [ { "id": "objectives/persistence/system/daemon/init::daemonize-self-reexec", "atk": "T1543", "mbc": "F0006", "crit": 2, "desc": "Daemonizes via self-exe re-exec + fork/setsid", "from": [ { "off": 130972, "file": 1 } ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string" }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-archive-ref-download", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "GitHub archive refs download URL", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/memory/mmap::mmap64-fn", "conf": 0.66, "crit": 2, "desc": "Maps files or devices into memory", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "conf": 0.76, "crit": 1, "desc": "Go allocation symbol bytes", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/threshold::large-binary-500k", "conf": 1.0, "crit": 1, "desc": "Binary is 500KB+", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.7, "crit": 2, "desc": "Short -h help flag", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawnp-import", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn PATH execution", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 UDP ASSOCIATE request opcode", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "from": [ { "file": 1 } ], "spans": [ [ 34, 4 ], [ 196, 3 ] ] }, { "id": "micro-behaviors/process/identity/query::getpid", "conf": 0.3, "crit": 2, "desc": "Get process ID", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repo", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "atk": "T1105", "conf": 0.82, "crit": 3, "desc": "Rust invokes curl or wget", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/fd/dup::dup", "crit": 2, "desc": "Duplicate file descriptor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "crit": 2, "desc": "Duplicate file descriptor (I/O redirection)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "conf": 0.4, "crit": 2, "desc": "/proc fs path in native binary", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-30", "conf": 1.0, "crit": 1, "desc": "Binary has 30+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 2, "desc": "Read symbolic link target path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::signal", "conf": 0.9, "crit": 2, "desc": "Install signal handler", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-pkgver-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a pkgver() function", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/config/system::config-etc", "conf": 0.66, "crit": 2, "desc": "Reference to /etc configuration files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::pipe-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "POSIX pipe creation symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "atk": "T1106", "conf": 0.88, "crit": 3, "desc": "Child process stdio pipe redirect", "from": [ { "off": 4839, "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-package-quality-metadata", "conf": 0.88, "crit": 2, "desc": "Cargo package has quality metadata", "from": [ { "file": 7 } ] }, { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword" }, { "id": "objectives/privilege-escalation/exploit/kernel::suid-binary-target", "atk": "T1068", "mbc": "E1068", "conf": 0.85, "crit": 1, "desc": "Targets a setuid system binary", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::abort", "conf": 0.9, "crit": 2, "desc": "Abort program execution", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::std-env-var", "conf": 0.86, "crit": 3, "desc": "Rust environment variable lookup", "from": [ { "file": 2 } ] }, { "id": "metadata/package/manifest/name::cargo-package-version", "conf": 0.85, "crit": 2, "desc": "Cargo package has version" }, { "id": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "conf": 0.4, "crit": 1, "desc": "SIGHUP signal ignore pattern (x86_64)", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target-word component", "from": [ { "off": 11487, "file": 2, "line": 304 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repository", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "from": [ { "file": 10 } ] }, { "id": "metadata/package/manifest/name::cargo-conventional-version", "conf": 0.85, "crit": 2, "desc": "Cargo package uses conventional version" }, { "id": "metadata/binary/metrics/structural::many-strings-large-elf", "conf": 0.9, "crit": 2, "desc": "Large ELF with 500+ strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/memory/mmap::munmap", "conf": 0.66, "crit": 2, "desc": "Unmap files from memory", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "atk": "T1106", "conf": 0.82, "crit": 3, "desc": "POSIX spawn attribute control", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setuid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setuid)", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/keywords::payload", "conf": 0.6, "crit": 1, "desc": "payload keyword", "from": [ { "file": 1 } ] }, { "id": "metadata/unsigned", "conf": 1.0, "crit": 2, "desc": "Binary is not digitally signed" }, { "id": "metadata/file/format::vocab-required", "conf": 0.97, "crit": 1, "desc": "String literal contains required word", "from": [ { "file": 2 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/system::system-lib64", "conf": 0.66, "crit": 2, "desc": "Reference to /lib64", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "conf": 0.86, "crit": 1, "desc": "Interleaved tftp command token", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-40", "conf": 1.0, "crit": 1, "desc": "Binary has 40+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::concealed-payload-mass-8k", "conf": 0.85, "crit": 1, "desc": "High-entropy region mass over 8KB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-remote-archive-source", "conf": 0.6, "crit": 2, "desc": "PKGBUILD fetches a remote source archive" }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.8, "crit": 1, "desc": "High-entropy region mass over 1KB", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/handle::fcntl", "atk": "T1083", "mbc": "E1083", "conf": 0.4, "crit": 2, "desc": "File descriptor manipulation and control", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/mem/protect/modify::mprotect-import", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "Imports mprotect memory protection", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::peak-region-cipher-entropy", "conf": 0.85, "crit": 1, "desc": "Peak 1KB region at cipher entropy", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6, "crit": 2, "desc": "Several local variable assignments", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/compiler/systems::expect-failed", "conf": 0.85, "crit": 2, "desc": "Rust expect failure message", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiler/systems::rust-src-path", "conf": 0.85, "crit": 2, "desc": "Rust source file path (.rs)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.9, "crit": 1, "desc": "Binary high overall entropy (packed/encrypted)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::urandom", "conf": 1.0, "crit": 2, "desc": "Access /dev/urandom", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.97, "crit": 1, "desc": "String literal contains invalid word", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "HTTPS protocol prefix", "from": [ { "file": 5 } ] }, { "id": "metadata/hardening/missing::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/delete::rm-f", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 1, "desc": "rm -f shell command (force, non-recursive)", "from": [ { "file": 4 } ] }, { "id": "metadata/build/package::pkgbuild-build-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a build() function", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/link/symlink::symlink-resolve", "conf": 0.66, "crit": 2, "desc": "Resolve symbolic links to canonical", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "atk": "T1195.002", "conf": 0.88, "crit": 1, "desc": "build.rs captures command output", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::needed-lib", "conf": 1.0, "crit": 2, "desc": "ELF needed library metadata" }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "conf": 0.86, "crit": 1, "desc": "Interleaved wget command token", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.66, "crit": 2, "desc": "Write files", "from": [ { "off": 4745, "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 2, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.66, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::unwind-resume-symbol", "crit": 1, "desc": "_Unwind_Resume exception-unwinding symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/loop::rust-while-loop", "conf": 0.75, "crit": 2, "desc": "Rust while loop", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-date", "conf": 0.97, "crit": 1, "desc": "String literal contains date word", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "conf": 0.7, "crit": 1, "desc": "ELF symbol tables stripped from binary", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/vars/access::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setgid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setgid)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.3, "crit": 2, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "metadata/package/quality/integrity::pkgbuild-unverified-remote-source", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "PKGBUILD fetches a remote archive with no integrity check", "from": [ { "file": 5 } ] }, { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.95, "crit": 1, "desc": "Cloud marketplace cleanup path", "from": [ { "file": 4 } ], "spans": [ [ 0, 8 ] ] }, { "id": "metadata/binary/linking/static::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::dev-random", "conf": 0.7, "crit": 2, "desc": "/dev/random access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-base", "conf": 0.66, "crit": 2, "desc": "Create directories", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6, "crit": 3, "desc": "ELF debug stripped with .symtab", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::open64", "conf": 0.66, "crit": 2, "desc": "Open files (legacy 64-bit)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::file-under-12-lines", "conf": 0.8, "crit": 1, "desc": "Very short file (under 12 lines)", "from": [ { "file": 4 } ] }, { "id": "objectives/supply-chain/install-hook/distro-scriptlet::pacman-scriptlet-hook", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "pacman install scriptlet hook function", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "conf": 0.66, "crit": 3, "desc": "Uses readdir64", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.3, "crit": 2, "desc": "Delete files by fd/path", "from": [ { "file": 1 } ] }, { "id": "metadata/file/catalog/identity::platform-domain", "conf": 0.9, "crit": 1, "desc": "GitHub or Google platform domain", "from": [ { "file": 5 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "build.rs waits on command status", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "conf": 0.3, "crit": 2, "desc": "chdir syscall symbol", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.3, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "from": [ { "off": 94275, "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::native-environ-reference", "conf": 0.75, "crit": 2, "desc": "Direct environ[] global access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::glibc-ref", "conf": 0.3, "crit": 2, "desc": "glibc reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::rust-async-process", "atk": "T1059", "mbc": "E1059", "conf": 0.92, "crit": 3, "desc": "Builds process via Command::new", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/compiler/systems::unwrap-failed", "conf": 0.85, "crit": 2, "desc": "Rust unwrap failure message", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/control/wait::waitpid", "conf": 0.66, "crit": 2, "desc": "Wait for child process state", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-2000", "conf": 0.9, "crit": 1, "desc": "High plaintext string count", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "atk": "T1056.002", "conf": 0.6, "crit": 3, "desc": "References real sudo binary path to wrap", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "atk": "T1106", "conf": 0.86, "crit": 3, "desc": "POSIX spawn file actions", "from": [ { "file": 1 } ] }, { "id": "metadata/package/metrics::import-count-under-80", "conf": 0.84, "crit": 2, "desc": "Large binary with few DLL dependencies", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "conf": 0.66, "crit": 2, "desc": "Read own executable path (/proc/self/exe)", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::gimli-crate", "conf": 0.9, "crit": 2, "desc": "Rust gimli crate (DWARF parsing)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::box-drawing-banner", "conf": 0.9, "crit": 2, "desc": "Box drawing text banner", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-core", "conf": 0.66, "crit": 2, "desc": "Core directory iteration symbols", "from": [ { "off": 5569, "file": 1 } ] }, { "id": "micro-behaviors/process/tty/terminal::isatty", "crit": 2, "desc": "Detect if running in terminal (isatty)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::rust-file-open", "conf": 0.86, "crit": 2, "desc": "Rust file open call", "from": [ { "file": 2 } ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "from": [ { "file": 3 } ], "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/data/archive/extension::tar-gz", "conf": 0.4, "crit": 1, "desc": "Tar.gz archive filename reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 BIND request opcode", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/config::sysconf", "atk": "T1082", "mbc": "E1082", "conf": 0.4, "crit": 2, "desc": "Query system configuration information", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/write/copy::coreutils-install-file", "conf": 0.7, "crit": 2, "desc": "coreutils install stages a file", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/random/crypto::getrandom", "conf": 0.8, "crit": 2, "desc": "getrandom syscall", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/control/wait::waitid", "conf": 0.66, "crit": 2, "desc": "Wait for process state changes", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/remote-command/keywords::command-result-word", "conf": 0.4, "crit": 1, "desc": "Command/result vocabulary pair", "from": [ { "file": 2 } ] }, { "id": "objectives/discovery/host/fingerprint::version-field", "atk": "T1082", "conf": 0.9, "crit": 1, "desc": "WMI Version result field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "crit": 2, "desc": "Iterate shared object list", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "from": [ { "file": 4 } ], "spans": [ [ 0, 24 ] ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "GPL license reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/exec::rust-command-new-call", "atk": "T1059", "conf": 0.85, "crit": 1, "desc": "Rust Command::new call", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/compiler/systems::rustc-path", "conf": 0.95, "crit": 2, "desc": "Rust compiler path in binary", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/anomaly/format::elf-relacount-present", "conf": 0.95, "crit": 2, "desc": "ELF declares DT_RELACOUNT", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::rust-backtrace-symbolizer", "conf": 0.95, "crit": 2, "desc": "Rust std backtrace symbolizer stack", "from": [ { "off": 84035, "file": 1 } ] }, { "id": "metadata/hardening/missing::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-license-field", "conf": 0.85, "crit": 2, "desc": "Cargo package declares license" }, { "id": "metadata/hardening/missing::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/binary::binary-usr-local", "conf": 0.66, "crit": 2, "desc": "Reference to /usr/local binaries", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::documented-cli-binary", "conf": 0.85, "crit": 1, "desc": "Documented command line program", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/setsid::symbol-text", "mbc": "F0003", "conf": 0.75, "crit": 3, "desc": "setsid symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.66, "crit": 2, "desc": "Process forking", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.9, "crit": 1, "desc": "SOCKS5 client greeting bytes", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pacman-scriptlet-hook-fn", "conf": 0.9, "crit": 1, "desc": "Pacman install scriptlet hook function", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/linking/runtime::imports-tls-get-addr", "conf": 1.0, "crit": 2, "desc": "Imports __tls_get_addr from the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "atk": "T1082", "mbc": "E1082", "conf": 0.3, "crit": 2, "desc": "x86_64 architecture string", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::interpreter", "conf": 1.0, "crit": 2, "desc": "ELF program interpreter metadata" }, { "id": "metadata/binary/metrics/size::large-file-1mb", "conf": 1.0, "crit": 2, "desc": "File larger than 1MB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/terminate/signal::_exit", "conf": 0.4, "crit": 2, "desc": "Terminates process immediately without cleanup", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::getauxval-ref", "conf": 0.3, "crit": 2, "desc": "getauxval function reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::rust-spawn-call", "atk": "T1059", "mbc": "E1059", "conf": 0.8, "crit": 1, "desc": "Rust spawn() method call", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/metrics/threshold::many-sections-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ sections (installer/packer)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::sigaction", "conf": 0.9, "crit": 2, "desc": "Install signal handler (POSIX sigaction)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-russian", "conf": 0.8, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)", "from": [ { "file": 2 } ], "spans": [ [ 38, 16 ] ] }, { "id": "micro-behaviors/process/create/exec::spawn-api-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "spawn API call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn with FD actions", "from": [ { "off": 4931, "file": 1 } ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Script overall entropy stays low", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::addr2line-crate", "conf": 0.9, "crit": 2, "desc": "Rust addr2line backtrace symbolizer crate", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.7, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-version-string", "conf": 0.8, "crit": 2, "desc": "libc version string pattern", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "conf": 0.66, "crit": 3, "desc": "Uses fdopendir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "grep command keyword", "from": [ { "file": 5 } ] }, { "id": "metadata/build/package::pacman-lifecycle-hook-fn", "conf": 0.9, "crit": 2, "desc": "Pacman lifecycle hook function declaration", "from": [ { "file": 4 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 1 } ], "spans": [ [ 1480, 3 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-25", "conf": 1.0, "crit": 1, "desc": "Binary has 25+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/setsid::import", "mbc": "F0003", "conf": 1.0, "crit": 1, "desc": "setsid() function import", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "conf": 0.8, "crit": 2, "desc": "Low ratio of sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/binary::usr-local-bin-dir", "conf": 0.66, "crit": 2, "desc": "Reference to /usr/local/bin", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/structural::sentence-strings-20-plus", "conf": 0.9, "crit": 2, "desc": "Binary has 20+ sentence strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extension::tar-gz-or-zip-text", "conf": 0.9, "crit": 1, "desc": "Tar.gz or zip archive extension in text", "from": [ { "file": 5 } ] }, { "id": "well-known/malware/botnet/mozi::xor-pattern-2", "conf": 1.0, "crit": 1, "desc": "XOR loop pattern variant 2", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/identity::pkgbuild-basename", "conf": 1.0, "crit": 2, "desc": "Arch PKGBUILD package recipe basename", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-legacy64", "conf": 0.8, "crit": 3, "desc": "Read file status and metadata (legacy 64-bit)", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/capture/sudo-pty::execvp-symbol", "atk": "T1056.002", "conf": 0.6, "crit": 1, "desc": "execvp child-exec symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/provider::openssl-static-keys", "conf": 0.8, "crit": 2, "desc": "OpenSSL/BoringSSL static key markers", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiler/systems::rust-binary", "conf": 0.95, "crit": 2, "desc": "Rust-compiled binary", "from": [ { "off": 137915, "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-package-name", "conf": 0.85, "crit": 2, "desc": "Cargo package has name" }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendmsg socket call", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmsg socket call", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::i18n-validation-vocab", "conf": 0.97, "crit": 1, "desc": "Form-validation vocabulary in dense non-ASCII file", "from": [ { "off": 10060, "file": 2, "line": 266 } ] }, { "id": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "conf": 0.95, "crit": 2, "desc": "Joystick, gamepad, or DirectInput keyword", "from": [ { "file": 1 } ] } ], "type": "gz" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91Ak.[V00000kMy=:00000[r:{\u003c0000000000kMA+z3\u0026\u0026J)ble\u003e!1][S61onA4kMy=:00000kMy=:00000kMy=:00000PAk8[00000PAk8[000002MK\u00268000000@@r31onA4?#S(U00000?#S(U00000?#S(U000008#]%s000008#]%s000000rr9", "n": [ { "c": 3, "d": "Shared library binds dynamic loader", "i": "metadata/binary/linking/runtime::library-loader-dep", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000001onA41onA4}#M\u0026#00000}#M\u0026#00000}#M\u0026#00000l\u0026Wh!00000l\u0026Wh!000001onA400000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B1onA45c8Xg0rr91m]04:000001][S60rr91000001onA46Awak0@@r3m]04:mUF[g?0\u003c^w+0eyn+o38zw:lTL0000000000000000000000000000000rr915=.[i000000000000000000006951jaohxw0000", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 736, "z": 27, "cf": 0.66 } ], "ln": 640 }, { "b": "uUsj]zEmEbvrcD%uJsC8r83.gwPzu{x(!xcA-t+2y\u0026si5raflLwDl7er83.uwOkZ#By/F(o*--nzE(^QvR/PQuTEq/vp9RXzEEu}DsW7[wO\u003e{@C(Rq-zeYFZrC)1{zE^9LwPJ0hwDljRz/YE\u0026zdNN3z*2W(zdNN9wPN]?wO\u003e{]z#:P[vruQp0af8Py\u0026-@@wPRo/wmPYXwnCQ!By/G3By!/#xK(b-zfo-kvq(i/D2)F7y?%8\u003cBzbYavpS.NBAzLgwmY?7A=lj6A+eV\u00260af8AA=M5ouU\u003cT\u003cvruj4zuafWwnc5:uSy#/x(mD*m}D^lpYLctBAzkc0b(*/zz\u003crKz/xo9vrsy:0bVHZx(ThXrC)1{zE^9AwPQ).CYV?{y^IMKwDl7qzG//jwm4\u0026rBvoLVvnZVMlsB}D0aPX.z/oZ$xjVf@zGV23BAhhezuaJZy\u00261310b#\u003c$x)s04wO\u003e\u003c(x\u003eIq-w].D]0chTVy\u00261310c-D$By+CZvqG:#v/QjYv@#I!AbPMe0chTXB]Vb:zGGW{CxdztwP!5]wN/[2B7UF=wPR)9wb{WZzE^Q9x8()+wm/vVB8UMizG2O%z!0M]Bz$V5ASxY\u0026A++U]z/YSquVQf{CwZ=1x(4u/vpKy[z/fS6vpS[UxK\u003e*$uV6/.AbP/iCWCJhvrVP@w[=6)uTWC^x(v)guTWFQv}Yy!ASy5%B7](aB8UMizEETeA:JJ#x(\u003ct]z/YSquVQf{CwZ=1x(4u/vpKy[z/fS6x(mTb0b#\u003c$x)s0aAa9%duUj1*wNw\u003eQBzkVhB6\u0026u^wmP?4g5#oiB7](aB8UMizEETeA:J)0Bz$(kz/{10AbP/iCWCJhvrVP$BAzLgB7GD9y**%$0b#\u003c$x)s0aAa9%duUj1*wNw\u003eQBzkVhB6\u0026D?B98CvC(R/4B7](aB8UMizEETeA:Ju*B98CvC(R]1xjU}0BA}}sBo3w@xjksYB7GB[AbP/iCWCJhvrVP$BAzLgB7GDmx\u003eH%/w)]*#Bo2(\u0026C4\u003e#nzuaS]B7](aB8UMizG2O.wQ4{h0aZj\u003eg5#xbBz2SjB-qy4B7GDax\u003edi+wPS6ewb{WZBz$(bwb{WZBAqeb0cq\u003c!zEEtYwQ4=@C5NC2x\u003eg*^uUr}(Aa@?.Cvticx\u003edi+D2)FlzE@(/x(ESs0a{p]vrsy:0ae-zCwg@9uQwghyJKP9v}tT:vqf?5x\u003ediOx(W/@0bMZ/wOTgX0aZj\u003e0axtPA=.q2BzbYavpS.^wO+@UAcb=lwNPaRxjVf[BAzLgzG2O{BzbYavpS.NBAzLgxjVgaBywV{0cq\u003c!vpKy[z/bL]vrDT50b2\u003e+v%qC-B-82fzFGk*B97\u0026jhz+zPByxnHgYR9ix(\u003ct(zddxwgYRMcvqG)\u003eBz7U{wNPa=x(mX^B97\u0026jCMqw/BAg/cwn=q+uTEq/vpaa\u0026A+eV\u0026uTX4/CXInbx(d*90c03[A+eV\u0026uU:j#uT[a/vru5XAcb=lwNPaRyH}=#wmYN*By+C\u003eBzbYavpS.^wPS0jwN/B^x\u003e4cPwn=A#zE^E40chTVwmPy{hz+zRzFT38yHIq+xkR\u003c0xjVf(y?Wu*uV{13B7]Mg0b2\u003e+vrD*rvqC{+x\u003eH\u003c\u003cBAqLjv}#6-BzbYavpS.NBAzLgxjVf$BZYr3B7]@i0bVW}z//M2Bo2VPCYmq5B98ClA=M8suVDcRy\u0026sxawnc5:uSy#/x(mD*m}D^ovqY.2vp%dIAaJJ[w[+:yvrt]TuSy#/x(mD*m}D^lp!tLpzVBcAzG//jwm4\u0026rBw=W.x(v(/Byxii0ae-zCwg@9uSgJTm]xs]rC)1{zE^9MwPQHu0ae-zCwg@9uS7rDB7E^+v}xR3x(v\u003e?uSy$", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 5408, "z": 6, "cf": 0.92 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 4764, "z": 4, "cf": 0.66 }, { "c": 3, "d": "Uses recv socket call", "i": "micro-behaviors/communications/socket/receive::recv-symbol", "o": 4769, "z": 4, "cf": 0.66 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 4787, "z": 7, "cf": 0.66 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 4802, "z": 7, "cf": 0.66 }, { "c": 3, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 5683, "z": 8, "cf": 0.66 }, { "c": 3, "d": "Uses fdopendir", "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "o": 5559, "z": 9, "cf": 0.66 }, { "c": 3, "d": "Uses readdir64", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "o": 5569, "z": 9, "cf": 0.66 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::delete-comp", "o": 5579, "z": 8, "cf": 0.3 }, { "c": 3, "d": "Read file status and metadata (legacy 64-bit)", "i": "micro-behaviors/fs/file/stat::stat-legacy64", "o": 5273, "z": 7, "cf": 0.8 }, { "c": 3, "d": "Imports mprotect memory protection", "i": "micro-behaviors/mem/protect/modify::mprotect-import", "o": 5657, "z": 8, "cf": 0.9 }, { "c": 3, "d": "Child process stdio pipe redirect", "i": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "o": 4876, "z": 33, "cf": 0.88 }, { "c": 3, "d": "POSIX spawn attribute control", "i": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "o": 5124, "z": 29, "cf": 0.82 }, { "c": 3, "d": "POSIX spawn file actions", "i": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "o": 4931, "z": 29, "cf": 0.86 }, { "c": 3, "d": "POSIX spawn with FD actions", "i": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "o": 4839, "z": 36, "cf": 0.9 }, { "c": 3, "d": "POSIX spawn PATH execution", "i": "micro-behaviors/process/create/direct::posix-spawnp-import", "o": 5162, "z": 12, "cf": 0.9 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 5232, "z": 6, "cf": 0.8 }, { "c": 3, "d": "setsid symbol text", "i": "micro-behaviors/process/create/setsid::symbol-text", "o": 5218, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Set group ID (capability)", "i": "micro-behaviors/process/identity/setuid::setgid", "o": 5196, "z": 6, "cf": 0.6 }, { "c": 3, "d": "Set user ID (capability)", "i": "micro-behaviors/process/identity/setuid::setuid-dup", "o": 5203, "z": 6, "cf": 0.6 }, { "c": 2, "d": "IFUNC-related markers", "i": "metadata/binary/linking/runtime::ifunc-markers", "o": 5609, "z": 9, "cf": 0.4 }, { "c": 2, "d": "Imports __tls_get_addr from the dynamic loader", "i": "metadata/binary/linking/runtime::imports-tls-get-addr", "o": 4507, "z": 12, "cf": 1.0 }, { "c": 2, "d": "Iterate shared object list", "i": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "o": 4520, "z": 15, "cf": 0.5 }, { "c": 2, "d": "chdir syscall symbol", "i": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "o": 4594, "z": 5, "cf": 0.3 }, { "c": 2, "d": "Create directories", "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "o": 4637, "z": 5, "cf": 0.66 }, { "c": 2, "d": "File descriptor manipulation and control", "i": "micro-behaviors/fs/file/handle::fcntl", "o": 4774, "z": 5, "cf": 0.4 }, { "c": 2, "d": "Open files (legacy 64-bit)", "i": "micro-behaviors/fs/file/open::open64", "o": 4621, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4572, "z": 4, "cf": 0.8 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 4745, "z": 5, "cf": 0.66 }, { "c": 2, "d": "Read symbolic link target path", "i": "micro-behaviors/fs/link/symlink::readlink", "o": 5451, "z": 8, "cf": 0.8 }, { "c": 2, "d": "Resolve symbolic links to canonical", "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "o": 5442, "z": 8, "cf": 0.66 }, { "c": 2, "d": "Maps files or devices into memory", "i": "micro-behaviors/fs/memory/mmap::mmap64-fn", "o": 5435, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Unmap files from memory", "i": "micro-behaviors/fs/memory/mmap::munmap", "o": 4536, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Direct environ[] global access", "i": "micro-behaviors/os/env/access::native-environ-reference", "o": 5154, "z": 7, "cf": 0.75 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 4696, "z": 6, "cf": 0.4 }, { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 5466, "z": 9, "cf": 0.8 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 5325, "z": 5, "cf": 0.9 }, { "c": 2, "d": "Install signal handler (POSIX sigaction)", "i": "micro-behaviors/os/signal/handler::sigaction", "o": 5385, "z": 9, "cf": 0.9 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 5225, "z": 6, "cf": 0.9 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 5259, "z": 7, "cf": 0.4 }, { "c": 2, "d": "Wait for process state changes", "i": "micro-behaviors/process/control/wait::waitid", "o": 5252, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 5299, "z": 7, "cf": 0.66 }, { "c": 2, "d": "Duplicate file descriptor", "i": "micro-behaviors/process/fd/dup::dup", "o": 5321, "z": 3, "cf": 0.5 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 5181, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 4834, "z": 4, "cf": 0.66 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 4795, "z": 6, "cf": 0.3 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 5176, "z": 4, "cf": 0.4 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 4498, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 5267, "z": 5, "cf": 0.85 }, { "c": 1, "d": "_Unwind_Resume exception-unwinding symbol", "i": "metadata/lang/compiled::unwind-resume-symbol", "o": 4456, "z": 13, "cf": 0.5 } ], "ln": 4360 }, { "b": "e]$}-f-TZhlTIS4fAsQglTIS4gxo{jlTIV5ga\u003elXy?Wu*e]$}-hullvnKt^Kga\u003esmh2{cunKt^Kga\u003eu.m[=GvlTIP3gCgG:m[=GvlTIP3gYQ3tnKt^Kga\u003eM!m[=GvlTIP3f/e(2oI4MruOTk*h2{cunKt^Kga\u003ept07PZOlpk9ne?]r=m[=GvlTIP3gbP54oI4MruOTk?h#(DxnKt^Kga\u003esx07PZOlpk9ne\u0026bfYm[=GvlTIP3gCO@2oI4MruOTk\u0026gxo{snKt^Kga\u003evt07PZOlpk9ne\u0026bG/yY", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 5944, "z": 5, "cf": 0.9 } ], "ln": 5848 }, { "b": "uU0.SB.tc0BzLVezc+uoekUUxCTnidAt%?D0000000000%nSc0%nSc02MK\u002682MK\u002682MK\u002682MK\u00268fFLssg=mfIi5%n\u003elQTvjvCv0J4PFOb)dPO\u003c\u00262m:3xM4]yCwhejePbczy?W=#eIeLaeIeLa0000000000zeS%5vrco%B7GDsvQ%4(0SSi20SSi20SSi200000001Yu001Yw0000000000v@Dm5wN/*@z/cXrwPIB80rAi40rAi40rAi40rAi4AEXpAAEXpAAEXpAAEXpA/w#GmD%TlB", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 79940, "z": 4, "cf": 0.8 } ], "ln": 79844 }, { "b": "(^EscUy/Zky.O6oarR^HarR^HarR^HarR^-n=]7)lJWt/lJWrtvflH*vflJelJWs+vflI+vflHMu\u0026{AdlJWt/lJWt/lJWr)vflIB6^dv4yH}E2xcp!{x(4u\u003eazbLjasB@acKG\u003c?g:3HAaARpdayYFcy?aV2vqfK?wftA9wGV8kayMyfx(!ufzF77*m]gszwQb*HA=(mX3igJ0k0y8\u003cvrcm1zF80MZ-%$oB0a)lB9RRsx(mYe\u0026^^moA+e\u003c9B7]J8aARJAA+eV\u00263im\u003cxaIX0+055wnB97[Bh90SIh-rxGwIE!9gbQ)xh.)j0w[2gUf/iA1ix5\u003cbh!s*OgDmoDfkLuiA::0lfjwWkz^$CwA:{+jz!%l3v@#B6zGvEuBAg@7fkUcpfj/3yA^ooTA@Vn5aIW%TtFHnB02ouZzeTDuayP85z!0i$x(v(iz!pcc4J]kaBy/Iow)]y\u0026wN(bFZYDLtZYjQsz//A7iV#iMaAg+0yHH\u003c!d03*WBz\u0026pvA=(nh3ih.)z/65swmYO0vpJ./fd{:yA+xqzA+e($B98CFflqezfkkrmwQ2?qA::63B1RfBeIPmxiB=UXv(v^NvL{24w?NUgvq]N.B.LV5wPxvVe\u0026CsoflqezflIwJy+Gypvrt\u003c[vq)\u0026tA@Vq\u0026eIj:rflhhRByM%YixeYKhzEa3f\u003eK\u0026Hh8E0CgbJDLvQS+3g?nK9h-th9wI^*Ki5SDzy?Wv0vrcSDvqG:#v\u003eR[zv\u003eR[BA+PA7e](1k0sDQytFHq3aoj6dz/65swmYO0vpJ./fd{:yA+xqzA+e($B98CFflqezfkkrmwQ2?qA::63B1RfBeIPmxiB=UXv(v^NvL{24w?NUgvq]N.B.LV5wPxvVe\u0026CsoflqezflIwJy+GBwvq])jA=RjlA=(CBv\u003ePY1i50oHf/AO$w))CLg+Z\u003czg?76avpI2Gwh=IchE[:Tg*@g1hzu!2x\u003c#9\u003eA^orVByW4CA:{+zD2\u003eSMz.C*yuVQ3$v}vrcz*2Y4e](1k0wqg6055wnB966CwPhYzxk8j0x!q1\u003egCQNsflqezflgSjwg}w2vSD46e](1k5mGT3wPz)bz/cX9y?mj2aIXKhA+Pf1Bylk6vqfK?wi7\u003cG2)}^$y?mj2iV#iA3lTw6xj#xFaIW#)0sw/cjIQ$Y05527zdLwhwO=D%v{%Eje[nsgxkYCzwOkZ#BAhTWB8\u003e+zx(mD)CRiGDvru74e[]kQf/.6Jv}EYghEXKMh8Ns8fjw:tBA}XleIO\u003eie?]goB8\u003e+zv@Dg4AXqxN055wnB97[Bh90SIh-rxGwIE!9gbQ)xh.)j0w[2gUf/iA1ix5\u003cbh!s*OgDmoDfkLuiA::0lfjO{vwInaBv\u003eR[tx\u003e7ZczdNM]xMt.CA@Zo4v\u003eRXcx(kLzA@-#RaIYfzAa9l(vp%d)ayPq4aAIvcBy!#9w]zYjA+f9aC42ht3igVQz/^aoze:r5zdNQbwN)?AZZ}Saz/^agaxix7wKyxLz/L?hxM4:0fjXTgBywV/Bt2m!B-RUEA4=rKz!@]%vqfR2flqkzvR/QcCSmP*hz^1dzFKcdCwY0Gx(n6reOw%zfkLuiflhhRBzLV2flqezflhhRBt4DAvSC)$C}TkXwg@1Av\u003eR[GzEUtrzEWlgA=Ri*ayMylx(dN2vr9Ha2{r/7x(!xqiV[zQA=(CBv\u003ePY1i50oHf/AO$w))CLg+Z\u003czg?76avpI2Gwh:", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 82317, "z": 6, "cf": 0.5 }, { "c": 3, "d": "Recognized runtime ships fork+setsid", "i": "objectives/persistence/system/daemon/init::recognized-fork-setsid-marker", "o": 81314, "z": 47, "cf": 1.0 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 81189, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Rust std backtrace symbolizer stack", "i": "metadata/lang/compiled::rust-backtrace-symbolizer", "o": 81908, "z": 14, "cf": 0.95 }, { "c": 2, "d": "Rust-compiled binary", "i": "metadata/lang/compiler/systems::rust-binary", "o": 81401, "z": 9, "cf": 0.95 }, { "c": 1, "d": "Go allocation symbol bytes", "i": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "o": 81369, "z": 7, "cf": 0.76 }, { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 81591, "z": 12, "cf": 0.86 } ], "ln": 81093 }, { "b": "y\u0026\u003c8}vrsdPv{%y\u003cz.Dcxxk8BeA^orVA:{+pzE^s6e[n{gBy/ICx(tNTiw-:aw\u0026KoUvL}QLh8/b2v@bN)uU\u003cp#eIO\u003eje?!@1A:{+lCYUMUA@W\u003elB-RTTwmY.3fjwy4AX.DBzE\u003eyNe\u00262ppf!WP*v\u003eRCpzEW^5z/dgFA@W\u003elB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}TkXwg@1Av\u003eRCax!KyCuVQsfe](1kflhhRByM%YixeYKhzEa3f\u003eK\u0026Hh8E0CgbJDLvQS+3g?l", "n": [ { "c": 2, "d": "Rust addr2line backtrace symbolizer crate", "i": "metadata/lang/compiled::addr2line-crate", "o": 84035, "z": 18, "cf": 0.9 } ], "ln": 83939 }, { "b": "d8k%dz!pcc0X2nc2oUAXlq]ru0kFPI6D?QrA+]nsB7GCoB-p(1By!#9d8lGswO#Qgx\u003equdv}Yp*xjUQ5e^.Oeo\u003e!V=vru0)ayX]7Cv+u6ay]4}x(mTbx(v(ivqYP#vpJ!UB8@Exw/$G%17i-7ZYl33z/65swmYO0vpJ./fd}o/B98LzflzbJy?4c!x(m#BB97\u00261y?khyi5Ub4g+A\u0026/yI[6mzy]WszGQgQxkR\u0026By?WuiA=(CBy?WuiB8\u003e+zA=(CBfkLuiA::0lfjwWkz^$CwA:{+jz!%j", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 86501, "z": 3, "cf": 0.8 } ], "ln": 86405 }, { "b": "wNPa5x(mD)CRj2T06a+hBy/GgvqE5$A=M8siV@0KBy/G7wfu2jA+eV?xKLv^wGUG3wmW!AB98B-i+AzJzc}Bcw\u0026IiO1sUDRaIYfzCvtLnwQ5f9v@#o)aARJAxKM6}atC0GxKL{jayYFnaIXNiv}Yp\u003eB0bWrA+cw9z/]@d055wnB966CwPhYzze0)4Ds7Pnx\u003eg^bfFksqiwkC]v\u003eRLlw]7)$wImLiA+c\u003ezA@:0uaAg+0yHH\u003c!az\u003eLjaz#ataz2!iB95KszxIkiq.xg(A^n^Kx([3bB-X-T", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 89372, "z": 4, "cf": 0.8 } ], "ln": 89276 }, { "b": "AbYJexcpU(v@3gbvpJ\u003c\u003eAb]VgBzkS9aARJAvrMN6wft\u0026fBy/uix\u003c\u003e*2A+e:6A=U@kzvcxV0u/e]iV}%KCw.5lvpT7\u0026xcqe4v@2H=wG.xXdlY{VavQr\u003ez/N(YB9h2iaz(oAv@DHawft=dBrC47aAIHgCwZ#5iV#is3igcPeX?t!eX?utxM4:0fjXTgBywV/Bt2mRvrc10flgSpx(!xpC}TkVv\u003eRLlwmZ0rv@=11wPGFrz.iX7g=Y5TiaB\u003cQhdwB2h!BZ:BAhCpz7NB]f!\u003epnflqezfkLui", "n": [ { "c": 1, "d": "sudo command keyword", "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "o": 90085, "z": 4, "cf": 0.7 } ], "ln": 89989 }, { "b": "azC)tz/{dAz!pb3z/]@dB0bykayI$=v88:+k0zdMmriA!AV/Nmx([6bxcp/8AV/BCwn-PjwO0[BZYs=xZZRzNz/6DfwPRG]arS8F1r.R{aIX4caIX0+0kI5Dra]#!ayO=4x(v(iv{%l$A+f9aC4z!gze:AlByx6eaAg+0yHH\u003c!B0hU$zxJ\u003erwmY^7Bz\u0026phwGV55w[u0laA.:p3ig/8k0y8TCX7xcBzkVhaz2Olz/M%GZYM2DaIX0+01Hb)z/65dB7]G9y*?ubZZk68wQ4{gBugJAjACQ+", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92931, "z": 4, "cf": 0.8 } ], "ln": 92835 }, { "b": "B7F^2v}YN]xcoGuqz6NO3ih-1B-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}SVCA+c[BA:{+jwO=foz/f5@e](1kfjXTqfk+]GyYDbeB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}TkXwg@1Av\u003eR[GB1.Gvy+G{Gx)qpFz!7FvA@W\u003elB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rve", "n": [ { "c": 2, "d": "/dev/null (legitimate discard device)", "i": "micro-behaviors/fs/path/device/special::dev-null", "o": 94275, "z": 9, "cf": 1.0 } ], "ln": 94179 }, { "b": "jrM[kz/PV8au*bParUljwPzA{auQ+#ePVhPv\u003c3dweIgWOw]w!Q3lQDlwO(10xjShqePLAzB.$XjtoCHHAb]JiwO#33D($0)vrlibD($0)B8bGew[=pbBrB\u0026@arR!rzdN:2wGSMRxK#103qUR.x(v)giV{1Uf\u003e0BVl$H4bzG6Vtr^4:QarR^HarR^HarT(heIgyuB08OFarR^HarR^HarR^HarR^HarR^Hayc9]at2fNB-FPEarR^HarT}%arR^HarR^HarT(heIg)Uy\u003cvQMwPhNearR^HarR^HarR^HarR^Hayc9]at2f^yIv:bxk!$oarT}%arR^HarR^", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 94824, "z": 26, "cf": 0.94 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 94807, "z": 13, "cf": 0.95 } ], "ln": 94711 }, { "b": "zF-%9xjShdD($0)B-p(1By=NqarR!Oat2f=wOkN(eQ8bNy?aU]3lQDlarR^HarR!hat2f*wPz\u003caz/cWuarR^HarR^HarR^HarR^HarR^HarR^HarR^HaybrYarR^@z/M$qz/PzixK#10ay/tcB9hqvaARpdaw$S]l}{9hazt\u003esAc15[fk20vxMW=pv@DiqrC(tUA:@K1fF+TvvrDQ0eOe^gA+w}\u003cl3mo.z/N(YrC(tUA:@K1fF+S{flItRfjFTkfjw{vk0zdMnnh%-iV@cOB97\u0026by-)c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 95536, "z": 3, "cf": 0.8 } ], "ln": 95440 }, { "b": "wPF#oxKM09Cw?Ruwftt)az\u003eXgxjUQ8azCZoz/Px1AYMM@y?4Q7vruj3xcp.@AaJ]$wO#0(wPGERe*aXyzE\u003c%#asWy@ZYCS3.YO{V2M$bfaycb90sw*az//A7flz5Ifjx0zvj=5cwPzA{eN-afk0zdg0000007omOmnccqr6+zEr://!wLNe=mSiA!wk)nWwN[OVBy]5aaW3@1f:Y3CarR^Hat2fNB7w\u003c3B7foay?dH2xjVsfwPzVhb4LnawO+{/BzUPhvpS!*vnGP!lrcPJl$x\u003eFv@bZ+zu", "n": [ { "c": 2, "d": "Unix /tmp/ path reference", "i": "micro-behaviors/fs/path/temp::unix-temp", "o": 95803, "z": 5, "cf": 0.7 } ], "ln": 95707 }, { "b": "BAg@7yhWN5=cjx}eMcFceM380mmoZDayPslwo\u00265nx!.w5006/:eM3jlq!W\u003cpfe2NyuN)YYflQ=AfjXJBAbf7[vrb\u003c\u003e3nlNhAXy{hv}YBbwncabw[=6)A%:McflItRfjFTkflqnDz.DlOAXy)ozzc9ywIngEAXy)ozzb\u003cIflItRfjFTkflg[Yq/BruAb]VgBs?9yA=2lbc2K?KB$CpQz!%ujzE[05A+GMpAc15[fk20vy**^9vrb\u003c\u003ey?W^fCRi]Pxd)Xlv}YW)zGQgSAa9l(vp%p(xd[jjv@2H=wPGCAw?tPKvr:wCx(dAsmriA4wPRAnwO(10xjS-uz/PV8e]$PCfj/lnfj/0iA+w@pCw?Irwg?}mBs}VLA4LV=k0y9kz/PV8e]$PCaA.Tlvru6\u003ee^:^aj%ipmA=k$VaAIWozY\u0026[uazb4@y?mc1Cw7M9azbt9vqGU7x(mMaCw?Irwg?}mBs)[:k0y8TA=M8siV@G^wn-PjwN##}CXInhwfu8gBn", "n": [ { "c": 3, "d": "References real sudo binary path to wrap", "i": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "o": 96544, "z": 13, "cf": 0.6 }, { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 96699, "z": 5, "cf": 0.66 } ], "ln": 96448 }, { "b": "awM?$z/P/gvqYT!aAg+0yHH\u003c!B0bWrA+cw9z/]@daA8cuD2E?CaAI*HBy/qw3uZl6wPzA{k0zdMmriA!AYLsjvqfK?wft#jay/7@v@0i0z/M$sA=tY2zGvAqk0zdMrD8O\u003evpT7\u0026xcqnvB97#gasIeuw[+:?vqE6bwPhNedk0k93o*Tqaxrw[A:-G)zF77Trz\u003c@UvpK7YxjVcpe?NF.l3kvPj%ipmA=k$VaAIHkv}/L2aAg+0yHH\u003c!B0bNyay]58wO+{/BrCgoz/3Rvz/PV8e]$PCe^:^aj%ipmA=k$VaAIHkv}/L2aAd", "n": [ { "c": 1, "d": "Shell execution wrapper", "i": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "o": 97485, "z": 22, "cf": 0.8 } ], "ln": 97389 }, { "b": "azbB#xlcHop/HN%qBK2LwOD46Byx04ayP85aA}:Ay?aVcyIdY^mn)hXmn^YrB.$XjvixJfwP?^aB-RwAazC.nwPz*lAcbV4az\u003eXgxjU1mnL?(FqD3K[yIv-gBzbkdw[=pbBrCKhv@2H=wGUY8aARpdaAz4mB.$Xjy?W%jp/pp*mn^Ylz*2XmAa9l(vp%d)az#atazCZoCw?Irwg?}mBrz#JA=(nhdn\u0026P8mnu-(xjU%(A::63aAg+0yHH\u003c!az\u003eXivpS!*vix5*v}YA@c#@)iwO@}{mmP^wuSQ33oHI+", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 99621, "z": 11, "cf": 0.86 } ], "ln": 99525 }, { "b": "0009300093000310@@r30@@r30@@r30000200093000930000000ri30@@r30@@r3000930009300093000001onA40000000000006!njIQ$Y:SHOlu\u0026Qfbat3Agx(n2nxK#10asIqxwGU\u0026dA+cwqx([2hcOl]-wO=rkdnU50zGE1mwO=rdd05%hayMylB.$#7A^n^Kx([2hcOo0VdrYoyB7]Mgp\u0026Zn/BrCWsx(+zlwPI{3xjSi7AV/EqwGUU$y\u0026yInw/#hewGUS1C4CLlB9g@4z/6u1zE+epdrxSvv@Dj3vqYQypFBLHpdeIkl${ZYy*?Pix(d*9wO(0@Byxo9z/cXrwPS6nzE)u3vqWi0A=M8saA.NkCYmk7By/00D1go0y?mc1u@yMSB.(dXi^2s:A:-]ndpsopzxJw9ayESUA:Q2kvqH6$00000", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 106006, "z": 128, "cf": 0.94 } ], "ln": 105910 }, { "b": "z/Pzivrc16zdNQbBhd#\u003eA=M8si(@GAFm5uS0u.xTZYX:[A5#8-0dXCT000xHvixS9ze0/{AV\u0026d8az2!iB98E:asB$u:SHOlu\u0026ZldcJBe{Z}!5m0dXCS00aCEeIgTEy\u0026Eh9:SHOlu\u0026Qfb8dsUhvqH6$azC)tA+flkx(W=}azbLjasB$u:SHOlu\u0026QfycM((vBrCEtzE\u003c@mvriMjB-qqox\u003ep/P4@2{8vqGT*aA?gfB.8WyZ}!5m0dXCS00:\u003e]w]zYjc==t?Z@WY0Fm5AU0vE\u003e^z/Y#lvR/P#C3$", "n": [ { "c": 3, "d": "Network-capable utility profile", "i": "objectives/supply-chain/trojanized/backdoor::network-client-utility-profile", "o": 112540, "z": 6, "cf": 0.9 } ], "ln": 112444 }, { "b": "B9g@4z/6u1zE:(0B-X:AzE\u003c@mvriMez/^avA=lbnwmYoKB9g@4z/6u1zE^/e3jomvAV/jqA+cwczF0*czddK2z/d9GBAhTHc=0Ktaol}10009Ge^.OUzFKcdCwXKiA+xJiwO#Pjz/M$kA=l8tazCvsarTx!yH[SfB-I4oD2E*Fvrb{4B-RnmxcqqfwGUA4xlw65zGE1nwftq#wft=dBrCWswGV5cz/P}xz/M$pz/fhgw]7)*A%+uRA=k$DdmN-/vqE62zGGDgzEEu7wPz*fAXnFhy?m3@wGUG3zGxH", "n": [ { "c": 1, "d": "Interleaved wget command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "o": 113452, "z": 11, "cf": 0.86 } ], "ln": 113356 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ze0J6j%jVMzDg^\u003ci7m\u003edz/Q2fy?WA!B-pYfz!i%fz/Pi3wO#v0wfs5Uy?mG]vqG:\u003ewftnTwPJ0gBuhE9zG*bfA40eyaA8cuvqWh}mriARaA?gfB.9YPtqv{I8^tcWgI[7ng=^Eg8^tcWheKppg=NMOj8C{vgDmDNi#.xYi6e#V8^tcUj2e(V8^t9Tj2e(ptqXx4gclBVg+-+=tqO6K8^tcOz5VXogI[7ng=f4*tqOiO8^tcSz5VXoh/fHrf!+p#8^t3Jf(m\u003elf!+w18^t2", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 119972, "z": 91, "cf": 0.85 } ], "ln": 119876 }, { "b": "Cw7YbwGU\u0026dwnbU3x(mMax([zsB97\u00262yANLswPzy0z*9srzF0*czddK2z/d9GvpBd}BzkS93t9Z*vqE6bB-8qnzdK\u00263A=M8siV}%Nz/u?qw/#hewGU@2zFrP6Aaa3dz^^f0Aa9S#v@2T^efFwgz/P@lzF6qsB-889zdNlwuTE?@B97=2zE^9}xM4{kuT^CNyJKP9v}x1OA=(CBuT^OVx(mp0xM4{kuT^CNyJKP9v}xZlwmYj)xj27RvSD46e[xfAe[wK5B.t5\u003eBZF\u003c2wmZ0rwmYj)xj2v\u003cw]xp", "n": [ { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 127807, "z": 7, "cf": 1.0 } ], "ln": 127711 }, { "b": "az(mxBrC47aAz4nxMw3nzy=]svScpex(mL\u003cw)]^\u0026y-)+vzGGPfwGUM8A=k$Vax0u6BrC74zF\u003cxmay!\u00264v}V#%z/PA6xkO\u00266CW\u003er7BzkVhB1wCxvScpex(mL\u003cze0J6j%jVMzEW9\u003ey?mc1u@yMSB.(dXi^2s:A:-]ndpsopzxJw9ayESUA:Q2kvqH6$w)]^\u0026y-)+vzGGPfwGUM8A=k$VayPtjwPz)bz/cXfvqfK?wi7\u0026GwQbzbB0bQDx)KtkaW3@vmoJ$@mnu/.k$\u0026*LvpBd}BzkS93uQi8az\u003eL8C{3K9Bzk]faAz44wftYbv@3cdz/cW}Ct8{+yHIp9wPz)bz/cXfvqfK?wi7\u0026EB6\u003c6cy\u0026r*0wN)igByxo5drw{nx([Ryv}YB-yJ9##w[km\u0026Aa9%dA3fjAv}f7YwmYo]vS==nBzbkdv}YN)wg8Bvp!s4$", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 128342, "z": 128, "cf": 0.85 } ], "ln": 128246 }, { "b": "z/65dwmY\u003c\u003ex(4\u0026kvrb{4z/6igBy!#laAzQxaA}KwxDQXXrz#\u003e7lp0$ir8M1HmlLm9y\u00260G4w]zYjvix-8A:\u0026%dwGUC\u003cv@3gbvpJ\u003e33t9ZXy?mc1Bz\u0026puAaJ]ffjXTqflgGswn=s7z!%kra$)FrB$W(AzE^W5a$jTDvqfK?wm/m:y?mc1Bz\u0026pmwO#71vru66A:-\u0026@z/3Rcvrt{hB-RNRy?WuiwmYj)xd\u003e(DB.LV5eOO-Gw)]^\u0026y-)+vzGGPfwGUM8A=k$VaARpdax9MbBy/qivqG:#v{%E$AV/jcC{40yBrCZEwGT@CqY{o#Bz8!cwPI%lBZ]JiA=S=OvpBd}BzkS93t9Z*vqE6bB-8qnzdK\u00263A=M8siV@u-BrCHlaxh3kazULlB1wCxvScpex(mL\u003cB98ClA=M8suVEo3vqfL2A+fcbatmXOz^$CwwO+%iwQ4=evrM6[y**^?wIb8%B09bPA=kCgzeTMmBy!#Ex(n37A=br4az2Olz/N(YwO#Q3A+e=7B-8khvpJ$VvR/P#v@C)?iV@JTwGV8dA+eV\u0026azC.9zY\u003cajBAIKBy\u0026r%2v\u003c2GbzyoJGA+e:6A=U@rwPRP%A+cwcB0bvsazk/", "n": [ { "c": 2, "d": "Read own executable path (/proc/self/exe)", "i": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "o": 130972, "z": 14, "cf": 0.66 }, { "c": 2, "d": "Secure random number generation", "i": "micro-behaviors/os/random/crypto::secure-random", "o": 130727, "z": 11, "cf": 0.8 } ], "ln": 130631 }, { "b": "A+e:5z/Qa{B3SidA+e:5z/Qa\u003ex(W={Bz(hBph+kyze:PxqE%oEpI%#]mRMWIB9R?GwO\u003c[Jy?mWkB97#goMa\u0026*q/(C:wLM/UCw?IqmRMWInmuyDy?lgQC42i3wjZVTB-Zh)C42i3wjf\u003cFvomF-By!S!A=j(#z/Po0wKZ/Uy!![\u003cq!oJQvpB4:qfu/0vmtAJwO2y-wjyoHwMiO^oKR%OwM08Xz/{8gwKpJXC%#%?v%8)4vR/QBx(4uEB-R*}A=l2uwPHmJC4\u003eC$B5W6@o\u003c}{+oLFxWB4Hm)vqC", "n": [ { "c": 2, "d": "Joystick, gamepad, or DirectInput keyword", "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "o": 131607, "z": 6, "cf": 0.95 } ], "ln": 131511 }, { "b": "X\u003e\u0026\u003ep(}[k)lSax])nBF{lSax]lSax]A8m2Ah=6$:A8m2AlSax]h=6$:A8m2Ah=6$:A8m2AbVb3KlSax]lSax]h=6$:A8m2AlSax]lSax]lSax]h=6$:A8m2ADVAXcB-ILqz/cXlx(dNaaAz44v}YB:ElRaKzfd*1mriA!A:S@hB7/Gmy?aU$wGUY7AbP/sx\u003c$)\u0026aA}KwxM53nayMy2w]hSJi.14dzddKdwPzfxas[THzGGDgzEEu7wPz*fAYLsOzGGDgwN({azGoq%v}YpWy?j-0z!9ADB-8new[r8eat4hyc[cn?auyS:B-8Fmz!9BaEj/tLC5n\u003cwvqG:\u003ewftnTwPJ0gBuhE9zG*bfA40eyaA8cuvqWh}mriARaA?gfB.9mht@\u003e2ci^UvMz/Z5wwJz4#j%?y4v@DmaBrAT/c[F.qvqH0@DMWUTaBLv}", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 133156, "z": 128, "cf": 0.85 } ], "ln": 133060 }, { "b": "1POJ5007fgi@/lX0086/r0041008kanezma000Ob!Au(j005Wjp8Boq002og5C669004L?Q\u003c!p9000992[mBV7AaqqbQU8{f/p{LaBtjZauyR/DKqqhc[2AfEjlZMaBNDDe?QBtvqG:\u003ewftnQAcb/jzAo?3zG*bfA40eyaA8cuviw@Mz/fb]aA?gfB.bJ2zFrP6x(k54ay]58BAhIlBz(gxwoz{bzF784y?m3)B-oGbaW6WJByO#}B8UM9x\u003e5o1zxJvgw{503BzkVhaARp9BrC74zF\u003cxmaA.NCx(mDnfFCjngb7Hrg+Z^vhzv6zi50uEfFLppgbgNtg+*\u003cxhzEcBi59AGfFUvrgbpTvg+{{zhzNiDi5iGIfF+BtgbyZxg=40BhzWoFi5rMKfF\u003eHvgbH^zg=d6Dhz^uHi5ASMfF$NxgbQ\u003cBg=mcFhz)AJ", "n": [ { "c": 2, "d": "Rust unwrap failure message", "i": "metadata/lang/compiler/systems::unwrap-failed", "o": 137915, "z": 128, "cf": 0.85 } ], "ln": 137819 }, { "b": "1PXVb0rJAf2M+kh0S-rc0r\u0026-h1onMd1owG61Qk2i0Tw@l1Qbbm1{1(i0TG8k0%FY91QLel2($nh0S\u0026Pb1PO=k0rJA90%/bp2m7Lu00-=g1oX(j2l+nj2)yzq1QCnj0rSGb1P]5h1{a@j2)gCs2)gFl0%[@j0S\u0026Sf2l$Co2l\u003eFt2)7nl1{Utl1{\u003eCn0rJAb1o]en1o]eo0sn]i1{1\u0026c2NyXq0%/2n2)HCo2M\u003etk0%w\u0026k1Qk2i0s5Yf2lB#g2l+zs1{+hl00@=h0rAGd1oX#h0%[#m00SVg2M+nj0Te\u0026l2lLeh2lLhq2NyLk0%F/j0SSxg1{a\u0026e00S-k2)yzk1{\u003eqk00SGd00000tgL=#!(hkekrCLydxkPA{*[1Qx0+W92Gm%:s\u003c1=SCe3knF8NMwn+K.B[vT3Lq/x%s?\u003cEWj*\u0026E-Leg/DCLM![ie1\u003eKSy3niEN\u0026qPT}9]w1hPOU4GYp\u003c8G5Ps/X0SdHm0^\u003eMc7tUQbo4Q2A^@tryk^1\u0026{Af$c{3:WmpOi}TH3]qMhk%CVgCcqNbs/zMw?e!@F!No7FoSSECc1W$aO#}jg0D*Ap%g{]Lnw0%\u003e^/GJj??{=b!=[dC?[6Dv^3+z4x(G.T./9gyPogej-O#bxSZwYJau%-29/hiJe+@U.wBv(UL!@Anv(Rn[9\u0026A*]4)$88[=\u003c=zfhfAM3f0Ss4=@}fT:QPH(\u003c(IjjIMLeNyy]Y}.e+(nu\u003c)n@k)XXPJTUTv@*@VF?E5=xTlqLl)G3(*EhZ9#WY*lI{8x{Zu]p\u003eiAY)REk)=68Dj.{d/*Q\u00263Gw(=]uREM:^4]V)5InN6mY\u0026F[86AuumlXUR/A^uV9kJv.yIIhJT(R9FpvG{Ly6VDN)TUl:NH2\u003crJgQB)Ov?eJWJzS\u003c3oczz\u0026^::UQj){\u003e=-I!sl-V3wrqhYtg2aB$vIS3pECP", "n": [ { "c": 1, "d": "Peak 1KB region at cipher entropy", "i": "metadata/file/metrics::peak-region-cipher-entropy", "o": 141312, "z": 512, "cf": 0.85 } ], "ln": 141216 }, { "b": "7^XYzk[je2001$U000M\u003e008wR2lnMu0000=4Ig@p7^XYPk[kqe4LSIsJ0bdyJ@\u003cInc{Xs=ljK\u002604Ig@p2TF}O002K\u0026002XN001dk2ll4J0000+4Ig@p7^XYPljLzg4LQfUi6!3tG9NttJrLsBJ@$ar0$Lzxi6!3dljLzg4J[7F7^XYzk[je2000Mg005xE000d]2lkFs00000001$U0068Y000O52lkkm0000+4Ig@p7^XYPk[kqe4LSIsJS+yBH5}CS0s*Iz4J[7F7^XYzk[je2001$U008jz0088L2lnMu0000=4Ig@p7^XYPk[kqe4LSIsJ0bdyJ@", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 180146, "z": 41, "cf": 1.0 } ], "ln": 180050 }, { "b": "4Ig]o2TF@Z0rr91nb@R\u002607)j\u003eoGryV8uP%t06}8aljK\u002604J[7Fc{!y$k[k\u003ex4Q:[]J0tmBJS+yBH5}CT0$EpR4LQiVc{!y^ljK\u002604Ig]o2MK\u002685c8XgoIbo+[h}0S5c8Xg000005c8Xgu}Hz0(]UNOi@/lX00000nb@R\u0026Bv(Jk7^ef9Hx4qO074ebljK\u002604J[7Fc{Xs%G9EnrJrCmzJ@/w{4K:TNavlLPljKL[4HtJlfHlf%ljLb84J4Ix5jc\u003cjnb@R\u0026Z!aOboHGf!F=C=J074ebljK\u002604J[7Fc{Xs%G9EnrJrCmzJ@/w\u003e4K:TNavlLPljKL[4G", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 184224, "z": 37, "cf": 1.0 } ], "ln": 184128 }, { "b": "4Ijl]p.0=G5c8Xg/IqFE\u003cAy[g?2EAP000005c8Xg(}WPYUY{DO9@(ov000005c8Xg08JT}YM:..nb@R\u0026000005c8Xg6I[=f{\u0026)8Bi@/lX0bA5Qc\u0026:kEc@o)zbZxW@{w+f[06}8al\u003eg]60S}6=5j3^ik[kOF4Ig]o2MK\u002685c8Xgr8rL{{\u003c0eC5c8Xg000005c8XgxIXWe]MZ-yc\u0026:kE00000kMy=:D@6!y5paS.ZYjum074ebljK\u002604J[7Fc{Xs%l\u003ei4C28\u0026.B1DAOB0+hY]k[kqf4J[7F7^XYzljKn!4P0c95c8XgZ!+1hJcU^ga]?P", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 185724, "z": 31, "cf": 1.0 } ], "ln": 185628 }, { "b": "rbIWo\u003eV52\u003emGrz*089\u003elH5%ZK26HyW2/V\u0026AbME/ABz.6U{/v\u003e7cij8D06}8aH5%ZK226TMJS+yB0#g?B2m7qf5c8XgOnFrbkW1M@1][S600000bME/AUX\u003cBvjx-c[!C]NH06}8aH5%ZK22o^PJ0kjAJ@]E23\u003cN4r7YTKo/LQV?ByCTU8uo:q06}8aH5%ZK1][S6c\u0026:kE]LKTeCW.6YiSPiX06}8aH5%ZK226TMJS+yB0($=P2TF\u003e65c8Xg7YTKoaA4kWJaim@6Awak06}8aH5%ZK210}A7YTKojz$i1KyFX02(\u003c@906}8aH5%ZK1][S6aohxwsz[ftV$6NBH5.hN06}8aH5%ZK21KpGJSPue3\u003cN4rec2UID#w#+5n8yKli3#=06}8aH5%ZK21a1CJSS(42m9Q71}Tok2m9Q71}Q+m8#]%sTzX7s\u0026a-V2bME/A08\u003cvsH5%ZK21x1a2/V\u0026Ac\u0026:kE+X)", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 193540, "z": 52, "cf": 1.0 } ], "ln": 193444 }, { "b": "nDm1biMzU.Sr951n@Tk}nichJGnY\u003ci06}d7eib%RedcHFoAL$Oo]m]@TBLWzvGl{)lhQYZnq*B)p!lISb-\u00260a07-3bb:XMi01VIabW:e%^HR0B0rr9\u003ciM.\u003e+1PXP6FijT-4#*O\u003c008n?0rr9\u003cI^dJDpk{I3nJDzNGy]3u%4FtQbXP(fr3UphI+Cy7nqN:2nSuvxnqQ1=5kFiw5(jGH5:Ho80MdD+?+GdR2qLQpItG\u003e8]BDOm0000=54jOAnE}P[Bkont\u003cvLi:4\u003c7^AJxwyQiMDg^on%ufnichJ", "n": [ { "c": 1, "d": "SOCKS5 client greeting bytes", "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "o": 245865, "z": 8, "cf": 0.9 } ], "ln": 245769 }, { "b": "bW:f5YD\u003e\u00267002YH@@i.(STO@4IejCJoO)p9A7C[Sb*VI\u003e08erLb?J7%08erDb\u0026wU508bAA4#3FM002-E\u003cpv9n0000N*ENgUoO}{i6@O5v0o]^N0093l1Gz[hZx1rm0knEl0093l@hyb9nqj?\u0026GJ4%L0lb1lnxjd00rr91nqP+vnxjdg0rr91oGzY!4[IRabRXBJg64yt[=Y0[nqk/u6g!4ebRV!g0000\u0026IqFmEnu9a0nq?NnkUcR54$@dg002MFD)zm]0rr91(9*/@07.@.bPb\u0026xnqRdd7\u003c4[u6)DR^0j@mi006.l0000)IrB)NyY", "n": [ { "c": 1, "d": "SIGHUP signal ignore pattern (x86_64)", "i": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "o": 246892, "z": 29, "cf": 0.4 } ], "ln": 246796 }, { "b": "002MHYD/fm006Ot0002f0rr91lau{}001+E\u003e**yH07-95b!%DY07-9lbSC@c07-3bbSC@c07-3PbTqIk07:\u003cEC4CYnx(v(WIf}2Ynwv#wx(n2nC4Bj3jtxxV-TLE}V)m)u002MFJ3H7X000Jv0Ul-kbV1*F07Yc6BpX%hGD%w3000JUGD@kP002MDJ3L[m003Qwz?Gw\u00261POL]4$sNIJL3J!6-Xk8JKf$T0002gsonE5@$Q*}2()IOOSA*K07YhxFb/MHBQZ)3Y){7.0ri^0@S@M}y5q0l002K", "n": [ { "c": 2, "d": "Contains version information", "i": "metadata/package/quality/profile::versioned", "o": 488345, "z": 7, "cf": 0.85 } ], "ln": 488249 }, { "b": "g08$Auc3R\u0026w[CT!e!o4S0000001VH$Gzv-O3p6dw0s%%%4GDF]54qH7Itq!!E[n5KnEteXGVK:Y]A20)n=M}7%g\u003co62tG{2B\u0026S.]4GDFtWVfkA%nO6Q%b25!fXnMH/lf{X54{qu}u7}gnr2^-sm#O:v?+n20S2GFmBq7]o[?1YY8R*h01T+.4fcwsWGbNM0@@r)Jryj(GtmOC:hdiInwTH3nqP^B(0:!@08eqt=}e/D00960Io9J\u003e2Ut6jnRs!@mkrMYX=R{jnSr\u0026)nq1XWIo0E32Uq!}5j?TDXj5a", "n": [ { "c": 3, "d": "Mozi XOR encrypted configuration", "i": "well-known/malware/botnet/mozi::xor-config", "o": 815131, "z": 11, "cf": 0.85 } ], "ln": 815035 }, { "b": "002MDMeIPu%450O\u003e(7LYnS0B3Z^{J\u003cC)TYP4$M}D002N100000WGcvdnqS4B}V3OFRgwBx@@uU-Rg!ZB@@y5)FCPrC0z6.iy?ttqvq{oUJKo]0%nLSDmH8F]fk$@Iv\u003eR[mnqNL\u003cmH]F\u0026JH+Q^%nM*Bt1BIc@$N6O1os6o0zFuTnDn.\u0026BQpP#1XuYq0p8jcI)Xxc%nLSHO-6wA%45cmC(4EunqVl/[Pa:iGf68AG$dr^07-34\u003e\u003e+tVnr7q9[=eRWI3JlxEGfvtY-n3j00000Fk7)?nr6e.[=eRWGcHv!:3Qar0000\u0026GjtC", "n": [ { "c": 2, "d": "/proc fs path in native binary", "i": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "o": 820331, "z": 9, "cf": 0.4 } ], "ln": 820235 }, { "b": ".VG[.+/[qP+/\u003c6TIrd38k#{]PF:x(E002MF2ty4noP9\u0026}nxgYg0000[H5RWpW/uydnqV}eXbVHe0jz[d07.@n/VcCs00000x2^v30072c?#MxUfjXTqflIqznqS3O@@r2sG/G8i%88v=zn}n(@@q##nr554nr72h@@r2f4fcwd@$R]Y0%0$4UMn\u003eSoPqi!O=X%:GfxoTbKl^HI/(K2JEw(sJAaS{HdREDGmg/wBSBelEB7Mrj]/WgoO@Jc)O%k^o]h6O0%eD50p6\u0026EmA!5O2s%A:Xb=Nftr#NYuTpMu", "n": [ { "c": 2, "d": "Access /dev/urandom", "i": "micro-behaviors/os/random/crypto::urandom", "o": 896470, "z": 12, "cf": 1.0 } ], "ln": 896374 }, { "b": "g0a3tw[CTc4\u003ccD800000mgV?F%aybiBQyA+@S9K+i$Iw(mgV\u003c2mtZ+8GxvUP!8\u003csg{c\u003cVmC[#4G2ta%in=MX1GztK\u003c:ls-U003R)oO($cn+Z[iIaY*0H4V4g1P!V7nq*binr3asnio9G4$+5/002M9Z\u0026h*Dk)S0=y5@C!nq\u0026D#%nS9\u0026%g}l.ohDednn9UK9y#3nXdsmc0SSi(IpCdN:aKgu4#6iG0093lXln$mnR$!WI=p@)nr7p]%nS9\u0026JDl^AInwAO6Aw7yWUkp)%nLhV4$$o2002MFB5ky?", "n": [ { "c": 1, "d": "SOCKS5 BIND request opcode", "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "o": 924304, "z": 8, "cf": 0.6 } ], "ln": 924208 }, { "b": "np/.10rr8n\u003c{jGU[KOqG8bb%xC(N*z(aWh#07.+x0$QbM0@@sV0p8:rGz#e!Hbn#j01VIe2m[pu1p}}W2ePBk3d+1mnwTBpnwTi\u0026nd1=R53i?T(Kuyq@@AT+1P[-854qKfI/(*aF-V$j%nLSx=qJ[1}#uW/GztPWHdhmB07q.B(Qal@}3dB+hV\u003c3W54k1l54uGXl\u003euZ\u003e20{8-5j3S(IVut+\u00263.dj\u00260r0.Z!6x#nE}]z2\u003cR%(GztJUH5}CS07mvb07-2xS7qG#0rr90nq22Znq?SiUMmpKG-IeM", "n": [ { "c": 1, "d": "SOCKS5 UDP ASSOCIATE request opcode", "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "o": 927429, "z": 8, "cf": 0.6 } ], "ln": 927333 }, { "b": "@$Qex0SU/G-{jgcIn\u00268Aubf0+*Jjf7I*-WT0rr91oO@^uIqFmEwITw/oO@JcuebCX+/[qP+/[qP+/[qP+Vdh\u003c\u003cV#%lr-qLu)6)5@07.$znXUl9000000dWRIB7Gf1fj/xtnqS3:@@r0?Xg./wz^$CwwK}Viir5%T-!u[Y%nJ6\u0026JEwrcJKp+B%nPUv000306}vn=0e2Zf0D/!YJxL2/0SU=FEB}kIEB7VEB\u003ezMCGwV\u00265JsBHg]8zl\u003c1C68A:P7f?I/(*aJExgqnGv^hoGvKFBXbbZEB}kMB\u003ezMCGwV\u00265Jsz!R]8zl\u003c1C68A:P7feWNQ)ZZ\u0026Z{*j4Nf", "n": [ { "c": 2, "d": "Read own executable path fragment (self/ex)", "i": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "o": 998367, "z": 7, "cf": 0.58 }, { "c": 2, "d": "Read own executable path (/proc/self/exe)", "i": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "o": 998392, "z": 14, "cf": 0.66 } ], "ln": 998271 }, { "b": "6/+\u003c!0kpO@0093lTQUyj-S.I-0SSk^20}$40D=%.G-qNp1PXP654hT%hV-#jZZ(d)0000\u0026XbVHe0jz[d07.@nZ@F)+00000x2^u:0072c:n[\u0026wfjXTqflgGsnqS3q@@r2sG=*r]%88v=zn}nO@@q##nr54+nr71]@@r2f3\u0026*nc@$T#o0SW\u003e3M\u0026N.J3JZqdnq?R-nr554nr3S+\u003e//v)%at:70s%\u003eV0rr9/I*.%2Im\u003c=9%nQb[9rc0r0rr91oPud\u003e@@r0(IZnPz0SS+t1\u003e+^n0eedgl+SN3002YH[4eJ", "n": [ { "c": 2, "d": "/dev/random access", "i": "micro-behaviors/os/random/crypto::dev-random", "o": 1008027, "z": 11, "cf": 0.7 } ], "ln": 1007931 }, { "b": "83o\u003cK01P757.D-F0001l000000000d8uP%L01P5L]ag)40000-1onA4000128uP%L01P6q{yEr80002I1onA40001:8uP%L01P8001/hh0001a0000000000e[]iBwPz.\u0026e]CPHwIcnnnIb3)x8\u003cM4z//LyxkR\u0026AvS=y3wg.Ia04}/czGy8u04}]4BUm\u0026GA=U@kzu8q4zGNNPwPz\u003caz/e{504}]4BUmuoB7+Lawo\u00266lBAdvlA+f5}e[xlB04@q6y*!@ny\u0026/UfxjCBUwQ4Y@AcbDevpB4:04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04@w8CYS{rx(mTb04}\u003e$zFo86AboQ@e{7SjByte4ByGrj04}\u003e$zFrD^A=LPl04}#6x()Y\u003cA=LPl04}!\u003cByu!xwO-#tzVzz2D2v5cx\u003e4b}xk.\u003e(e[Y9Ae]USG04@q6y\u0026TD3Aa9o/x(mL-e{7@qv@c73wNxK/vR/PQe[wyjve}]?B8}slv@Dj3wO#O\u0026e]#qPBywRUe]$YEBAhFivGn34BAhFivGlynuTWzTuVYZ?0af8jo*-nYnMeO}uJsRFA+e($B97#luVV", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 1211799, "z": 8, "cf": 0.9 }, { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 1211648, "z": 7, "cf": 0.9 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 1211602, "z": 7, "cf": 0.9 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 1211561, "z": 7, "cf": 0.9 } ], "ln": 1211465 }, { "b": "07PyzuUaE(wPh-#BywS{wIC$vm)/TJwQ4Y@AcbDevpB4:f/e(2lQLi(CW\u003er7Byfb#vR/Qgh2{cllTKzHv}xR3uVYZ=y?ksV0ae]8f/0lPvq]N.B.LV5wPxRIBzkLJw]7)$uU%j\u003cgb8glvrtjLA3OaRbUGyIbVVfXr3TwozGxxfBtkZ/ggSr#wJ8w5w\u0026zXeg=vfDmf2?BlTKzHv}xR3uVYZ=y?kvQ07PyzuUaE(wPh-#BywS{wIL$um)/TJwQ4Y@AcbDevpB4:gbn\u00261lQLi(CW\u003er7Byfb#vR/QhgYQ3k", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1242674, "z": 12, "cf": 0.86 } ], "ln": 1242578 }, { "b": "y\u0026131e?Ri!A+PA7e?Q7AA+PA7bU7/VbU7/Vf/J=6hA9AGf/RcFg=EuKg?wBh0ae]8g?gDAwIXpEAXPycwo8QcuUKy+Abn@)wH6@GbX7U0A9)6%x(4r\u003eAXn$!BzkLze[O{dBye([A4S+jy*?AWvq)F=r3U%\u0026vq]N.B.LV5wPxyQB-.tle?Q\u003cGe?P.abTS?=y\u0026131e?RrUv\u003eGxmwN=#Vr3U%\u0026vq]N.B.LV5wPxyQB-.tle?Q\u003cGe?P.abU7/VbU7/VbU7/Vf/J=TwObH+ia+0Ti5\u0026(Qf/RfZ07PyzuUaE(wD", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1246925, "z": 13, "cf": 0.86 } ], "ln": 1246829 }, { "b": "y=L\u0026UB97}HB9RUkiD5!BwNxm(v@1UhBv4=\u003ci8sB4wLv2LyFF$DBv4][gg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{Ah^XvZD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMln@mbx(t\u003euA=M8shaqLaz/Ookh^VL(qCIygC20cOBwu{BB82.^q:\u003ch]q8r2GuO=+BwhwpLB2F5EzE^W5heD#AB:b]VwPR%3zE^W5hBG#mnKC]DuS6D\u003cC20cDB7W{Uw\u003eK)Jf\u0026HFsuO(nhA+d4CBAf8(wo8QcuUKy+Abn@)wL2Tspin/VuP8}oB9hqvhD1acB.(expiolMpin\u003cAyh#\u003czmmRk)gI/6UgJNUGghgU:wPz*fAY3paA=k$!mm5Z?uJrO-lTKzH", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1263527, "z": 9, "cf": 0.8 } ], "ln": 1263431 }, { "b": "q8r2GuO=+Bwhm\u003eqhdZ/Gz/NZ7A=M8smm6ZQ0aeS0C20cOBwu{MBvga:A.6a$m@zfWy=L\u0026UB97}EggBW4yJKP9v}x1/B2!q!zdmB1x)KtFxk8j0x!?wUx\u003c#c\u003cwnCQ!By/G3By!/#xK(cyv{%g\u0026vQS+Z0aeS0C20cOBwu{BB82.^q:\u003ch]q8r2GuO=+Bwhb\u0026GvpK7{A:-D?uVHiFB9RRiz!%clwI[amzer]yzeAZ20aeS0C1)3+piolMpiolMlVW0.nk?@EzC-iaiBsN-ByW9YvQS+ZBAg/1wNxF0iDGE.vSc5", "n": [ { "c": 2, "d": "Iterate shared object list", "i": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "o": 1264196, "z": 15, "cf": 0.5 } ], "ln": 1264100 }, { "b": "f?bIsmm5.5uJsChnLTC7BvgaZmqVTfgd:i0l@NCHv@Dy0gJmCRf/9uXz/x5$zEmv0vpJ\u003eupiolOpin\u003cAyh#\u003czmmRk)gI/6UgJNUGghgUYh!lGivrDyduW3K8By!/\u003ezfdZ5wmoC0wPyvqBwu{AoKxX/B-ILwAYcpcA=Vetqb.c%mmxKruJsChnLTC7BvgaZmqVTfgd:i0l@NCHv@Dy0gJmCRf/9uXz/x5$zEmv0vpJ\u003eupiolOsAw:{piolMpin\u003cAy!!b0A==BWx*#cghdprqz^$HRv@Dg1wN/*@z/fQ", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1275519, "z": 11, "cf": 0.86 } ], "ln": 1275423 }, { "b": "pd4PFC1\u003e.NlsBjYz/f5@uU\u003cT\u003cyE}oylnq}Ri8sB4wLv2LyFF$DBv6FAgg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{Av{.3kD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMlsTvTx(t\u003euA=M8shaqLaz/Oo2mkd5ruJrO-lTKzHv}xR3uVYZ=y?ksXgxp=WpiGxQpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e#PvpK7{A:-D?g\u0026d8uyCXZXlRvzHlQLi(CW\u003er7Byfb#vR/Qgi5yRxqu", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1286257, "z": 9, "cf": 0.8 } ], "ln": 1286161 }, { "b": "CwhejuT[k0A+fcguV6p?wLLP/lR./1Bv4@]iDezAx\u003e7{)zF7WVwmYvYB.(ebxM4*8fFESrfHv:a0aeS0C20cOBvga:A.6a$m@zfWy=L\u0026UB97}JBzbYavpR8Ezddc@uVY$4wNPaao*IuCe?^ojqCIyqB1}xopin\u003cAxglVHoeo6[q::L\u003eg?gDAwIW}nBw=WBBv4()h:?w3Abn%dgIgGClVW0.nk?@EzC-iaiBsN-ByUwUqCIyqB1}xopin\u003cAxglVHoeo6[q::L\u003eg?gDAwIW}nBw+\u003eQpiolMli", "n": [ { "c": 1, "d": "main_* architecture payload name", "i": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "o": 1286861, "z": 5, "cf": 0.96 } ], "ln": 1286765 }, { "b": "C@68yv\u003e//Lx(mD*wOtBVv@#B6zGxesloexMm)/TJwQ4Y@AcbDevpB4:gbg=?uS6TxpiolMpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e=XvqE=yzFstJz/WS?xkzo\u003ev{:y\u003cA=U@kzu9f]lTKzHv}xR3uVYZ=y?kvSg5%*ilTKzHv}xR3uVYZ=y?kvSgxp=Wpe:]hsX.sQpiGuMfKEN%pin\u003cAyh#\u003czmmRk)gI/6UgJNUGg\u0026)}Wv(eawv}wzSls:BWpI%VNf/rDHy\u00260D%zEWl+w]zZ1wLLP:p5", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 1288283, "z": 5, "cf": 0.8 } ], "ln": 1288187 }, { "b": "pd4PFC1\u003e.Nls%N+z/f5@uU\u003cT\u003cyE}oylnraWi8sB4wLv2LyFF$DBv6UFgg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{AxKrMpD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMltfZYx(t\u003euA=M8shaqLaz/Oo2mkdqdBwu{MBvgaZmqVTfgd:i0l@NCHv@Dy0gJdkNia^qJv@#B6zz\u003c$4pI%VNr8MFkls:B-pI%VNq/(C\u0026wKP3Fv{%g\u0026uVf*(wJ1ZNvpB4:ltfZam)/TJwQ4Y@AcbDeve", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1289293, "z": 9, "cf": 0.8 } ], "ln": 1289197 }, { "b": "uVYZ=y?kHYirhMplTKzHv}xR3uVYZ=y?kHZgxo{jlTKzHv}xR3uVYZ=y?kHZgYQ(XpiGxOpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z2^{vpiGxQpiolMpin\u003cAyh#\u003czmmRk)gI/6UgJNUGgJN?.hGAkzwn=rxy?W^fCSxzFBAg/cwn=rtiy=IqqBa5CpFCgZrZxqJk%!mle?^ojqCIygC20cOBwu{BB82.^q:\u003ch]q8r2GuO=+BwhwpLB2F5EzE^W5heD#AB:b]VwPR%3zE^W5gbzA#pdeCXpe:OGrz(m)k#{oyoHh0smj{m]uS6TxpiGxOpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z80?DqBa5CpFCg]ml%sAe?^n}lQLi(CW\u003er7Byfb#vR/Qlh8UC8lQLi(", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1298458, "z": 9, "cf": 0.8 } ], "ln": 1298362 }, { "b": "BywS{wI(jym)/TJwQ4Y@AcbDevpB4:h8UCKwO\u003e{\u003cAXovgg+@U%v}vOSvl3qShz)6@xlt*X0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}Cr6nHzE^9}B7E9bvpS[?ghHVxwIb=0vLxL[ix7Ich.!+%whbVCxlt*X0aeR}piGxOlVV)ezdVA@nIKdiq^Rv\u003ez/PzBAccaPgH$JAA9)r%uVo*\u0026v}wzSpin\u003cAy!!b0A==BWx*#cghdl", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 1308476, "z": 6, "cf": 0.3 } ], "ln": 1308380 }, { "b": "haqLaz/NZBvrDT5f/J=9wNNGdw?U}@wIW}ch8NuZ0aeS0C34HYpin\u003cAxglVHoeo6[q::L\u003eg?gDAwIXjDz8C)BA=k$[Bv4-\u0026f/q{JC$8*)zaOR!mriA!A.ZZKBv4()gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AY4unB-RaGh!V!-ggSaKggq\u003eDh-22Rf/8k#uS6TxsAuo9piolMlVV)ezdVA@nIKdiq^Rv\u003ez/PzBzGP!NwPz*fA.ZZyhd56]p*[x=wL3=YmriA!A.ZZKBv4#{gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AY4unB-RaGh!VUXhdXK5g=WAGvMuk3vMl^RuS{h-gHzz3r3Uo=BUUS@vriYpgb6$-y*?o\u0026vS=y3wmY^le[e%qy?d9$e?RrQy\u0026%q@Aa9^dwPxyQl2H%GvqH6$p*[x=wD", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1335837, "z": 13, "cf": 0.86 } ], "ln": 1335741 }, { "b": "e?]joy\u00261oie\u00262pygc46Bf!$QAfF\u003eEugb7Ev0aeS0C35/)piolMlVV)ezdVA@nIKdiq^Rv\u003ez/PzBzGP!PwmYmaw]8M:Bv4/\u003ef/q^oA=U!Yy\u0026r:7mriA!A.ZZKBv4@]gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AYd#SB-H#6f/J=5v(k#2f!+N@vkP(NwIV8ge]kuEz7WO3h.)xFgCHTxhzu%wg+{:uh2{#YpiGxQpin\u003cAxglVHoeo6[q::L\u003eg?gDAwI[KBx\u003e7ZffK]3uD0+f7z/5\u003c5yY", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1343139, "z": 13, "cf": 0.86 } ], "ln": 1343043 }, { "b": "bU7/VgbB5\u003czE)r?B8$=gD0+92BZ/e#uU0O^xFzCVh.^s8h!a*chz!\u0026KvM2#Jmf3W#pbaIly*?o\u0026vS=y3wmY^swPz*fAXPytA=M8sbURe.mKgG6bR.i1zFKcdCwZ+@A+xJiwO#PAh!VYfv(b\u003e{vkhmKvpJ.Rh8dJ1uS{hVggLceA9)6%x(4r\u003eAYd(BA=U/jia=-gBAIRnB1]y\u003cB.tt#B98bmzGvJ/wnbNYD2E?jzdNc[f/J=9iBKW6w?U[)i5t83hE{k+0ae]8f/0lPvq]N.B.LV5wPxUtA=M8sf/hr", "n": [ { "c": 1, "d": "Interleaved wget command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "o": 1362572, "z": 11, "cf": 0.86 } ], "ln": 1362476 }, { "b": "z*bMbzE(dluJsCkzG//jwm5kyx(^\u0026OCW\u003er7BzkVh0ae-zCwg@9uQOEwwPRGLCW\u003er7BzkVh0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}CqqS.0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}Cq-#yBy!%70aeR}piGxQo(\u00266%pin\u003cAy!!b0A==BWx*#cghdprqz^$.DvrV74wN!qbBv4@]f!(NmCueo+nP5ASA=sDaA+fr6A=#1Hf\u003etifA+fr6A=#23vqYQ.xKL^?y?lv-pin*huO}", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 1407564, "z": 6, "cf": 0.3 } ], "ln": 1407468 } ], "depth": 3, "facts": { "imp": [ [ "", "libc_start_main" ], [ "", "gmon_start__" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "ITM_registerTMCloneTable" ], [ "", "cxa_finalize" ], [ "", "memcpy" ], [ "", "bcmp" ], [ "", "Unwind_Resume" ], [ "", "close" ], [ "", "memmove" ], [ "", "memset" ], [ "", "memcmp" ], [ "", "isatty" ], [ "", "tls_get_addr" ], [ "", "dl_iterate_phdr" ], [ "", "munmap" ], [ "", "syscall" ], [ "", "pthread_attr_destroy" ], [ "", "read" ], [ "", "errno_location" ], [ "", "chdir" ], [ "", "Unwind_GetIP" ], [ "", "gettid" ], [ "", "open64" ], [ "", "openat64" ], [ "", "mkdir" ], [ "", "Unwind_GetTextRelBase" ], [ "", "Unwind_GetDataRelBase" ], [ "", "chroot" ], [ "", "getenv" ], [ "", "strlen" ], [ "", "malloc" ], [ "", "posix_memalign" ], [ "", "free" ], [ "", "realloc" ], [ "", "write" ], [ "", "calloc" ], [ "", "ioctl" ], [ "", "poll" ], [ "", "recv" ], [ "", "fcntl" ], [ "", "writev" ], [ "", "recvmsg" ], [ "", "getpid" ], [ "", "sendmsg" ], [ "", "pidfd_spawnp" ], [ "", "socketpair" ], [ "", "fork" ], [ "", "posix_spawn_file_actions_addchdir_np" ], [ "", "posix_spawn_file_actions_addchdir" ], [ "", "posix_spawnattr_init" ], [ "", "posix_spawn_file_actions_init" ], [ "", "posix_spawn_file_actions_adddup2" ], [ "", "posix_spawnattr_setpgroup" ], [ "", "posix_spawnattr_setflags" ], [ "", "posix_spawn_file_actions_destroy" ], [ "", "posix_spawnattr_destroy" ], [ "", "sigemptyset" ], [ "", "sigaddset" ], [ "", "posix_spawnattr_setsigdefault" ], [ "", "environ" ], [ "", "posix_spawnp" ], [ "", "exit" ], [ "", "dup2" ], [ "", "setgroups" ], [ "", "setgid" ], [ "", "setuid" ], [ "", "setpgid" ], [ "", "setsid" ], [ "", "signal" ], [ "", "execvp" ], [ "", "pidfd_getpid" ], [ "", "waitid" ], [ "", "sysconf" ], [ "", "pipe2" ], [ "", "fstat64" ], [ "", "Unwind_Backtrace" ], [ "", "waitpid" ], [ "", "dirfd" ], [ "", "lseek64" ], [ "", "dup" ], [ "", "abort" ], [ "", "pthread_self" ], [ "", "pthread_getattr_np" ], [ "", "pthread_attr_getstack" ], [ "", "sigaction" ], [ "", "pause" ], [ "", "getcwd" ], [ "", "unlink" ], [ "", "lstat64" ], [ "", "stat64" ], [ "", "exit" ], [ "", "mmap64" ], [ "", "realpath" ], [ "", "readlink" ], [ "", "statx" ], [ "", "getrandom" ], [ "", "cxa_thread_atexit_impl" ], [ "", "pthread_key_create" ], [ "", "pthread_key_delete" ], [ "", "pthread_setspecific" ], [ "", "fdopendir" ], [ "", "readdir64" ], [ "", "unlinkat" ], [ "", "gnu_get_libc_version" ], [ "", "getauxval" ], [ "", "sigaltstack" ], [ "", "pthread_attr_getguardsize" ], [ "", "mprotect" ], [ "", "xpg_strerror_r" ], [ "", "closedir" ], [ "", "Unwind_GetLanguageSpecificData" ], [ "", "Unwind_GetIPInfo" ], [ "", "Unwind_GetRegionStart" ], [ "", "Unwind_SetGR" ], [ "", "Unwind_SetIP" ], [ "", "Unwind_RaiseException" ], [ "", "Unwind_DeleteException" ] ], "sec": [ [ ".interp", 736, 28, 3.94, "alloc" ], [ ".note.ABI-tag", 764, 32, 1.5, "alloc" ], [ ".note.gnu.build-id", 796, 36, 4.19, "alloc" ], [ ".dynsym", 832, 2856, 1.07, "alloc" ], [ ".gnu.version", 3688, 238, 2.06, "alloc" ], [ ".gnu.version_r", 3928, 384, 3.35, "alloc" ], [ ".gnu.hash", 4312, 28, 0.81, "alloc" ], [ ".dynstr", 4340, 1757, 4.86, "alloc" ], [ ".rela.dyn", 6104, 34560, 2.56, "alloc" ], [ ".rela.plt", 40664, 24, 1.22, "alloc,info_link" ], [ ".gcc_except_table", 40688, 39100, 6.01, "alloc" ], [ ".rodata", 79792, 73212, 6.44, "alloc,merge,strings" ], [ ".eh_frame_hdr", 153004, 12196, 5.57, "alloc" ], [ ".eh_frame", 165200, 77848, 5.15, "alloc" ], [ ".text", 243056, 877155, 6.21, "alloc,executable" ], [ ".init", 1120212, 27, 4.24, "alloc,executable" ], [ ".fini", 1120240, 13, 3.24, "alloc,executable" ], [ ".plt", 1120256, 32, 3.05, "alloc,executable" ], [ ".tdata", 1120288, 32, 0.2, "write,alloc" ], [ ".fini_array", 1120320, 8, 0.0, "write,alloc" ], [ ".init_array", 1120328, 16, 0.0, "write,alloc" ], [ ".data.rel.ro", 1120344, 17384, 1.17, "write,alloc" ], [ ".dynamic", 1137728, 464, 1.81, "write,alloc" ], [ ".got", 1138192, 4104, 0.0, "write,alloc" ], [ ".got.plt", 1142296, 32, 1.12, "write,alloc" ], [ ".data", 1142328, 2512, 0.04, "write,alloc" ], [ ".comment", 1144840, 166, 5.09, "merge,strings" ], [ ".symtab", 1145008, 66552, 3.12, "" ], [ ".shstrtab", 1211560, 339, 4.29, "" ], [ ".strtab", 1211899, 203507, 5.45, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 247152.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 1324.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 119.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "symtab_count": 2773.0, "dynrela_count": 1440.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 119.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 2.0, "wx_segment_count": 0.0, "comment_entry_count": 3.0, "hidden_symbol_count": 579.0, "program_header_count": 12.0, "has_direct_loader_dep": 1.0, "comment_distinct_count": 3.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 877232.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 877232.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 1417648.0, "entropy": 6.36, "size_bytes": 1417648.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.21, "data_entropy": 0.87, "overlay_size": 2242.0, "string_count": 2670.0, "overlay_ratio": 0.0, "overall_entropy": 6.36, "overlay_entropy": 1.66, "entropy_variance": 4.29, "avg_string_length": 75.55, "max_string_length": 5734.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.97, "peak_region_entropy": 7.84, "string_length_stddev": 133.22, "largest_section_ratio": 0.62, "sentence_string_count": 209.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 118.0 }, "sections": { "count": 35.0, "code_size": 877227.0, "entropy_max": 6.44, "entropy_mean": 2.92, "name_entropy": 4.24, "writable_count": 12.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 8, "mol": "H₅(Cm₂F₂MgPo₃U)Md(Bi)", "path": "v1.23.0!!aura-emerge-1.23.0/target/release/aura-emerge", "pid": 0, "risk": 12, "sha": "b47adeedc852f17231454e3d16a3c9cc22759bb061e1338013d0fce33f24b805", "size": 1417648, "traits": [ { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword", "spans": [ [ 90085, 4 ] ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string", "spans": [ [ 180146, 41 ], [ 184224, 37 ], [ 185724, 31 ], [ 193540, 52 ], [ 193646, 48 ] ] }, { "id": "metadata/unsigned", "conf": 1.0, "crit": 2, "desc": "Binary is not digitally signed" }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.7, "crit": 2, "desc": "Short -h help flag", "spans": [ [ 106074, 3 ] ] }, { "id": "micro-behaviors/process/control/wait::waitid", "conf": 0.66, "crit": 2, "desc": "Wait for process state changes", "spans": [ [ 5252, 6 ] ] }, { "id": "micro-behaviors/os/signal/handler::sigaction", "conf": 0.9, "crit": 2, "desc": "Install signal handler (POSIX sigaction)", "spans": [ [ 5385, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.66, "crit": 2, "desc": "Write files (write)", "spans": [ [ 4745, 5 ] ] }, { "id": "metadata/binary/linking/static::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "spans": [ [ 1211648, 7 ] ] }, { "id": "micro-behaviors/fs/memory/mmap::mmap64-fn", "conf": 0.66, "crit": 2, "desc": "Maps files or devices into memory", "spans": [ [ 5435, 6 ] ] }, { "id": "objectives/command-and-control/dropper/keywords::payload", "conf": 0.6, "crit": 1, "desc": "payload keyword", "spans": [ [ 127807, 7 ] ] }, { "id": "micro-behaviors/process/terminate/signal::_exit", "conf": 0.4, "crit": 2, "desc": "Terminates process immediately without cleanup", "spans": [ [ 5176, 4 ] ] }, { "id": "micro-behaviors/os/env/access::native-environ-reference", "conf": 0.75, "crit": 2, "desc": "Direct environ[] global access", "spans": [ [ 5154, 7 ] ] }, { "id": "metadata/binary/linking/static::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "spans": [ [ 1211561, 7 ] ] }, { "id": "metadata/binary/metrics/structural::sentence-strings-20-plus", "conf": 0.9, "crit": 2, "desc": "Binary has 20+ sentence strings", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 488345, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "spans": [ [ 79940, 4 ], [ 81189, 3 ], [ 81206, 3 ], [ 86501, 3 ], [ 89372, 4 ], [ 92931, 4 ], [ 95536, 3 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-40", "conf": 1.0, "crit": 1, "desc": "Binary has 40+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/handle::fcntl", "atk": "T1083", "mbc": "E1083", "conf": 0.4, "crit": 2, "desc": "File descriptor manipulation and control", "spans": [ [ 4774, 5 ] ] }, { "id": "micro-behaviors/mem/protect/modify::mprotect-import", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "Imports mprotect memory protection", "spans": [ [ 5657, 8 ] ] }, { "id": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "crit": 2, "desc": "Iterate shared object list", "spans": [ [ 4520, 15 ], [ 1264196, 15 ] ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "spans": [ [ 94275, 9 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 94824, 26 ] ] }, { "id": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "atk": "T1056.002", "conf": 0.6, "crit": 3, "desc": "References real sudo binary path to wrap", "spans": [ [ 96544, 13 ] ] }, { "id": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "conf": 0.95, "crit": 2, "desc": "Joystick, gamepad, or DirectInput keyword", "spans": [ [ 131607, 6 ] ] }, { "id": "metadata/binary/metrics/structural::many-strings-large-elf", "conf": 0.9, "crit": 2, "desc": "Large ELF with 500+ strings", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setgid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setgid)", "spans": [ [ 5196, 6 ] ] }, { "id": "micro-behaviors/os/random/crypto::dev-random", "conf": 0.7, "crit": 2, "desc": "/dev/random access", "spans": [ [ 130727, 11 ], [ 130744, 11 ], [ 1008027, 11 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-base", "conf": 0.66, "crit": 2, "desc": "Create directories", "spans": [ [ 4637, 5 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 95804, 3 ] ] }, { "id": "micro-behaviors/os/signal/handler::abort", "conf": 0.9, "crit": 2, "desc": "Abort program execution", "spans": [ [ 5325, 5 ] ] }, { "id": "micro-behaviors/process/create/setsid::symbol-text", "mbc": "F0003", "conf": 0.75, "crit": 3, "desc": "setsid symbol text", "spans": [ [ 5218, 6 ] ] }, { "id": "metadata/lang/compiler/systems::rust-src-path", "conf": 0.85, "crit": 2, "desc": "Rust source file path (.rs)", "spans": [ [ 81401, 9 ], [ 81594, 12 ], [ 81678, 10 ], [ 81794, 9 ], [ 81883, 9 ], [ 81930, 10 ], [ 82096, 9 ], [ 82176, 10 ] ] }, { "id": "micro-behaviors/process/fd/dup::dup", "crit": 2, "desc": "Duplicate file descriptor", "spans": [ [ 5321, 3 ] ] }, { "id": "metadata/binary/metrics/threshold::many-sections-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ sections (installer/packer)", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "conf": 0.4, "crit": 2, "desc": "/proc fs path in native binary", "spans": [ [ 820331, 9 ], [ 820339, 15 ], [ 998392, 14 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "atk": "T1082", "mbc": "E1082", "conf": 0.3, "crit": 2, "desc": "x86_64 architecture string", "spans": [ [ 82317, 6 ], [ 1308476, 6 ], [ 1407564, 6 ], [ 1407632, 6 ] ] }, { "id": "micro-behaviors/fs/link/symlink::symlink-resolve", "conf": 0.66, "crit": 2, "desc": "Resolve symbolic links to canonical", "spans": [ [ 5442, 8 ] ] }, { "id": "objectives/privilege-escalation/exploit/kernel::suid-binary-target", "atk": "T1068", "mbc": "E1068", "conf": 0.85, "crit": 1, "desc": "Targets a setuid system binary", "spans": [ [ 96544, 13 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-version-string", "conf": 0.8, "crit": 2, "desc": "libc version string pattern", "spans": [ [ 5944, 5 ], [ 1288283, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-30", "conf": 1.0, "crit": 1, "desc": "Binary has 30+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 4572, 4 ] ] }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "conf": 0.7, "crit": 1, "desc": "ELF symbol tables stripped from binary", "spans": [ [ 0, 42 ] ] }, { "id": "micro-behaviors/process/identity/query::getpid", "conf": 0.3, "crit": 2, "desc": "Get process ID", "spans": [ [ 4795, 6 ] ] }, { "id": "micro-behaviors/process/control/wait::waitpid", "conf": 0.66, "crit": 2, "desc": "Wait for child process state", "spans": [ [ 5299, 7 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-8k", "conf": 0.85, "crit": 1, "desc": "High-entropy region mass over 8KB", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/setsid::import", "mbc": "F0003", "conf": 1.0, "crit": 1, "desc": "setsid() function import", "spans": [ [ 5218, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-25", "conf": 1.0, "crit": 1, "desc": "Binary has 25+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/os/random/crypto::getrandom", "conf": 0.8, "crit": 2, "desc": "getrandom syscall", "spans": [ [ 5466, 9 ], [ 1263527, 9 ], [ 1263614, 9 ], [ 1286257, 9 ], [ 1289293, 9 ], [ 1298458, 9 ], [ 1298516, 9 ], [ 1298597, 9 ] ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setuid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setuid)", "spans": [ [ 5203, 6 ] ] }, { "id": "micro-behaviors/os/sysinfo/config::sysconf", "atk": "T1082", "mbc": "E1082", "conf": 0.4, "crit": 2, "desc": "Query system configuration information", "spans": [ [ 5259, 7 ] ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "spans": [ [ 94807, 13 ], [ 106006, 128 ], [ 112540, 6 ] ] }, { "id": "micro-behaviors/process/tty/terminal::isatty", "crit": 2, "desc": "Detect if running in terminal (isatty)", "spans": [ [ 4498, 6 ] ] }, { "id": "metadata/binary/linking/runtime::getauxval-ref", "conf": 0.3, "crit": 2, "desc": "getauxval function reference", "spans": [ [ 5609, 9 ] ] }, { "id": "metadata/lang/compiler/systems::unwrap-failed", "conf": 0.85, "crit": 2, "desc": "Rust unwrap failure message", "spans": [ [ 137915, 128 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 4769, 4 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 95803, 5 ] ] }, { "id": "metadata/lang/compiled::unwind-resume-symbol", "crit": 1, "desc": "_Unwind_Resume exception-unwinding symbol", "spans": [ [ 4456, 13 ] ] }, { "id": "metadata/binary/linking/runtime::interpreter", "conf": 1.0, "crit": 2, "desc": "ELF program interpreter metadata" }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.9, "crit": 1, "desc": "Binary high overall entropy (packed/encrypted)", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.66, "crit": 2, "desc": "Process forking", "spans": [ [ 4834, 4 ] ] }, { "id": "metadata/lang/compiler/systems::rustc-path", "conf": 0.95, "crit": 2, "desc": "Rust compiler path in binary", "spans": [ [ 81314, 47 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawnp-import", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn PATH execution", "spans": [ [ 5162, 12 ] ] }, { "id": "metadata/binary/linking/static::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "spans": [ [ 1211799, 8 ] ] }, { "id": "micro-behaviors/os/signal/handler::signal", "conf": 0.9, "crit": 2, "desc": "Install signal handler", "spans": [ [ 5225, 6 ] ] }, { "id": "micro-behaviors/os/random/crypto::urandom", "conf": 1.0, "crit": 2, "desc": "Access /dev/urandom", "spans": [ [ 896470, 12 ] ] }, { "id": "micro-behaviors/process/create/direct::pipe-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "POSIX pipe creation symbol", "spans": [ [ 5267, 5 ] ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "spans": [ [ 130978, 7 ], [ 998367, 7 ], [ 998398, 7 ] ] }, { "id": "metadata/binary/metrics/threshold::large-binary-500k", "conf": 1.0, "crit": 1, "desc": "Binary is 500KB+", "spans": [ [ 0, 43 ] ] }, { "id": "metadata/binary/linking/runtime::needed-lib", "conf": 1.0, "crit": 2, "desc": "ELF needed library metadata" }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 94824, 26 ] ] }, { "id": "metadata/binary/metrics/size::large-file-1mb", "conf": 1.0, "crit": 2, "desc": "File larger than 1MB", "spans": [ [ 0, 43 ] ] }, { "id": "micro-behaviors/fs/path/system::system-lib64", "conf": 0.66, "crit": 2, "desc": "Reference to /lib64", "spans": [ [ 736, 27 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "conf": 0.3, "crit": 2, "desc": "chdir syscall symbol", "spans": [ [ 4594, 5 ] ] }, { "id": "objectives/credential-access/capture/sudo-pty::execvp-symbol", "atk": "T1056.002", "conf": 0.6, "crit": 1, "desc": "execvp child-exec symbol", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "crit": 2, "desc": "Duplicate file descriptor (I/O redirection)", "spans": [ [ 5181, 4 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/crypto/library/provider::openssl-static-keys", "conf": 0.8, "crit": 2, "desc": "OpenSSL/BoringSSL static key markers", "spans": [ [ 128449, 11 ] ] }, { "id": "metadata/binary/anomaly/format::elf-relacount-present", "conf": 0.95, "crit": 2, "desc": "ELF declares DT_RELACOUNT", "spans": [ [ 0, 23 ] ] }, { "id": "metadata/binary/linking/runtime::imports-tls-get-addr", "conf": 1.0, "crit": 2, "desc": "Imports __tls_get_addr from the dynamic loader", "spans": [ [ 4507, 12 ] ] }, { "id": "micro-behaviors/fs/path/config/system::config-etc", "conf": 0.66, "crit": 2, "desc": "Reference to /etc configuration files", "spans": [ [ 96699, 5 ], [ 96720, 5 ] ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 2, "desc": "Read symbolic link target path", "spans": [ [ 5451, 8 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-legacy64", "conf": 0.8, "crit": 3, "desc": "Read file status and metadata (legacy 64-bit)", "spans": [ [ 5273, 7 ], [ 5415, 7 ], [ 5423, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "atk": "T1106", "conf": 0.82, "crit": 3, "desc": "POSIX spawn attribute control", "spans": [ [ 4910, 20 ], [ 4994, 25 ], [ 5020, 24 ], [ 5078, 23 ], [ 5124, 29 ] ] }, { "id": "metadata/lang/compiled::gimli-crate", "conf": 0.9, "crit": 2, "desc": "Rust gimli crate (DWARF parsing)", "spans": [ [ 81908, 14 ] ] }, { "id": "micro-behaviors/dylib/library/libc::glibc-ref", "conf": 0.3, "crit": 2, "desc": "glibc reference", "spans": [ [ 1288283, 5 ] ] }, { "id": "metadata/lang/compiler/systems::expect-failed", "conf": 0.85, "crit": 2, "desc": "Rust expect failure message", "spans": [ [ 106006, 128 ], [ 119972, 91 ], [ 128342, 128 ], [ 133156, 128 ] ] }, { "id": "micro-behaviors/fs/memory/mmap::munmap", "conf": 0.66, "crit": 2, "desc": "Unmap files from memory", "spans": [ [ 4536, 6 ] ] }, { "id": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "conf": 0.76, "crit": 1, "desc": "Go allocation symbol bytes", "spans": [ [ 81369, 7 ] ] }, { "id": "metadata/binary/linking/static::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "spans": [ [ 1211602, 7 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "atk": "T1106", "conf": 0.86, "crit": 3, "desc": "POSIX spawn file actions", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ] ] }, { "id": "metadata/lang/compiled::addr2line-crate", "conf": 0.9, "crit": 2, "desc": "Rust addr2line backtrace symbolizer crate", "spans": [ [ 84035, 18 ] ] }, { "id": "metadata/file/metrics::peak-region-cipher-entropy", "conf": 0.85, "crit": 1, "desc": "Peak 1KB region at cipher entropy", "spans": [ [ 141312, 5120 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 4764, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/open::open64", "conf": 0.66, "crit": 2, "desc": "Open files (legacy 64-bit)", "spans": [ [ 4621, 6 ] ] }, { "id": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "conf": 0.8, "crit": 2, "desc": "Low ratio of sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 BIND request opcode", "spans": [ [ 924304, 8 ] ] }, { "id": "metadata/package/metrics::import-count-under-80", "conf": 0.84, "crit": 2, "desc": "Large binary with few DLL dependencies", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "spans": [ [ 1286861, 5 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.3, "crit": 2, "desc": "Delete files", "spans": [ [ 5408, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.3, "crit": 2, "desc": "Delete files by fd/path", "spans": [ [ 5579, 8 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "conf": 0.4, "crit": 1, "desc": "SIGHUP signal ignore pattern (x86_64)", "spans": [ [ 246892, 29 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "spans": [ [ 5683, 8 ] ] }, { "id": "metadata/hardening/missing::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "spans": [ [ 1211561, 7 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "conf": 0.86, "crit": 1, "desc": "Interleaved wget command token", "spans": [ [ 113452, 11 ], [ 1362572, 11 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.9, "crit": 1, "desc": "SOCKS5 client greeting bytes", "spans": [ [ 245865, 8 ] ] }, { "id": "metadata/hardening/missing::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "spans": [ [ 1211799, 8 ] ] }, { "id": "micro-behaviors/os/env/vars/access::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "spans": [ [ 4696, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 4787, 7 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "conf": 0.66, "crit": 2, "desc": "Read own executable path (/proc/self/exe)", "spans": [ [ 130972, 14 ], [ 998392, 14 ] ] }, { "id": "metadata/hardening/missing::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "spans": [ [ 1211602, 7 ] ] }, { "id": "metadata/hardening/missing::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "spans": [ [ 1211648, 7 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-2000", "conf": 0.9, "crit": 1, "desc": "High plaintext string count", "spans": [ [ 0, 29 ] ] }, { "id": "well-known/malware/botnet/mozi::xor-pattern-2", "conf": 1.0, "crit": 1, "desc": "XOR loop pattern variant 2", "spans": [ [ 815131, 11 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 UDP ASSOCIATE request opcode", "spans": [ [ 927429, 8 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "conf": 0.66, "crit": 3, "desc": "Uses fdopendir", "spans": [ [ 5559, 9 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "conf": 0.66, "crit": 3, "desc": "Uses readdir64", "spans": [ [ 5569, 9 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6, "crit": 3, "desc": "ELF debug stripped with .symtab", "spans": [ [ 0, 38 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "conf": 0.86, "crit": 1, "desc": "Interleaved tftp command token", "spans": [ [ 81591, 12 ], [ 99621, 11 ], [ 1242674, 12 ], [ 1246925, 13 ], [ 1275519, 11 ], [ 1335837, 13 ], [ 1335969, 13 ], [ 1343139, 13 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 4802, 7 ] ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "spans": [ [ 97485, 22 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn with FD actions", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ], [ 5162, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.66, "crit": 2, "desc": "Write files", "spans": [ [ 4745, 5 ] ] }, { "id": "objectives/persistence/system/daemon/init::daemonize-self-reexec", "atk": "T1543", "mbc": "F0006", "crit": 2, "desc": "Daemonizes via self-exe re-exec + fork/setsid", "spans": [ [ 5218, 6 ], [ 130972, 14 ], [ 998392, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 94824, 26 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 94807, 13 ], [ 94824, 26 ], [ 106006, 128 ], [ 112540, 6 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.3, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "spans": [ [ 4834, 4 ], [ 5218, 6 ], [ 94275, 9 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-core", "conf": 0.66, "crit": 2, "desc": "Core directory iteration symbols", "spans": [ [ 5559, 9 ], [ 5569, 9 ], [ 5683, 8 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 4572, 4 ] ] }, { "id": "metadata/lang/compiler/systems::rust-binary", "conf": 0.95, "crit": 2, "desc": "Rust-compiled binary", "spans": [ [ 81314, 47 ], [ 81401, 9 ], [ 81594, 12 ], [ 81678, 10 ], [ 81794, 9 ], [ 81883, 9 ], [ 81930, 10 ], [ 82096, 9 ] ] }, { "id": "metadata/lang/compiled::rust-backtrace-symbolizer", "conf": 0.95, "crit": 2, "desc": "Rust std backtrace symbolizer stack", "spans": [ [ 81908, 14 ], [ 84035, 18 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 2, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 4572, 4 ], [ 4745, 5 ] ] }, { "id": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "atk": "T1106", "conf": 0.88, "crit": 3, "desc": "Child process stdio pipe redirect", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ], [ 5162, 12 ], [ 5267, 5 ] ] }, { "id": "micro-behaviors/ui/help::documented-cli-binary", "conf": 0.85, "crit": 1, "desc": "Documented command line program", "spans": [ [ 0, 22 ], [ 94824, 26 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "fdD", "ln": 1, "addr": 0 }, { "b": "lVl{?A+Pf1Brz#0diHx1gbZmPzE^s0v{%EkgDb", "ln": 2, "addr": 3 }, { "b": "ra]#!aAhvtxl4A$azC)tw].D]aAIEkBA.elwJy@Vz/)gjvqWidwN]H@BAh88B-.gqx(\u003eFazE+zsAV/jqwnbU3", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 34, "z": 4, "cf": 0.8 } ], "ln": 3, "addr": 34 }, { "b": "x(\u003eFuzE^s0aARpdaARgnzf3?rw/#hewGTGrruK!yzE)\u0026%y-(L%vR/:*awuGVwO#N2ayPslAckSax(^%0wftub", "ln": 4, "addr": 103 }, { "b": "BzbkdmSJ6Kax9h\u003cBA.elwGTDXB-7.#BzkVhefFIrBzblaaA?spB7]MgatUcUw/#hewGTVXv}xL0wH[%xAS", "ln": 5, "addr": 172 }, { "b": "B-RapB97}Ni=GaTv}x.5iY.QPz/6u1zE+pvq/(L:z*:X", "ln": 16, "addr": 461 }, { "b": "", "ln": 17, "addr": 497 }, { "b": "fe1EcLZ}+TFfmf)zEENhaAg+hxMCrQLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z", "n": [ { "c": 2, "d": "Box drawing text banner", "i": "metadata/file/format::box-drawing-banner", "o": 521, "z": 165, "cf": 0.9 } ], "ln": 18, "addr": 498 }, { "b": "", "ln": 19, "addr": 687 }, { "b": "v@DmaBrA\u003eHqBaURnLRq?arS1LBAeG!ar\u0026EYB8\u0026{yx(kOjB-H[mi@", "ln": 20, "addr": 688 }, { "b": "", "ln": 33, "addr": 1392 }, { "b": "v@DmaBrBTXqCoF=q:\u003cU)mOcoxiV]K(B98BBjS\u003e}4wPRAnwO(10xjS-uz/PV8e]$PCb0b", "ln": 34, "addr": 1393 }, { "b": "v@DmaBrA\u003eoq^R\u003c\u003enLzJVlp1KsiV]K(B98BBjS\u003e}4BzU$IvrDQ0eOe^gA+w@nvpBp4i@", "n": [ { "c": 1, "d": "tmp keyword", "i": "metadata/file/string/file::tmp", "o": 1480, "z": 3, "cf": 0.2 } ], "ln": 35, "addr": 1448 }, { "b": "v@DmaBrBTXqCoF=q:\u003cU)r83gIarS1LBAeG!ar\u0026EIByM$nzdN:2wInmCA+]nsB7GCCBzU$vi@", "ln": 36, "addr": 1502 }, { "b": "", "ln": 37, "addr": 1560 }, { "b": "arR^HA+e({zAn[Hz/oCy", "ln": 149, "addr": 4625 }, { "b": "", "ln": 150, "addr": 4642 }, { "b": "arR^Hfe1$3qE}C2wPI^aC4z!pwPhNex([olC{46DwObU3wPF#az/M$ey?$kkvpK7YxjVcbx(k5qz/PV8e]$PC", "n": [ { "c": 1, "d": "Source/repository/workspace target-word component", "i": "objectives/impact/destroy/keywords::destructive-code-target", "o": 4662, "z": 10, "cf": 1.0 } ], "ln": 151, "addr": 4643 }, { "b": "arR^Hbu[O%xddOmzF77Par\u003e\u0026qxjU%jCw?IrwfJEd", "ln": 152, "addr": 4712 }, { "b": "arR^HA+e({zEmQaA+]nEayYncy+b", "ln": 153, "addr": 4745 }, { "b": "arR^HarR^He[O*lBy/FvD#KDQDJ", "ln": 264, "addr": 9973 }, { "b": "arR^HarR^HarR^Hx\u003ewFhC42i3wmoN\u003euVo^[c#ZQTDJ", "ln": 265, "addr": 9995 }, { "b": "arR^HarR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8XzGYD8x\u003eeu9vpK7YxjSi6vqPM#d06frAbYx0dlnO#EiHi+A49\u003c", "n": [ { "c": 1, "d": "String literal contains invalid word", "i": "metadata/file/format::vocab-invalid", "o": 10060, "z": 7, "cf": 0.97 } ], "ln": 266, "addr": 10029 }, { "b": "arR^HarR^HarR^HarR^Hw)]H%wD", "ln": 267, "addr": 10101 }, { "b": "arR^HarR^HarR^HEir9qB7DFv", "ln": 268, "addr": 10123 }, { "b": "arR^Hw]zYjvRGZ5x(k4utr#m!l0(@IpaNI:k%[vjpg3sVpaNI^ryxR\u0026lp\u003c{6axg=#uQvsVefEU/uQvsVefE?+uQvsVt{aE", "ln": 280, "addr": 10493 }, { "b": "arR^HarR^Hx\u003ewFhB97}Ni=FIHxGwgJvrufzi=nIMc$l[ddk2gRx(!xqc[co=", "ln": 281, "addr": 10569 }, { "b": "arR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8Uvrt{]iV@DOADL#owN(])x(mv1C{40yBrCglB-7.JaBwIXefFzozyET", "n": [ { "c": 1, "d": "String literal contains required word", "i": "metadata/file/format::vocab-required", "o": 10652, "z": 8, "cf": 0.97 } ], "ln": 282, "addr": 10618 }, { "b": "arR^HarR^HarR^HB97}Ni=GaTv}x.5iYZ?%x(\u003e:Tdlv", "ln": 283, "addr": 10690 }, { "b": "arR^HarR^HEe", "ln": 284, "addr": 10725 }, { "b": "arR^HzEEx[iV}vyA+PA7ec", "ln": 302, "addr": 11444 }, { "b": "arR^HC4CYnx(v(Iax9x5x(mMm", "ln": 303, "addr": 11462 }, { "b": "arR^HA+fidiV}vyA+PA7ec", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 11487, "z": 4, "cf": 0.88 } ], "ln": 304, "addr": 11483 }, { "b": "arR^Hfe1$3b2fs8zE[2yar\u003c/faA.ToA:-G\u0026efDc8a%pAmCw.5lvpS}2ar\u003cYcaAz4czGx]dy?%", "ln": 305, "addr": 11501 }, { "b": "arR^HB97\u0026jB-PO^q/)4]zF7H", "ln": 306, "addr": 11560 }, { "b": "fe1$3lVl*XB-.gqx(n0lvqG:5B97\u0026jB-PO^pcAGaCpT\u003epj-$ZRA:-G\u0026efEtzwn=Wfxl4A\u003ewH[%4j-UaFzGx]dy?$Z", "ln": 309, "addr": 11583 }, { "b": "w]n-gyId0}ByxolB0${mzdL:JcuBoHefF?wCvbJ8AYLr\u0026B98BKat2=1q/)4]zF78s", "ln": 310, "addr": 11655 }, { "b": "arR^Hy?mYhz/{dAjS[//wi8+\u003cA=kD0B8%x6lVl*UvqYQpi=nIMc@rh%o*IJYlp\u003c{3", "n": [ { "c": 3, "d": "Builds process via Command::new", "i": "micro-behaviors/process/create/direct::rust-async-process", "o": 11736, "z": 13, "cf": 0.92 } ], "ln": 311, "addr": 11708 }, { "b": "arR^HarR^He[5^kB0$lpeM0Yyaz$R8wNc.", "ln": 312, "addr": 11761 }, { "b": "arR^HarR^He[F{zc)ztLuQmvVa$K\u0026XlN0@", "ln": 313, "addr": 11789 }, { "b": "arR^HarR^He]#bBz/{dIB97}Ni=GaTv}x.5iYZhYwnb%yi=F!LwN)hrdf", "ln": 314, "addr": 11817 }, { "b": "arR^HarR^He]#bBwPz/tB97}Ni=GaTv}x.5iYZhYwnb%yi=o7Ry:Z.Y", "ln": 315, "addr": 11863 }, { "b": "arR^HarR^He]L(OAclmJdlv", "n": [ { "c": 1, "d": "build.rs captures command output", "i": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "o": 11916, "z": 9, "cf": 0.88 } ], "ln": 316, "addr": 11908 }, { "b": "arR^Hy?mYhx(n0lvqG:\u003ewfs2TzddJ@xDRkoBrC]", "ln": 317, "addr": 11927 }, { "b": "arR^HarR^HpIRv%diJtpaA5(NByxolB1RJRv}f7\u003eB0@EWjW70n", "ln": 318, "addr": 11959 }, { "b": "fe1$3mRcWKxDPPvqxP{!v@2H=wGUY8w]w/nx\u003c\u0026bol1}DWB-.OBBrCKhA=U@jxd:", "ln": 440, "addr": 16354 }, { "b": "w]n-iwPI^aC4C2?B-F)HyIdYHaspq\u003eBAh8kxi=@eeJ$pTwN^\u00260yIcjRw]x\u003cQDJ", "ln": 441, "addr": 16405 }, { "b": "arR^Hy?mYhzfo}yA+frmy\u0026*^.axA5-iY.d\u0026Cpj[4", "n": [ { "c": 1, "d": "Command/result vocabulary pair", "i": "objectives/command-and-control/remote-command/keywords::command-result-word", "o": 16467, "z": 71, "cf": 0.4 } ], "ln": 442, "addr": 16455 }, { "b": "arR^Hw]zYjAbf8ex(k5jyIdYhDJ", "ln": 443, "addr": 16488 }, { "b": "arR^HarR^Hy?mYhz/{evB-X-?avy6:zddr)iY.d\u0026Cpk:SqBaURnLQY", "ln": 444, "addr": 16510 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HzEEx[auZ\u0026\u003ce{8bFz73?=Bz\u003eJcBAh8kxdbh\u003c", "ln": 457, "addr": 17016 }, { "b": "arR^HarR^HarR^HarR^HarR^HEe", "ln": 458, "addr": 17069 }, { "b": "arR^HarR^HarR^HarR^HEir9qB7DFdw/$]7zE\u003eCwByxiiB6\u003cc9Bz96Dr+lq)x(v(kdiJ%", "n": [ { "c": 1, "d": "WMI Version result field", "i": "objectives/discovery/host/fingerprint::version-field", "o": 17135, "z": 7, "cf": 0.9 } ], "ln": 459, "addr": 17091 }, { "b": "arR^HarR^HarR^HarR^HarR^Hx\u003ewG7wPP4[z/65lB$1K%az++fwIe4yy?W#tcPSR7e]C=Ac]0d[DJ", "ln": 460, "addr": 17147 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HC4CYnx(v(ijS[]2BAh8jc[c=\u003cz^NNcA+PA7c[dj", "ln": 461, "addr": 17209 }, { "b": "fe1$3m}D=+BzbkdA+fidB7]-mA^n^oaAg+0yHH\u003c!aA}mnazC.mByx04wN(]}A=k!qc$L2ze*8uFvpJ$@z/WHwCYW$meP@]]efDcBB-FVPe=", "ln": 473, "addr": 17489 }, { "b": "fe1%", "ln": 474, "addr": 17575 }, { "b": "fe1$3Aa9l[vqWiaB-.OBBrCpsaz+$avqGHbwmYZ\u003ezE^r@Brz$QqE%/=B7]-mA^n\u0026KfczE=Q0XOvZr\u003cgjXy3eWWiu.Dar\u003cY{AbP/iBz(hBa%pDsv\u003eGh.", "n": [ { "c": 3, "d": "Cyrillic script detection (Russian/Ukrainian)", "i": "metadata/file/profile/language::lang-russian", "o": 17634, "z": 14, "cf": 0.8 } ], "ln": 475, "addr": 17579 }, { "b": "fe1$3s7JH^z/Pu0awtdfk$\u003c%nlM*C*azbt0y?aVavqPN%ayPq4ayP8gvr(]pmq=:Ox(^@u", "ln": 476, "addr": 17672 }, { "b": "fe1%", "ln": 477, "addr": 17729 }, { "b": "arR^HarR^Hv@k:evrc0eA49\u003c", "ln": 602, "addr": 22373 }, { "b": "arR^HEe", "ln": 603, "addr": 22393 }, { "b": "arR^HzddJ@xDQ/4wg?}BvruTkc[co=", "n": [ { "c": 1, "d": "build.rs waits on command status", "i": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "o": 22412, "z": 9, "cf": 0.86 } ], "ln": 604, "addr": 22399 }, { "b": "arR^HarR^HpIRw1diH=qaAGeRBZ[])B8@-Uec", "ln": 605, "addr": 22424 }, { "b": "arR^HarR^Hmriz%wHO-+j%kg", "ln": 606, "addr": 22454 }, { "b": "arR^Hfe1CEA^n^HzY\u0026U6ByO#be(LUnnLR-JazbUjz6ht.BwcaLaAy[mave*}", "ln": 617, "addr": 22859 }, { "b": "arR^Hy?mYhB-IpvjS[uPA=2lbaT!KYEj]}}flgGBfgXI$l[Ze\u003eqBs2JmO+iVaves)uQ)W!oHh0Llp1KsefF[Exdk[", "ln": 618, "addr": 22908 }, { "b": "arR^Hy?mYhz/{evB-X-?avy6:zddr)iY.d\u0026CpjUBB-Ipxdf", "n": [ { "c": 3, "d": "Rust invokes curl or wget", "i": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "o": 22997, "z": 19, "cf": 0.82 } ], "ln": 619, "addr": 22980 }, { "b": "arR^HarR^He[5^kB0$lpePUIFefDb*eP1{veP+YzwG\u0026VFa#HL}asqkKy*wE", "ln": 620, "addr": 23018 }, { "b": "arR^HarR^He]#bBz/{dIq/(L:z-P{#x(ES]c[cO", "ln": 621, "addr": 23066 }, { "b": "arR^HarR^Hx\u003ewFhC42i3wmoN\u003euVo^[c$lR9wHO:HD(#)bA+c\u003ekz/fV9x(m#ucOD?@aBs", "ln": 654, "addr": 24255 }, { "b": "arR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8TA=M8siV@cOC42i3wft\u00261v@2H=wGU(0zdK?qDWNm:\u0026^^moB8bGeAa%i5a$K\u003cCvrb{di@", "n": [ { "c": 1, "d": "String literal contains invalid word", "i": "metadata/file/format::vocab-invalid", "o": 24344, "z": 7, "cf": 0.97 } ], "ln": 655, "addr": 24310 }, { "b": "arR^HarR^HarR^HA+funA=90{z/fbF", "ln": 656, "addr": 24392 }, { "b": "arR^HarR^Hfe1CzAaJ]fp!KqBry]\u003eLazCZobT\u003e9)r8lymvR6d\u0026A+cw5B.LV5x(mMax\u003ewFteOeEbBrCpsaAIao", "ln": 737, "addr": 27183 }, { "b": "arR^HarR^Hx\u003ewG0wnccdDJ", "ln": 738, "addr": 27252 }, { "b": "arR^HarR^HarR^Hy?mYhwN]H%z/M%-aAITniYZ?\u0026B#?Wcvr9+ummoZDpF@w=", "n": [ { "c": 3, "d": "Rust environment variable lookup", "i": "micro-behaviors/os/env/access::std-env-var", "o": 27295, "z": 14, "cf": 0.86 } ], "ln": 739, "addr": 27270 }, { "b": "arR^HarR^HarR^HarR^He]L=qwO=B0d12xHaAITniYZ?\u0026B#?Wcvr9+ur.lj\u0026k$\u0026EKdf", "ln": 740, "addr": 27319 }, { "b": "arR^HarR^HarR^HarR^He{h5QA:-]]z/Ph@y\u0026:eoD%.mzb5Q?bzZ3/Qz^NNcA+PA7c[cPb", "ln": 741, "addr": 27373 }, { "b": "arR^HarR^HarR^HB97}Ni=GaTv}x.5iYZ?%x(\u003e:Tdlv", "ln": 977, "addr": 36130 }, { "b": "arR^HarR^HEe", "ln": 978, "addr": 36165 }, { "b": "arR^HarR^Hy?mYhCw?Irwm5!OA+doOnmuNMq!p5kq/)4]zF8cQjS[PIByO#bw]*0]mRMWIiY.g#wO@[$pF%\u003eOuSfx)uQ^QXmjxva", "n": [ { "c": 2, "d": "Rust file open call", "i": "micro-behaviors/fs/file/open::rust-file-open", "o": 36227, "z": 11, "cf": 0.86 } ], "ln": 979, "addr": 36175 }, { "b": "arR^HarR^HarR^HpIRv\u003cx(4ufau.[hx(u3[luM)rwNPaXAYMm0wP]Lmx(4uf", "ln": 980, "addr": 36256 }, { "b": "arR^HarR^HarR^HarR^He]kltwPGmG", "ln": 981, "addr": 36305 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1CTz/P(fv@@\u0026lwPhMgAb]J4x)p+twPw]jvpK7YxjSXrra]#!az\u003eLeBy/GlazbLjayL", "ln": 1344, "addr": 51425 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C+x)si1aA7\u003e7x\u003e7\u003c=y+4!KqxPW\u003eB97\u0026by-)}nwPzu8z/fbexKLZ?ay!?$aAIWnv}xjZ", "ln": 1345, "addr": 51500 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C(xLzo]aARpdaA8vnwPw]9vqfL0aMv{oaA}xtzfo]waz#ataz+$qwGV8nvpK6}z!pblxK}", "n": [ { "c": 2, "d": "Rust while loop", "i": "micro-behaviors/data/control-flow/loop::rust-while-loop", "o": 51600, "z": 6, "cf": 0.75 } ], "ln": 1346, "addr": 51577 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1CYvqGJ#Bzb98aA}:AyH}3cayPd#az(mxBrCEtBrCglA:@V6vqWhivrDPmaAhvjw[=F", "ln": 1347, "addr": 51656 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C^zGG!tvqWiaw[C:!x\u003c\u003e*2Aa9l(vp%c]z/M$zx\u003e7Y%C4CYnvj?", "ln": 1348, "addr": 51732 }, { "b": "", "ln": 1412, "addr": 54230 }, { "b": "arR^Hx\u003ewF$xKL^\u003ewN(]DjS(B3DJ", "ln": 1413, "addr": 54231 }, { "b": "arR^HarR^HAb]VgBzL?rc)B1^aA}:Ay?betwPP5eB0a[cA+eV\u0026C{4lGaARJAwmoN\u003ee*q??b0FgOa$^IGwO2:cdk27Fy?a}ydlv", "n": [ { "c": 1, "d": "String literal contains date word", "i": "metadata/file/format::vocab-date", "o": 54301, "z": 4, "cf": 0.97 } ], "ln": 1414, "addr": 54253 }, { "b": "arR^HarR^HA+funA=9@", "ln": 1415, "addr": 54332 }, { "b": "arR^HEe", "ln": 1416, "addr": 54348 }, { "b": "arR^HarR^HarR^He]#bBx(ks$ByY97iY.j]AaJMddjC", "ln": 1520, "addr": 58015 }, { "b": "arR^HarR^HarR^He]#bBz/{dIq/(L:z-P{%B.\u003e\u003exdjC", "ln": 1521, "addr": 58050 }, { "b": "arR^HarR^HarR^He]$#uCwX/Ti@", "n": [ { "c": 3, "d": "spawn API call", "i": "micro-behaviors/process/create/exec::spawn-api-call", "o": 58098, "z": 6, "cf": 0.85 } ], "ln": 1522, "addr": 58085 }, { "b": "", "ln": 1523, "addr": 58107 }, { "b": "arR^HarR^HzddJ@xDQ!#x(4r!Ab](baBs", "ln": 1524, "addr": 58108 }, { "b": "arR^HDJ", "ln": 1548, "addr": 59050 }, { "b": "arR^HarR^HpIRw1diJtpaAGeRBZ[])B8@-Uau.[hAb]VgBzL?rc)y\u0026sj%k5/A+]nsB7GCoB-p(1By!#na$k5", "ln": 1549, "addr": 59056 }, { "b": "arR^HarR^HpIRv=diH=qaz2Ijx(n3ezxQzLk0zdMmriA!AYLs:B.2zkzfv4lvqfK?wfu8fwO@S5x(mu}x)KGhxcqzpA+]nsB7GCCa$k5", "n": [ { "c": 1, "d": "sudo command keyword", "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "o": 59163, "z": 4, "cf": 0.7 } ], "ln": 1550, "addr": 59124 }, { "b": "arR^HarR^Hmriz%wHO-+j%jAQA+PAky\u0026gyAb0FgOavQr\u003ez/N(YB9h2iaz(oAv@DHawft=dBrC47aAIHgCwZ#5iV@=$a$K\u003cFdj+", "ln": 1551, "addr": 59208 }, { "b": "arR^HEe", "ln": 1552, "addr": 59287 }, { "b": "Ee", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 118304, "z": 52, "cf": 1.0 } ], "ln": 1553, "addr": 59293 } ], "depth": 3, "facts": { "imp": [ [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "pkg.starts_with" ], [ "", "pkg.contains" ], [ "", "pkg.contains" ], [ "", "pkg.chars.all" ], [ "", "pkg.chars" ], [ "", "c.is_alphanumeric" ], [ "", "\"@._+-/\".contains" ], [ "", "packages.iter.filter.cloned.collect" ], [ "", "packages.iter.filter.cloned" ], [ "", "packages.iter.filter" ], [ "", "packages.iter" ], [ "", "validate_pkg" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "meta.file_type.is_symlink" ], [ "", "meta.file_type" ], [ "", "o.status.success" ], [ "", "s.split_whitespace.nth.unwrap_or.to_string" ], [ "", "s.split_whitespace.nth.unwrap_or" ], [ "", "s.split_whitespace.nth" ], [ "", "s.split_whitespace" ], [ "", "\"N\".to_string" ], [ "", "installed.is_empty" ], [ "", "\"N\".to_string" ], [ "", "\"R\".to_string" ], [ "", "\"U\".to_string" ], [ "", "\"R\".to_string" ], [ "", "\"D\".to_string" ], [ "", "p.repo.is_empty" ], [ "", "format" ], [ "", "format" ], [ "", "status.green.bold.to_string" ], [ "", "status.green.bold" ], [ "", "status.green" ], [ "", "status.yellow.bold.to_string" ], [ "", "status.yellow.bold" ], [ "", "status.yellow" ], [ "", "status.red.bold.to_string" ], [ "", "status.red.bold" ], [ "", "status.red" ], [ "", "status.cyan.bold.to_string" ], [ "", "status.cyan.bold" ], [ "", "status.cyan" ], [ "", "vec" ], [ "", "pkgs.iter.map.collect" ], [ "", "pkgs.iter.map" ], [ "", "pkgs.iter" ], [ "", "args.extend_from_slice" ], [ "", "output.status.success" ], [ "", "stdout.lines.filter.map.collect" ], [ "", "stdout.lines.filter.map" ], [ "", "stdout.lines.filter" ], [ "", "stdout.lines" ], [ "", "l.is_empty" ], [ "", "line.splitn" ], [ "", "parts.next.unwrap_or.to_string" ], [ "", "parts.next.unwrap_or" ], [ "", "parts.next" ], [ "", "parts.next.unwrap_or.to_string" ], [ "", "parts.next.unwrap_or" ], [ "", "parts.next" ], [ "", "name.contains" ], [ "", "name.splitn" ], [ "", "p.next.unwrap_or.to_string" ], [ "", "p.next.unwrap_or" ], [ "", "p.next" ], [ "", "p.next.unwrap_or.to_string" ], [ "", "p.next.unwrap_or" ], [ "", "p.next" ], [ "", "name.clone" ], [ "", "pkg_status" ], [ "", "infos.is_empty" ], [ "", "Some" ], [ "", "p.split.last.unwrap_or.to_string" ], [ "", "p.split.last.unwrap_or" ], [ "", "p.split.last" ], [ "", "p.split" ], [ "", "probe_official" ], [ "", "found_names.insert" ], [ "", "info.name.clone" ], [ "", "found.push" ], [ "", "pkgs.iter.filter.collect" ], [ "", "pkgs.iter.filter" ], [ "", "pkgs.iter" ], [ "", "found_names.contains" ], [ "", "bare_of" ], [ "", "probe_official" ], [ "", "infos.is_empty" ], [ "", "found.append" ], [ "", "missing.push" ], [ "", "pkg.clone" ], [ "", "pkg.clone" ], [ "", "stdout.lines" ], [ "", "line.starts_with" ], [ "", "line.split.nth" ], [ "", "line.split" ], [ "", "v.trim.to_string" ], [ "", "v.trim" ], [ "", "line.starts_with" ], [ "", "line.split.nth" ], [ "", "line.split" ], [ "", "v.trim.to_string" ], [ "", "v.trim" ], [ "", "pkg_status" ], [ "", "result.push" ], [ "", "\"aur\".to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "out.status.success" ], [ "", "Some" ], [ "", "stdout.lines" ], [ "", "line.starts_with" ], [ "", "line.starts_with" ], [ "", "line.splitn.nth" ], [ "", "line.splitn" ], [ "", "val.trim.to_string" ], [ "", "val.trim" ], [ "", "r.is_empty" ], [ "", "Some" ], [ "", "pacman_c" ], [ "", "first_repo" ], [ "", "pacman_c" ], [ "", "first_repo" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "get_pkg_repo" ], [ "", "format" ], [ "", "forced_prefix.unwrap_or" ], [ "", "format" ], [ "", "bare.to_string" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "pkgs.len" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "pkgs.iter.enumerate" ], [ "", "pkgs.iter" ], [ "", "pkgs.len" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "pkgs.iter.enumerate" ], [ "", "pkgs.iter" ], [ "", "format_atom.green.bold.to_string" ], [ "", "format_atom.green.bold" ], [ "", "format_atom.green" ], [ "", "format_atom" ], [ "", "total.to_string.yellow.bold.to_string" ], [ "", "total.to_string.yellow.bold" ], [ "", "total.to_string.yellow" ], [ "", "total.to_string" ], [ "", "total.to_string.green.bold.to_string" ], [ "", "total.to_string.green.bold" ], [ "", "total.to_string.green" ], [ "", "total.to_string" ], [ "", "cmd.args" ], [ "", "cmd.arg" ], [ "", "cmd.status" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "format" ], [ "", "out.status.success" ], [ "", "text.lines" ], [ "", "line.trim" ], [ "", "line.starts_with" ], [ "", "\"pkgver = \".len" ], [ "", "\"?\".to_string" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "pkgs.iter.filter_map.collect" ], [ "", "pkgs.iter.filter_map" ], [ "", "pkgs.iter" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "validate_pkg" ], [ "", "bare.contains" ], [ "", "eprintln" ], [ "", "abs_get_version" ], [ "", "pkg_status" ], [ "", "Some" ], [ "", "bare.to_string" ], [ "", "\"abs\".to_string" ], [ "", "pkg_infos.is_empty" ], [ "", "format" ], [ "", "build_base.exists" ], [ "", "pkg_infos.iter.enumerate" ], [ "", "pkg_infos.iter" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "build_base.join" ], [ "", "pkg_dir.starts_with" ], [ "", "eprintln" ], [ "", "pkg_dir.exists" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "pkg_dir.join" ], [ "", "trunk_dir.exists" ], [ "", "pkg_dir.clone" ], [ "", "\"nano\".to_string" ], [ "", "build_dir.join" ], [ "", "vec" ], [ "", "makepkg_args.push" ], [ "", "makepkg_args.push" ], [ "", "makepkg_args.push" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "args.get.map.unwrap_or" ], [ "", "args.get.map" ], [ "", "args.get" ], [ "", "args.get.map.unwrap_or" ], [ "", "args.get.map" ], [ "", "args.get" ], [ "", "args.get.or_else.map.unwrap_or" ], [ "", "args.get.or_else.map" ], [ "", "args.get.or_else" ], [ "", "args.get" ], [ "", "args.get" ], [ "", "s.lines" ], [ "", "line.splitn" ], [ "", "p.next" ], [ "", "p.next" ], [ "", "print" ], [ "", "n.to_str" ], [ "", "portageq_shim" ], [ "", "print_help" ], [ "", "check_binaries" ], [ "", "eprintln" ], [ "", "cli.packages.iter.any" ], [ "", "cli.packages.iter" ], [ "", "validate_packages" ], [ "", "cli.packages.iter.filter.cloned" ], [ "", "cli.packages.iter.filter" ], [ "", "cli.packages.iter" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "probe_official.is_some" ], [ "", "probe_official" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "target_pkgs.is_empty" ], [ "", "run_cmd" ], [ "", "regen_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "l.trim.is_empty" ], [ "", "l.trim" ], [ "", "l.trim.split.last.unwrap_or.to_string" ], [ "", "l.trim.split.last.unwrap_or" ], [ "", "l.trim.split.last" ], [ "", "l.trim.split" ], [ "", "l.trim" ], [ "", "eprintln" ], [ "", "l.trim.to_string" ], [ "", "l.trim" ], [ "", "l.is_empty" ], [ "", "installed.into_iter.filter.collect" ], [ "", "installed.into_iter.filter" ], [ "", "installed.into_iter" ], [ "", "world_bare.contains" ], [ "", "to_remove.is_empty" ], [ "", "vec" ], [ "", "args.push" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "vec" ], [ "", "args.push" ], [ "", "run_cmd" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "add_to_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "remove_from_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "vec" ], [ "", "s_args.push" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "orphans_str.lines.map.filter.collect" ], [ "", "orphans_str.lines.map.filter" ], [ "", "orphans_str.lines.map" ], [ "", "orphans_str.lines" ], [ "", "s.trim.to_string" ], [ "", "s.trim" ], [ "", "s.is_empty" ], [ "", "orphans.is_empty" ], [ "", "vec" ], [ "", "pacman_args.push" ], [ "", "pacman_args.push" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "p.split.last.unwrap_or" ], [ "", "p.split.last" ], [ "", "p.split" ], [ "", "o.status.success" ], [ "", "\"?\".to_string" ], [ "", "get_pkg_repo.unwrap_or_default" ], [ "", "get_pkg_repo" ], [ "", "repo.is_empty" ], [ "", "bare.to_string" ], [ "", "format" ], [ "", "vec" ], [ "", "aura_args.push" ], [ "", "aura_args.push" ], [ "", "aura_args.push" ], [ "", "run_cmd" ], [ "", "remove_from_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "base_args.push" ], [ "", "base_args.push" ], [ "", "base_args.push" ], [ "", "abs_install" ], [ "", "resolve_aur" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "probe_official_split" ], [ "", "missing.is_empty" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "official_infos.is_empty" ], [ "", "eprintln" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "official_infos.iter.map.collect" ], [ "", "official_infos.iter.map" ], [ "", "official_infos.iter" ], [ "", "p.name.clone" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "official_infos.is_empty" ], [ "", "resolve_aur" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "resolve_aur" ], [ "", "official_infos.clone" ], [ "", "all_infos.extend" ], [ "", "aur_infos.clone" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "official_infos.iter.map.collect" ], [ "", "official_infos.iter.map" ], [ "", "official_infos.iter" ], [ "", "p.name.clone" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "installed_infos.extend" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "installed_infos.extend" ], [ "", "installed_infos.is_empty" ], [ "", "print_emerge_completed" ], [ "", "add_to_world_set" ], [ "", "Some" ], [ "", "installed_infos.is_empty" ], [ "", "installed_infos.iter.filter.map.collect" ], [ "", "installed_infos.iter.filter.map" ], [ "", "installed_infos.iter.filter" ], [ "", "installed_infos.iter" ], [ "", "p.name.clone" ], [ "", "installed_infos.iter.filter.map.collect" ], [ "", "installed_infos.iter.filter.map" ], [ "", "installed_infos.iter.filter" ], [ "", "installed_infos.iter" ], [ "", "p.name.clone" ], [ "", "official_names.is_empty" ], [ "", "add_to_world_set" ], [ "", "aur_names.is_empty" ], [ "", "add_to_world_set" ], [ "", "Some" ], [ "", "eprintln" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "l.trim.to_string" ], [ "", "l.trim" ], [ "", "l.is_empty" ], [ "", "eprintln" ], [ "", "entry.split.last.unwrap_or" ], [ "", "entry.split.last" ], [ "", "entry.split" ], [ "", "pkg_world_entry" ], [ "", "updated.push" ], [ "", "updated.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "line.trim.to_string" ], [ "", "line.trim" ], [ "", "trimmed.is_empty" ], [ "", "validate_pkg" ], [ "", "trimmed.split.last.unwrap_or.to_string" ], [ "", "trimmed.split.last.unwrap_or" ], [ "", "trimmed.split.last" ], [ "", "trimmed.split" ], [ "", "current_set.insert" ], [ "", "pkg.split.last.unwrap_or.to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "pkg_world_entry" ], [ "", "current_set.get.map.unwrap_or" ], [ "", "current_set.get.map" ], [ "", "current_set.get" ], [ "", "current_set.insert" ], [ "", "current_set.into_values.collect" ], [ "", "current_set.into_values" ], [ "", "sorted.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "line.trim.to_string" ], [ "", "line.trim" ], [ "", "trimmed.is_empty" ], [ "", "validate_pkg" ], [ "", "trimmed.split.last.unwrap_or.to_string" ], [ "", "trimmed.split.last.unwrap_or" ], [ "", "trimmed.split.last" ], [ "", "trimmed.split" ], [ "", "current_set.insert" ], [ "", "pkg.split.last.unwrap_or.to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "current_set.remove.is_some" ], [ "", "current_set.remove" ], [ "", "current_set.into_values.collect" ], [ "", "current_set.into_values" ], [ "", "sorted.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "child.stdin.take" ], [ "", "writeln" ], [ "", "child.wait" ], [ "", "s.success" ], [ "", "s.success" ], [ "", "clap" ], [ "", "colored" ], [ "", "std" ] ], "mbr": [ "all_infos.extend", "args.extend_from_slice", "args.get", "args.get().map", "args.get().map().unwrap_or", "args.get().or_else", "args.get().or_else().map", "args.get().or_else().map().unwrap_or", "args.push", "aur_args.extend", "aur_infos.clone", "aur_names.is_empty", "aura_args.push", "bare.contains", "bare.to_string", "base_args.push", "build_base.exists", "build_base.join", "build_dir.join", "c.is_alphanumeric", "child.stdin", "child.stdin.take", "child.wait", "cli.abs", "cli.ask", "cli.aur", "cli.depclean", "cli.deselect", "cli.edit", "cli.help", "cli.noreplace", "cli.oneshot", "cli.only_repos", "cli.packages", "cli.packages.iter", "cli.packages.iter().any", "cli.packages.iter().filter", "cli.packages.iter().filter().cloned", "cli.packages.iter().filter().cloned().collect", "cli.pretend", "cli.prune", "cli.refresh", "cli.regen", "cli.regen_world", "cli.resume", "cli.search", "cli.searchdesc", "cli.select", "cli.skipfirst", "cli.skippgp", "cli.sync", "cli.unmerge", "cli.update", "cli.verbose", "cli.version", "cmd.arg", "cmd.args", "cmd.status", "current_set.get", "current_set.get().map", "current_set.get().map().unwrap_or", "current_set.insert", "current_set.into_values", "current_set.into_values().collect", "current_set.remove", "current_set.remove().is_some", "entry.split", "entry.split().last", "entry.split().last().unwrap_or", "forced_prefix.unwrap_or", "format_atom().green", "format_atom().green().bold", "format_atom().green().bold().to_string", "found.append", "found.push", "found_names.contains", "found_names.insert", "get_pkg_repo().unwrap_or_default", "info.name", "info.name.clone", "infos.is_empty", "installed.into_iter", "installed.into_iter().filter", "installed.into_iter().filter().collect", "installed.is_empty", "installed_infos.extend", "installed_infos.is_empty", "installed_infos.iter", "installed_infos.iter().filter", "installed_infos.iter().filter().map", "installed_infos.iter().filter().map().collect", "l.is_empty", "l.trim", "l.trim().is_empty", "l.trim().split", "l.trim().split().last", "l.trim().split().last().unwrap_or", "l.trim().split().last().unwrap_or().to_string", "l.trim().to_string", "line.split", "line.split().nth", "line.splitn", "line.splitn().nth", "line.starts_with", "line.trim", "line.trim().to_string", "makepkg_args.push", "meta.file_type", "meta.file_type().is_symlink", "missing.is_empty", "missing.push", "n.to_str", "name.clone", "name.contains", "name.splitn", "o.status", "o.status.success", "o.stdout", "off_args.extend", "off_args.push", "official_infos.clone", "official_infos.is_empty", "official_infos.iter", "official_infos.iter().map", "official_infos.iter().map().collect", "official_names.is_empty", "orphans.is_empty", "orphans_str.lines", "orphans_str.lines().map", "orphans_str.lines().map().filter", "orphans_str.lines().map().filter().collect", "out.status", "out.status.success", "out.stdout", "output.status", "output.status.success", "output.stdout", "p.name", "p.name.clone", "p.next", "p.next().unwrap_or", "p.next().unwrap_or().to_string", "p.repo", "p.repo.is_empty", "p.split", "p.split().last", "p.split().last().unwrap_or", "p.split().last().unwrap_or().to_string", "p.status", "packages.iter", "packages.iter().filter", "packages.iter().filter().cloned", "packages.iter().filter().cloned().collect", "pacman_args.push", "parts.next", "parts.next().unwrap_or", "parts.next().unwrap_or().to_string", "pkg.chars", "pkg.chars().all", "pkg.clone", "pkg.contains", "pkg.split", "pkg.split().last", "pkg.split().last().unwrap_or", "pkg.split().last().unwrap_or().to_string", "pkg.starts_with", "pkg_dir.clone", "pkg_dir.exists", "pkg_dir.join", "pkg_dir.starts_with", "pkg_infos.is_empty", "pkg_infos.iter", "pkg_infos.iter().enumerate", "pkgs.iter", "pkgs.iter().enumerate", "pkgs.iter().filter", "pkgs.iter().filter().collect", "pkgs.iter().filter_map", "pkgs.iter().filter_map().collect", "pkgs.iter().map", "pkgs.iter().map().collect", "pkgs.len", "probe_official().is_some", "r.is_empty", "repo.is_empty", "result.push", "s.is_empty", "s.lines", "s.split_whitespace", "s.split_whitespace().nth", "s.split_whitespace().nth().unwrap_or", "s.split_whitespace().nth().unwrap_or().to_string", "s.success", "s.trim", "s.trim().to_string", "s_args.push", "sorted.sort", "status.cyan", "status.cyan().bold", "status.cyan().bold().to_string", "status.green", "status.green().bold", "status.green().bold().to_string", "status.red", "status.red().bold", "status.red().bold().to_string", "status.yellow", "status.yellow().bold", "status.yellow().bold().to_string", "stdout.lines", "stdout.lines().filter", "stdout.lines().filter().map", "stdout.lines().filter().map().collect", "target_pkgs.is_empty", "text.lines", "to_remove.is_empty", "total.to_string", "total.to_string().green", "total.to_string().green().bold", "total.to_string().green().bold().to_string", "total.to_string().yellow", "total.to_string().yellow().bold", "total.to_string().yellow().bold().to_string", "trimmed.is_empty", "trimmed.split", "trimmed.split().last", "trimmed.split().last().unwrap_or", "trimmed.split().last().unwrap_or().to_string", "trunk_dir.exists", "updated.push", "updated.sort", "v.trim", "v.trim().to_string", "val.trim", "val.trim().to_string", "world_bare.contains" ], "tgt": [ "Some", "abs_get_version", "abs_install", "add_to_world_set", "all_infos.extend", "args.extend_from_slice", "args.get", "args.get().map", "args.get().map().unwrap_or", "args.get().or_else", "args.get().or_else().map", "args.get().or_else().map().unwrap_or", "args.push", "aur_args.extend", "aur_infos.clone", "aur_names.is_empty", "aura_args.push", "bare.contains", "bare.to_string", "bare_of", "base_args.push", "build_base.exists", "build_base.join", "build_dir.join", "c.is_alphanumeric", "check_binaries", "child.stdin.take", "child.wait", "cli.packages.iter", "cli.packages.iter().any", "cli.packages.iter().filter", "cli.packages.iter().filter().cloned", "cmd.arg", "cmd.args", "cmd.status", "current_set.get", "current_set.get().map", "current_set.get().map().unwrap_or", "current_set.insert", "current_set.into_values", "current_set.into_values().collect", "current_set.remove", "current_set.remove().is_some", "entry.split", "entry.split().last", "entry.split().last().unwrap_or", "first_repo", "forced_prefix.unwrap_or", "format_atom", "format_atom().green", "format_atom().green().bold", "format_atom().green().bold().to_string", "found.append", "found.push", "found_names.contains", "found_names.insert", "get_pkg_repo", "get_pkg_repo().unwrap_or_default", "info.name.clone", "infos.is_empty", "installed.into_iter", "installed.into_iter().filter", "installed.into_iter().filter().collect", "installed.is_empty", "installed_infos.extend", "installed_infos.is_empty", "installed_infos.iter", "installed_infos.iter().filter", "installed_infos.iter().filter().map", "installed_infos.iter().filter().map().collect", "is_safe_path", "l.is_empty", "l.trim", "l.trim().is_empty", "l.trim().split", "l.trim().split().last", "l.trim().split().last().unwrap_or", "l.trim().split().last().unwrap_or().to_string", "l.trim().to_string", "line.split", "line.split().nth", "line.splitn", "line.splitn().nth", "line.starts_with", "line.trim", "line.trim().to_string", "makepkg_args.push", "meta.file_type", "meta.file_type().is_symlink", "missing.is_empty", "missing.push", "n.to_str", "name.clone", "name.contains", "name.splitn", "o.status.success", "off_args.extend", "off_args.push", "official_infos.clone", "official_infos.is_empty", "official_infos.iter", "official_infos.iter().map", "official_infos.iter().map().collect", "official_names.is_empty", "orphans.is_empty", "orphans_str.lines", "orphans_str.lines().map", "orphans_str.lines().map().filter", "orphans_str.lines().map().filter().collect", "out.status.success", "output.status.success", "p.name.clone", "p.next", "p.next().unwrap_or", "p.next().unwrap_or().to_string", "p.repo.is_empty", "p.split", "p.split().last", "p.split().last().unwrap_or", "p.split().last().unwrap_or().to_string", "packages.iter", "packages.iter().filter", "packages.iter().filter().cloned", "packages.iter().filter().cloned().collect", "pacman_args.push", "pacman_c", "parts.next", "parts.next().unwrap_or", "parts.next().unwrap_or().to_string", "pkg.chars", "pkg.chars().all", "pkg.clone", "pkg.contains", "pkg.split", "pkg.split().last", "pkg.split().last().unwrap_or", "pkg.split().last().unwrap_or().to_string", "pkg.starts_with", "pkg_dir.clone", "pkg_dir.exists", "pkg_dir.join", "pkg_dir.starts_with", "pkg_infos.is_empty", "pkg_infos.iter", "pkg_infos.iter().enumerate", "pkg_status", "pkg_world_entry", "pkgs.iter", "pkgs.iter().enumerate", "pkgs.iter().filter", "pkgs.iter().filter().collect", "pkgs.iter().filter_map", "pkgs.iter().filter_map().collect", "pkgs.iter().map", "pkgs.iter().map().collect", "pkgs.len", "portageq_shim", "print_emerge_completed", "print_emerge_emerging", "print_emerge_plan", "print_help", "probe_official", "probe_official().is_some", "probe_official_split", "r.is_empty", "regen_world_set", "remove_from_world_set", "repo.is_empty", "resolve_aur", "result.push", "run_cmd", "s.is_empty", "s.lines", "s.split_whitespace", "s.split_whitespace().nth", "s.split_whitespace().nth().unwrap_or", "s.split_whitespace().nth().unwrap_or().to_string", "s.success", "s.trim", "s.trim().to_string", "s_args.push", "sorted.sort", "status.cyan", "status.cyan().bold", "status.cyan().bold().to_string", "status.green", "status.green().bold", "status.green().bold().to_string", "status.red", "status.red().bold", "status.red().bold().to_string", "status.yellow", "status.yellow().bold", "status.yellow().bold().to_string", "stdout.lines", "stdout.lines().filter", "stdout.lines().filter().map", "stdout.lines().filter().map().collect", "target_pkgs.is_empty", "text.lines", "to_remove.is_empty", "total.to_string", "total.to_string().green", "total.to_string().green().bold", "total.to_string().green().bold().to_string", "total.to_string().yellow", "total.to_string().yellow().bold", "total.to_string().yellow().bold().to_string", "trimmed.is_empty", "trimmed.split", "trimmed.split().last", "trimmed.split().last().unwrap_or", "trimmed.split().last().unwrap_or().to_string", "trunk_dir.exists", "updated.push", "updated.sort", "v.trim", "v.trim().to_string", "val.trim", "val.trim().to_string", "validate_packages", "validate_pkg", "world_bare.contains", "write_world_set" ], "metrics": { "ast": { "op.eq": 8.0, "op.lt": 1.0, "op.ne": 5.0, "op.add": 2.0, "op.lor": 7.0, "op.land": 10.0, "max_depth": 29.0, "bind_count": 18.0, "call_count": 618.0, "node_count": 16226.0, "member_count": 236.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "identifier_count": 334.0, "member_depth_max": 6.0, "string_literal_count": 424.0, "array_literal_max_length": 6.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 59294.0, "entropy": 4.73, "size_bytes": 59294.0 }, "text": { "digit_ratio": 0.0, "space_count": 16925.0, "total_lines": 1553.0, "char_entropy": 4.73, "unique_chars": 104.0, "lines_over_200": 9.0, "string_density": 0.27, "avg_line_length": 37.18, "high_byte_ratio": 0.04, "max_line_length": 227.0, "non_ascii_ratio": 0.04, "empty_line_ratio": 0.12, "last_line_length": 1.0, "long_token_count": 13.0, "whitespace_ratio": 0.31, "most_common_ratio": 0.05, "identifier_density": 1.7, "line_length_stddev": 31.05, "normalized_string_count": 10.76, "repeated_char_sequences": 573.0, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.05, "max_inline_whitespace_run": 31.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 31.51 }, "binds": { "count": 18.0 }, "calls": { "count": 618.0 }, "binary": { "overall_entropy": 4.73, "peak_region_bytes": 16384.0, "peak_region_entropy": 5.13 }, "source": { "class_count": 2.0, "function_count": 27.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 236.0 }, "strings": { "total": 424.0, "url_count": 1.0, "avg_length": 16.7, "max_length": 157.0, "path_count": 16.0, "avg_entropy": 2.43, "email_count": 1.0, "empty_count": 10.0, "sql_strings": 8.0, "total_bytes": 7082.0, "entropy_stddev": 1.36, "shell_command_strings": 1.0, "embedded_code_candidates": 1.0 }, "comments": { "chars": 10685.0, "lines": 174.0, "total": 167.0, "to_code_ratio": 0.13, "high_entropy_comments": 9.0 }, "functions": { "count": 29.0, "avg_params": 1.22, "max_params": 6.0, "length_stddev": 98.06, "over_100_lines": 2.0, "over_500_lines": 1.0, "avg_name_length": 13.59, "no_params_count": 4.0, "avg_length_lines": 46.63, "max_length_lines": 528.0, "min_length_lines": 6.0, "nested_functions": 1.0, "avg_nesting_depth": 0.07, "max_nesting_depth": 1.0, "high_entropy_names": 4.0, "single_char_params": 1.0, "avg_param_name_length": 5.39, "density_per_100_lines": 1.74, "code_in_functions_ratio": 0.81 }, "identifiers": { "count": 334.0, "total": 2638.0, "avg_length": 7.43, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.43, "reuse_ratio": 0.13, "unique_count": 334.0, "length_stddev": 4.05, "has_digit_ratio": 0.0, "sequential_names": 12.0, "single_char_count": 13.0, "single_char_ratio": 0.04, "high_entropy_count": 11.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 1.0 } } }, "id": 9, "mol": "H₃(CmOsPo₂)Md", "path": "v1.23.0!!aura-emerge-1.23.0/src/main.rs", "pid": 0, "risk": 5, "sha": "523f67490cdb81e60886bcd60dd953926109481b24f95881cad40c6bced467d4", "size": 59294, "traits": [ { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword", "spans": [ [ 59163, 4 ] ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string", "spans": [ [ 118304, 52 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repository", "spans": [ [ 4662, 10 ] ] }, { "id": "micro-behaviors/process/create/exec::rust-command-new-call", "atk": "T1059", "conf": 0.85, "crit": 1, "desc": "Rust Command::new call", "spans": [ [ 11736, 13 ] ] }, { "id": "objectives/discovery/host/fingerprint::version-field", "atk": "T1082", "conf": 0.9, "crit": 1, "desc": "WMI Version result field", "spans": [ [ 17135, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "spans": [ [ 34, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/loop::rust-while-loop", "conf": 0.75, "crit": 2, "desc": "Rust while loop", "spans": [ [ 51600, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::rust-spawn-call", "atk": "T1059", "mbc": "E1059", "conf": 0.8, "crit": 1, "desc": "Rust spawn() method call", "spans": [ [ 58097, 7 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 1480, 3 ] ] }, { "id": "micro-behaviors/os/env/access::std-env-var", "conf": 0.86, "crit": 3, "desc": "Rust environment variable lookup", "spans": [ [ 27295, 14 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "atk": "T1105", "conf": 0.82, "crit": 3, "desc": "Rust invokes curl or wget", "spans": [ [ 22997, 19 ] ] }, { "id": "objectives/command-and-control/remote-command/keywords::command-result-word", "conf": 0.4, "crit": 1, "desc": "Command/result vocabulary pair", "spans": [ [ 16467, 71 ] ] }, { "id": "micro-behaviors/process/create/direct::rust-async-process", "atk": "T1059", "mbc": "E1059", "conf": 0.92, "crit": 3, "desc": "Builds process via Command::new", "spans": [ [ 11736, 13 ] ] }, { "id": "micro-behaviors/fs/file/open::rust-file-open", "conf": 0.86, "crit": 2, "desc": "Rust file open call", "spans": [ [ 36227, 11 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 11487, 4 ] ] }, { "id": "metadata/file/format::box-drawing-banner", "conf": 0.9, "crit": 2, "desc": "Box drawing text banner", "spans": [ [ 521, 165 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "build.rs waits on command status", "spans": [ [ 22412, 9 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "atk": "T1195.002", "conf": 0.88, "crit": 1, "desc": "build.rs captures command output", "spans": [ [ 11916, 9 ] ] }, { "id": "metadata/file/format::vocab-date", "conf": 0.97, "crit": 1, "desc": "String literal contains date word", "spans": [ [ 54301, 4 ] ] }, { "id": "metadata/file/format::vocab-required", "conf": 0.97, "crit": 1, "desc": "String literal contains required word", "spans": [ [ 10652, 8 ] ] }, { "id": "metadata/file/profile/language::lang-russian", "conf": 0.8, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)", "spans": [ [ 17634, 14 ] ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.97, "crit": 1, "desc": "String literal contains invalid word", "spans": [ [ 10060, 7 ], [ 24344, 7 ] ] }, { "id": "micro-behaviors/process/create/exec::spawn-api-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "spawn API call", "spans": [ [ 58098, 6 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target-word component", "spans": [ [ 4662, 10 ], [ 11487, 4 ] ] }, { "id": "metadata/file/format::i18n-validation-vocab", "conf": 0.97, "crit": 1, "desc": "Form-validation vocabulary in dense non-ASCII file", "spans": [ [ 10060, 7 ], [ 10652, 8 ], [ 24344, 7 ], [ 54301, 4 ] ] } ], "type": "rust" }, { "id": 10, "mol": "Md", "sha": "df1972dd0970672eccfc212634e0623594ab1d3a90c06b868abbc2c18bc325ca", "path": "v1.23.0!!aura-emerge-1.23.0/repo-files/UA-README.MD", "risk": 1, "size": 8180, "type": "markdown", "depth": 3 }, { "ctx": [ { "b": "AbP/tuUKz0Byx04c[co=3lQEczxHJLw/@:HB8\u0026{Iz!0i(fjFTkfj/0iA+w@aflItRfkLMpvqEPax(kOyz/P@dxjV5\u0026Ef{s2z/Z2cB-p#lvpS{$diJ%AarUSwB97=6zGx]dy?%Db3jp-)wNxE?zeTPec[co=3lQEiz6gAxatm\u003eUAXzlEv{%gbvRGZkAbP=svp%d\u003e3vI", "ln": 0, "col": 1, "line": 1 } ], "depth": 3, "facts": { "imp": [ [ "", "ln" ], [ "", "post_install" ], [ "", "rm" ] ], "tgt": [ "ln", "post_install", "rm" ], "funcs": [ [ "post_install", 0 ], [ "post_upgrade", 75 ], [ "pre_remove", 110 ] ], "metrics": { "ast": { "max_depth": 5, "call_count": 3, "node_count": 36 }, "file": { "size": 158, "entropy": 4.52 }, "text": { "lines": 11, "top_char": 47, "max_ws_run": 1, "space_count": 14, "char_entropy": 4.52, "unique_chars": 28, "top_char_null": 0, "top_char_ratio": 0.08, "avg_line_length": 13.45, "max_line_length": 54, "empty_line_ratio": 0.18, "last_line_length": 1, "whitespace_ratio": 0.15, "identifier_density": 1.27, "line_length_stddev": 15.93, "normalized_unique_identifiers": 2.6 }, "binary": { "peak_region_bytes": 158, "peak_region_entropy": 4.52 }, "source": { "function_count": 3 }, "functions": { "count": 3, "density": 27.27, "avg_params": 1, "code_ratio": 0.82, "max_params": 1, "avg_name_length": 11.33, "avg_length_lines": 3, "max_length_lines": 3, "min_length_lines": 3, "avg_param_name_length": 5.33 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 14, "unique": 9, "avg_length": 9.67, "max_length": 23, "min_length": 2, "avg_entropy": 2.35, "reuse_ratio": 0.64, "length_stddev": 7.73, "high_entropy_count": 2, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.56 } } }, "id": 11, "mol": "Md₂(Bk)", "path": "v1.23.0!!aura-emerge-1.23.0/aura-emerge.install", "pid": 0, "risk": 2, "sha": "d63dff760e1f9e62567cf81cf46a7e1299c715445c31ea677f2e2692e928bb26", "size": 158, "traits": [ { "id": "metadata/build/package/maintainer-scripts::pacman-lifecycle-hook-fn", "conf": 0.9, "crit": 3, "desc": "Lifecycle-style shell function declaration", "spans": [ [ 0, 16 ], [ 74, 17 ], [ 109, 15 ] ] }, { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "metadata/build/package/maintainer-scripts::pacman-scriptlet-hook-fn", "conf": 0.9, "crit": 1, "desc": "Non-PKGBUILD lifecycle-style shell function", "spans": [ [ 0, 0 ] ] } ], "type": "shell" }, { "id": 12, "mol": "H(Cm)Md₂(BkPa)", "sha": "60d1535afa8836bca90945ab558460ec248ab202fb1ec45a7fd6e5579176427c", "path": "v1.23.0!!aura-emerge-1.23.0/PKGBUILD", "risk": 3, "size": 1214, "type": "shell", "depth": 3 }, { "id": 13, "sha": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986", "path": "v1.23.0!!aura-emerge-1.23.0/LICENSE", "risk": 1, "size": 35149, "type": "text", "depth": 3 }, { "id": 14, "sha": "7eb932c1d98dbc08e89c59c86b72a2b4e1394409650d83ab9a16a8486f9a270e", "path": "v1.23.0!!aura-emerge-1.23.0/Cargo.toml", "risk": 1, "size": 173, "type": "cargo.toml", "depth": 3 }, { "id": 15, "sha": "dd27df4d004f8f2c92b3fa43a25dee88f26a83c2b9c021171e21d42702953103", "path": "v1.23.0!!aura-emerge-1.23.0/Cargo.lock", "size": 7659, "type": "cargo.lock", "depth": 3 }, { "id": 16, "sha": "2116fe1191a50e7761f0c50a3cf2198d77b2b29e0644afad14ec9a58e2809f2f", "path": "v1.23.0!!aura-emerge-1.23.0/.SRCINFO", "size": 618, "type": "src_info", "depth": 3 }, { "id": 17, "sha": "dc27b5fd02af2b6c1605928ba9379298fff227096132b28c5936bd79033d2a2c", "path": "v1.23.0!!aura-emerge-1.23.0/README.MD", "size": 5830, "type": "markdown", "depth": 3 }, { "id": 18, "sha": "fd71e0c73ab66c9b143d80437e815141a519b467ec514ec3aa943e456e3f7653", "path": "anstream@1.0.0.registry.json", "size": 918, "type": "registry", "depth": 4 }, { "id": 19, "sha": "8478f3e62b5cbfa704241d5a3441897a1d1ec2e98756e211c8302082c06c6b58", "path": "anstyle@1.0.14.registry.json", "size": 821, "type": "registry", "depth": 4 }, { "id": 20, "sha": "282bcff666582ebffd4e06eeeca8a165ce73049b38cdd4f7bca4dcc43d0fa75d", "path": "anstyle-parse@1.0.0.registry.json", "size": 832, "type": "registry", "depth": 4 }, { "id": 21, "sha": "f914aac962bf12d47b1e3ea2592b6ccb821e5b47df782fc2a54b91f356472dec", "path": "anstyle-query@1.1.5.registry.json", "size": 844, "type": "registry", "depth": 4 }, { "id": 22, "sha": "7010dbbff29baafc31743cb608bf1d3a34eb9f05be6fb8aa2cea35d175c38b92", "path": "anstyle-wincon@3.0.11.registry.json", "size": 842, "type": "registry", "depth": 4 }, { "id": 23, "sha": "ed635db39a11bd8390dfe6ec6e3840c72946d370058e08d567bffe553dfbc10c", "path": "clap@4.6.1.registry.json", "size": 864, "type": "registry", "depth": 4 }, { "id": 24, "sha": "5898dd18f942112d30c9e72f4734607376f123e1307480925ac53c1d9f8e717c", "path": "clap_builder@4.6.0.registry.json", "size": 873, "type": "registry", "depth": 4 }, { "id": 25, "sha": "0dd9b39c54b657ccdc28ba963131ea9f057df41ebe24801d678f6fbbf5f5cfc7", "path": "clap_derive@4.6.1.registry.json", "size": 860, "type": "registry", "depth": 4 }, { "id": 26, "sha": "cf9fc3ba0386c81e93c07e53d911cf1badaa4739833efe927e73423ed5997d98", "path": "clap_lex@1.1.0.registry.json", "size": 832, "type": "registry", "depth": 4 }, { "id": 27, "sha": "6793e8864831812dc20b062d9192945a777996d2840164cd9f2865b219dd114d", "path": "colorchoice@1.0.5.registry.json", "size": 838, "type": "registry", "depth": 4 }, { "id": 28, "sha": "9478d4c6e16a2c62b84654ecae5d3676620e30f1ad3e3919fd6980dfcbe82103", "path": "colored@2.2.0.registry.json", "size": 868, "type": "registry", "depth": 4 }, { "id": 29, "sha": "5e882fe8a00dbf56819d96616fb952f67fd771676bfa81aed6a2e406b35b449b", "path": "heck@0.5.0.registry.json", "size": 831, "type": "registry", "depth": 4 }, { "id": 30, "sha": "2f6b8fb007ddeb71e4b1bd1d75b54bec02f2c252253e41a9827ecc4ba3922b09", "path": "is_terminal_polyfill@1.70.2.registry.json", "size": 895, "type": "registry", "depth": 4 }, { "id": 31, "sha": "897ecdf9aa91b38151aceae9b09ebd1544de38fc4c9a375422a7d885b7726ed1", "path": "lazy_static@1.5.0.registry.json", "size": 873, "type": "registry", "depth": 4 }, { "id": 32, "sha": "581c1f806373db4059f7015f026cd0085a853862a3d9163f72c738b2081cb514", "path": "once_cell_polyfill@1.70.2.registry.json", "size": 887, "type": "registry", "depth": 4 }, { "id": 33, "sha": "aa74b29b9816f416fdd500c7d7a49a3a7991042814b6cadd4c0ef8d7df3a9f4f", "path": "proc-macro2@1.0.106.registry.json", "size": 942, "type": "registry", "depth": 4 }, { "id": 34, "sha": "e91903d3d469eddf8073a38ebb5b1b3b63fb8d249dcfbf09771c1aa026cf8de5", "path": "quote@1.0.45.registry.json", "size": 827, "type": "registry", "depth": 4 }, { "id": 35, "sha": "766b0af2f16669f75baff26286941a4fcfec9bfa2f9f4a270cd0b8273ea1ca11", "path": "strsim@0.11.1.registry.json", "size": 969, "type": "registry", "depth": 4 }, { "id": 36, "sha": "124b0d77952d2f78266fb465ea168ac3f937fc1dc94e598322ac68412f0934bb", "path": "syn@2.0.117.registry.json", "size": 821, "type": "registry", "depth": 4 }, { "id": 37, "sha": "63dfc4f0d386c3101966521d80cff45db48653d1d84f9c51288d5095d8c5e284", "path": "unicode-ident@1.0.24.registry.json", "size": 944, "type": "registry", "depth": 4 }, { "id": 38, "sha": "a2e307a4b3ff8f11edd25620834488a212e36f86bfdcc21e9ca620e1a386d644", "path": "utf8parse@0.2.2.registry.json", "size": 822, "type": "registry", "depth": 4 }, { "id": 39, "sha": "85dce2ef17d3e90c136b3347e313cf90052de29853a67e192ea66e8305424e2c", "path": "windows-link@0.2.1.registry.json", "size": 826, "type": "registry", "depth": 4 }, { "id": 40, "sha": "894e50140334438cef33205b46d44155841474aeb78253ecfd0ffe91726ea789", "path": "windows-sys@0.59.0.registry.json", "size": 825, "type": "registry", "depth": 4 }, { "id": 41, "sha": "c9761f22fda3b6fb5e7b9363503db64d7060dd10170a10b87161b523c2e8be73", "path": "windows-sys@0.61.2.registry.json", "size": 825, "type": "registry", "depth": 4 }, { "id": 42, "sha": "57d702ad217c4053493bd342315dedfad2e025e3cb5ed93a09619c3f6a196a53", "path": "windows-targets@0.52.6.registry.json", "size": 835, "type": "registry", "depth": 4 }, { "id": 43, "sha": "54f1ed8609754a7dd4030fe34d8d09f859c62b97e13372445fd6b33883201ac3", "path": "windows_aarch64_gnullvm@0.52.6.registry.json", "size": 842, "type": "registry", "depth": 4 }, { "id": 44, "sha": "2ee3fd1e107884c4f31cc3e77c14e6d2edc242f0780677f6a89825607645ec37", "path": "windows_aarch64_msvc@0.52.6.registry.json", "size": 839, "type": "registry", "depth": 4 }, { "id": 45, "sha": "1634b851762b78465cecc262fc7a32a51ee0ae398903e2ede07e5dfad6da2db4", "path": "windows_i686_gnu@0.52.6.registry.json", "size": 835, "type": "registry", "depth": 4 }, { "id": 46, "sha": "aaa2589ec53a845b4360141f03c6f7f9c3aa890d7b904215da5cb44f37820864", "path": "windows_i686_gnullvm@0.52.6.registry.json", "size": 839, "type": "registry", "depth": 4 }, { "id": 47, "sha": "27d63f1d9075ceff80f1e5d7d4885d61aaec78a536f55623af4272dff472fa72", "path": "windows_i686_msvc@0.52.6.registry.json", "size": 836, "type": "registry", "depth": 4 }, { "id": 48, "sha": "b28a0f4d4feb6383a0e261a0e38c1c1b38cea5b26a036a3bebb78401352cc628", "path": "windows_x86_64_gnu@0.52.6.registry.json", "size": 837, "type": "registry", "depth": 4 }, { "id": 49, "sha": "0ffd79cbd52361b318c283178f2189534d715817eff7b1fcbe4fbb10dd47ae35", "path": "windows_x86_64_gnullvm@0.52.6.registry.json", "size": 841, "type": "registry", "depth": 4 }, { "id": 50, "sha": "8b37cecbe723cd339b81522a70e75a9c68ba14c02bf593807636d1ab11678fd4", "path": "windows_x86_64_msvc@0.52.6.registry.json", "size": 838, "type": "registry", "depth": 4 }, { "ctx": [ { "b": "abZy80000000zN(yMEk\u0026DoLYXu+#2Pi0)f%OF/-xK#t+1-0LkgJU9T4d1Ym4T3\u003c3SdKsc2RS-J#]a0jK{m!@5:prJR3bXp-gv[?z{J-wOSG3]A=0]iwY)v3S*wgejR@5u1jKr4{y\u003ck{sP.]E8lp^{WMsXZ{R4Sb\u003cIV", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "depth": 4, "facts": { "metrics": { "file": { "size": 28162716.0, "entropy": 8.0, "size_bytes": 28162716.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 28162048.0, "peak_region_entropy": 7.87 } } }, "id": 51, "mol": "O(S)H₆(Cm₄F₂MgOsPo₄U)Md₄(BiBkPa)", "path": "main", "risk": 19, "sha": "6545f64c138592e8cf088227ed6bb6b7836c2d777d81228dcb803a190e2169a2", "size": 28162716, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "from": [ { "file": 1 } ], "spans": [ [ 34, 4 ], [ 196, 3 ] ] }, { "id": "metadata/file/format::vocab-required", "conf": 0.97, "crit": 1, "desc": "String literal contains required word", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "atk": "T1105", "conf": 0.82, "crit": 3, "desc": "Rust invokes curl or wget", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "conf": 0.8, "crit": 2, "desc": "Low ratio of sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.3, "crit": 2, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::imports-tls-get-addr", "conf": 1.0, "crit": 2, "desc": "Imports __tls_get_addr from the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmsg socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extension::tar-gz", "conf": 0.4, "crit": 1, "desc": "Tar.gz archive filename reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/url/external/github::github-archive-ref-download", "atk": "T1105", "conf": 0.84, "crit": 3, "desc": "GitHub archive refs download URL", "from": [ { "file": 5 } ] }, { "id": "metadata/package/manifest/name::cargo-package-name", "conf": 0.85, "crit": 2, "desc": "Cargo package has name" }, { "id": "metadata/file/format::i18n-validation-vocab", "conf": 0.97, "crit": 1, "desc": "Form-validation vocabulary in dense non-ASCII file", "from": [ { "off": 10060, "file": 2, "line": 266 } ] }, { "id": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "atk": "T1106", "conf": 0.88, "crit": 3, "desc": "Child process stdio pipe redirect", "from": [ { "off": 4839, "file": 1 } ] }, { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword" }, { "id": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "crit": 2, "desc": "Iterate shared object list", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-25", "conf": 1.0, "crit": 1, "desc": "Binary has 25+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.66, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-russian", "conf": 0.8, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)", "from": [ { "file": 2 } ], "spans": [ [ 38, 16 ] ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.97, "crit": 1, "desc": "String literal contains invalid word", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 2, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/identity::pkgbuild-basename", "conf": 1.0, "crit": 2, "desc": "Arch PKGBUILD package recipe basename", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/control-flow/loop::rust-while-loop", "conf": 0.75, "crit": 2, "desc": "Rust while loop", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.3, "crit": 2, "desc": "Delete files by fd/path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 1 } ] }, { "id": "well-known/malware/botnet/mozi::xor-pattern-2", "conf": 1.0, "crit": 1, "desc": "XOR loop pattern variant 2", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/delete::rm-f", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 1, "desc": "rm -f shell command (force, non-recursive)", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/size::large-file-1mb", "conf": 1.0, "crit": 2, "desc": "File larger than 1MB", "from": [ { "file": 1 } ] }, { "id": "objectives/privilege-escalation/exploit/kernel::suid-binary-target", "atk": "T1068", "mbc": "E1068", "conf": 0.85, "crit": 1, "desc": "Targets a setuid system binary", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::pipe-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "POSIX pipe creation symbol", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::peak-region-cipher-entropy", "conf": 0.85, "crit": 1, "desc": "Peak 1KB region at cipher entropy", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::documented-cli-binary", "conf": 0.85, "crit": 1, "desc": "Documented command line program", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-core", "conf": 0.66, "crit": 2, "desc": "Core directory iteration symbols", "from": [ { "off": 5569, "file": 1 } ] }, { "id": "metadata/build/package::pacman-lifecycle-hook-fn", "conf": 0.9, "crit": 2, "desc": "Pacman lifecycle hook function declaration", "from": [ { "file": 4 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "atk": "T1195.002", "conf": 0.88, "crit": 1, "desc": "build.rs captures command output", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/link/symlink::symlink-resolve", "conf": 0.66, "crit": 2, "desc": "Resolve symbolic links to canonical", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.9, "crit": 1, "desc": "Binary high overall entropy (packed/encrypted)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/structural::many-strings-large-elf", "conf": 0.9, "crit": 2, "desc": "Large ELF with 500+ strings", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "atk": "T1056.002", "conf": 0.6, "crit": 3, "desc": "References real sudo binary path to wrap", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/capture/sudo-pty::execvp-symbol", "atk": "T1056.002", "conf": 0.6, "crit": 1, "desc": "execvp child-exec symbol", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repo", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/compiled::unwind-resume-symbol", "crit": 1, "desc": "_Unwind_Resume exception-unwinding symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/memory/mmap::munmap", "conf": 0.66, "crit": 2, "desc": "Unmap files from memory", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 1 } ], "spans": [ [ 1480, 3 ] ] }, { "id": "micro-behaviors/os/sysinfo/config::sysconf", "atk": "T1082", "mbc": "E1082", "conf": 0.4, "crit": 2, "desc": "Query system configuration information", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/config/system::config-etc", "conf": 0.66, "crit": 2, "desc": "Reference to /etc configuration files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/identity/query::getpid", "conf": 0.3, "crit": 2, "desc": "Get process ID", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string" }, { "id": "micro-behaviors/process/terminate/signal::_exit", "conf": 0.4, "crit": 2, "desc": "Terminates process immediately without cleanup", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "conf": 0.86, "crit": 1, "desc": "Interleaved wget command token", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "conf": 0.66, "crit": 3, "desc": "Uses readdir64", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiler/systems::rust-binary", "conf": 0.95, "crit": 2, "desc": "Rust-compiled binary", "from": [ { "off": 137915, "file": 1 } ] }, { "id": "micro-behaviors/fs/search::grep-keyword", "conf": 0.7, "crit": 1, "desc": "grep command keyword", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/linking/static::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendmsg socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "conf": 0.66, "crit": 2, "desc": "Read own executable path (/proc/self/exe)", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/remote-command/keywords::command-result-word", "conf": 0.4, "crit": 1, "desc": "Command/result vocabulary pair", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "atk": "T1106", "conf": 0.82, "crit": 3, "desc": "POSIX spawn attribute control", "from": [ { "file": 1 } ] }, { "id": "metadata/unsigned", "conf": 1.0, "crit": 2, "desc": "Binary is not digitally signed" }, { "id": "metadata/file/catalog/identity::platform-domain", "conf": 0.9, "crit": 1, "desc": "GitHub or Google platform domain", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "conf": 0.7, "crit": 1, "desc": "ELF symbol tables stripped from binary", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.3, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "from": [ { "off": 94275, "file": 1 } ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "crit": 2, "desc": "Duplicate file descriptor (I/O redirection)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::rust-async-process", "atk": "T1059", "mbc": "E1059", "conf": 0.92, "crit": 3, "desc": "Builds process via Command::new", "from": [ { "file": 2 } ] }, { "id": "metadata/build/package::pkgbuild-remote-archive-source", "conf": 0.6, "crit": 2, "desc": "PKGBUILD fetches a remote source archive" }, { "id": "objectives/supply-chain/install-hook/distro-scriptlet::pacman-scriptlet-hook", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "pacman install scriptlet hook function", "from": [ { "file": 4 } ] }, { "id": "metadata/file/format::box-drawing-banner", "conf": 0.9, "crit": 2, "desc": "Box drawing text banner", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repository", "from": [ { "file": 2 } ] }, { "id": "metadata/file/metrics::concealed-payload-mass-1k", "conf": 0.8, "crit": 1, "desc": "High-entropy region mass over 1KB", "from": [ { "file": 5 } ] }, { "id": "metadata/build/package::pkgbuild-pkgver-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a pkgver() function", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/structural::sentence-strings-20-plus", "conf": 0.9, "crit": 2, "desc": "Binary has 20+ sentence strings", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-conventional-version", "conf": 0.85, "crit": 2, "desc": "Cargo package uses conventional version" }, { "id": "metadata/hardening/missing::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/mem/protect/modify::mprotect-import", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "Imports mprotect memory protection", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "atk": "T1106", "conf": 0.86, "crit": 3, "desc": "POSIX spawn file actions", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::concealed-payload-mass-8k", "conf": 0.85, "crit": 1, "desc": "High-entropy region mass over 8KB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.66, "crit": 2, "desc": "Write files", "from": [ { "off": 4745, "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extension::tar-gz-or-zip-text", "conf": 0.9, "crit": 1, "desc": "Tar.gz or zip archive extension in text", "from": [ { "file": 5 } ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "from": [ { "file": 4 } ], "spans": [ [ 0, 24 ] ] }, { "id": "micro-behaviors/fs/file/open::rust-file-open", "conf": 0.86, "crit": 2, "desc": "Rust file open call", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/anomaly/format::elf-relacount-present", "conf": 0.95, "crit": 2, "desc": "ELF declares DT_RELACOUNT", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/binary::binary-usr-local", "conf": 0.66, "crit": 2, "desc": "Reference to /usr/local binaries", "from": [ { "file": 4 } ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "GPL license reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-date", "conf": 0.97, "crit": 1, "desc": "String literal contains date word", "from": [ { "file": 2 } ] }, { "id": "metadata/package/quality/integrity::pkgbuild-unverified-remote-source", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "PKGBUILD fetches a remote archive with no integrity check", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/compiler/systems::rust-src-path", "conf": 0.85, "crit": 2, "desc": "Rust source file path (.rs)", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "conf": 0.4, "crit": 1, "desc": "SIGHUP signal ignore pattern (x86_64)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/write/copy::coreutils-install-file", "conf": 0.7, "crit": 2, "desc": "coreutils install stages a file", "from": [ { "file": 5 } ] }, { "id": "metadata/file/profile/identity::install-doc-basename", "conf": 0.85, "crit": 1, "desc": "Installation documentation basename", "from": [ { "file": 10 } ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::open64", "conf": 0.66, "crit": 2, "desc": "Open files (legacy 64-bit)", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-build-fn", "conf": 0.9, "crit": 1, "desc": "PKGBUILD defines a build() function", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::getrandom", "conf": 0.8, "crit": 2, "desc": "getrandom syscall", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "atk": "T1082", "mbc": "E1082", "conf": 0.3, "crit": 2, "desc": "x86_64 architecture string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::dev-random", "conf": 0.7, "crit": 2, "desc": "/dev/random access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::rust-spawn-call", "atk": "T1059", "mbc": "E1059", "conf": 0.8, "crit": 1, "desc": "Rust spawn() method call", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "build.rs waits on command status", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "conf": 0.76, "crit": 1, "desc": "Go allocation symbol bytes", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/setsid::symbol-text", "mbc": "F0003", "conf": 0.75, "crit": 3, "desc": "setsid symbol text", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-30", "conf": 1.0, "crit": 1, "desc": "Binary has 30+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/memory/mmap::mmap64-fn", "conf": 0.66, "crit": 2, "desc": "Maps files or devices into memory", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.66, "crit": 2, "desc": "Process forking", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setuid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setuid)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fd/dup::dup", "crit": 2, "desc": "Duplicate file descriptor", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-package-version", "conf": 0.85, "crit": 2, "desc": "Cargo package has version" }, { "id": "metadata/build/package::pacman-scriptlet-hook-fn", "conf": 0.9, "crit": 1, "desc": "Pacman install scriptlet hook function", "from": [ { "file": 4 } ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6, "crit": 2, "desc": "Several local variable assignments", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/message::https-prefix", "conf": 0.9, "crit": 2, "desc": "HTTPS protocol prefix", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/compiled::gimli-crate", "conf": 0.9, "crit": 2, "desc": "Rust gimli crate (DWARF parsing)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::getauxval-ref", "conf": 0.3, "crit": 2, "desc": "getauxval function reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/control/wait::waitpid", "conf": 0.66, "crit": 2, "desc": "Wait for child process state", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 BIND request opcode", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-base", "conf": 0.66, "crit": 2, "desc": "Create directories", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::abort", "conf": 0.9, "crit": 2, "desc": "Abort program execution", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::glibc-ref", "conf": 0.3, "crit": 2, "desc": "glibc reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.9, "crit": 1, "desc": "SOCKS5 client greeting bytes", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::interpreter", "conf": 1.0, "crit": 2, "desc": "ELF program interpreter metadata" }, { "id": "micro-behaviors/process/create/setsid::import", "mbc": "F0003", "conf": 1.0, "crit": 1, "desc": "setsid() function import", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/host/fingerprint::version-field", "atk": "T1082", "conf": 0.9, "crit": 1, "desc": "WMI Version result field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 2, "desc": "Read symbolic link target path", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiler/systems::expect-failed", "conf": 0.85, "crit": 2, "desc": "Rust expect failure message", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-40", "conf": 1.0, "crit": 1, "desc": "Binary has 40+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiler/systems::unwrap-failed", "conf": 0.85, "crit": 2, "desc": "Rust unwrap failure message", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-license-field", "conf": 0.85, "crit": 2, "desc": "Cargo package declares license" }, { "id": "metadata/binary/metrics/threshold::many-sections-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ sections (installer/packer)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::std-env-var", "conf": 0.86, "crit": 3, "desc": "Rust environment variable lookup", "from": [ { "file": 2 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.7, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 5 } ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.9, "crit": 2, "desc": "Script overall entropy stays low", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/keywords::payload", "conf": 0.6, "crit": 1, "desc": "payload keyword", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/tty/terminal::isatty", "crit": 2, "desc": "Detect if running in terminal (isatty)", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/exec::rust-command-new-call", "atk": "T1059", "conf": 0.85, "crit": 1, "desc": "Rust Command::new call", "from": [ { "file": 2 } ] }, { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.95, "crit": 1, "desc": "Cloud marketplace cleanup path", "from": [ { "file": 4 } ], "spans": [ [ 0, 8 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::native-environ-reference", "conf": 0.75, "crit": 2, "desc": "Direct environ[] global access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "conf": 0.95, "crit": 2, "desc": "Joystick, gamepad, or DirectInput keyword", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6, "crit": 3, "desc": "ELF debug stripped with .symtab", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-legacy64", "conf": 0.8, "crit": 3, "desc": "Read file status and metadata (legacy 64-bit)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawnp-import", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn PATH execution", "from": [ { "file": 1 } ] }, { "id": "metadata/package/manifest/name::cargo-package-quality-metadata", "conf": 0.88, "crit": 2, "desc": "Cargo package has quality metadata", "from": [ { "file": 7 } ] }, { "id": "objectives/persistence/system/daemon/init::daemonize-self-reexec", "atk": "T1543", "mbc": "F0006", "crit": 2, "desc": "Daemonizes via self-exe re-exec + fork/setsid", "from": [ { "off": 130972, "file": 1 } ] }, { "id": "micro-behaviors/process/control/wait::waitid", "conf": 0.66, "crit": 2, "desc": "Wait for process state changes", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::sigaction", "conf": 0.9, "crit": 2, "desc": "Install signal handler (POSIX sigaction)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setgid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setgid)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::needed-lib", "conf": 1.0, "crit": 2, "desc": "ELF needed library metadata" }, { "id": "micro-behaviors/fs/file/handle::fcntl", "atk": "T1083", "mbc": "E1083", "conf": 0.4, "crit": 2, "desc": "File descriptor manipulation and control", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 UDP ASSOCIATE request opcode", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "conf": 0.66, "crit": 3, "desc": "Uses fdopendir", "from": [ { "file": 1 } ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "from": [ { "file": 3 } ], "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/crypto/library/provider::openssl-static-keys", "conf": 0.8, "crit": 2, "desc": "OpenSSL/BoringSSL static key markers", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/vars/access::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::urandom", "conf": 1.0, "crit": 2, "desc": "Access /dev/urandom", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target-word component", "from": [ { "off": 11487, "file": 2, "line": 304 } ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/compiler/systems::rustc-path", "conf": 0.95, "crit": 2, "desc": "Rust compiler path in binary", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-2000", "conf": 0.9, "crit": 1, "desc": "High plaintext string count", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/exec::spawn-api-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "spawn API call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "conf": 0.3, "crit": 2, "desc": "chdir syscall symbol", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn with FD actions", "from": [ { "off": 4931, "file": 1 } ] }, { "id": "micro-behaviors/fs/path/system::system-lib64", "conf": 0.66, "crit": 2, "desc": "Reference to /lib64", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::rust-backtrace-symbolizer", "conf": 0.95, "crit": 2, "desc": "Rust std backtrace symbolizer stack", "from": [ { "off": 84035, "file": 1 } ] }, { "id": "micro-behaviors/fs/path/binary::usr-local-bin-dir", "conf": 0.66, "crit": 2, "desc": "Reference to /usr/local/bin", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "conf": 0.86, "crit": 1, "desc": "Interleaved tftp command token", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::file-under-12-lines", "conf": 0.8, "crit": 1, "desc": "Very short file (under 12 lines)", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::large-binary-500k", "conf": 1.0, "crit": 1, "desc": "Binary is 500KB+", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "conf": 0.4, "crit": 2, "desc": "/proc fs path in native binary", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.7, "crit": 2, "desc": "Short -h help flag", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/metrics::import-count-under-80", "conf": 0.84, "crit": 2, "desc": "Large binary with few DLL dependencies", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/compiled::addr2line-crate", "conf": 0.9, "crit": 2, "desc": "Rust addr2line backtrace symbolizer crate", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-version-string", "conf": 0.8, "crit": 2, "desc": "libc version string pattern", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/signal/handler::signal", "conf": 0.9, "crit": 2, "desc": "Install signal handler", "from": [ { "file": 1 } ] } ], "type": "gz" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91Ak.[V00000kMy=:00000[r:{\u003c0000000000kMA+z3\u0026\u0026J)ble\u003e!1][S61onA4kMy=:00000kMy=:00000kMy=:00000PAk8[00000PAk8[000002MK\u00268000000@@r31onA4?#S(U00000?#S(U00000?#S(U000008#]%s000008#]%s000000rr9", "n": [ { "c": 3, "d": "Shared library binds dynamic loader", "i": "metadata/binary/linking/runtime::library-loader-dep", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000001onA41onA4}#M\u0026#00000}#M\u0026#00000}#M\u0026#00000l\u0026Wh!00000l\u0026Wh!000001onA400000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B1onA45c8Xg0rr91m]04:000001][S60rr91000001onA46Awak0@@r3m]04:mUF[g?0\u003c^w+0eyn+o38zw:lTL0000000000000000000000000000000rr915=.[i000000000000000000006951jaohxw0000", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 736, "z": 27, "cf": 0.66 } ], "ln": 640 }, { "b": "uUsj]zEmEbvrcD%uJsC8r83.gwPzu{x(!xcA-t+2y\u0026si5raflLwDl7er83.uwOkZ#By/F(o*--nzE(^QvR/PQuTEq/vp9RXzEEu}DsW7[wO\u003e{@C(Rq-zeYFZrC)1{zE^9LwPJ0hwDljRz/YE\u0026zdNN3z*2W(zdNN9wPN]?wO\u003e{]z#:P[vruQp0af8Py\u0026-@@wPRo/wmPYXwnCQ!By/G3By!/#xK(b-zfo-kvq(i/D2)F7y?%8\u003cBzbYavpS.NBAzLgwmY?7A=lj6A+eV\u00260af8AA=M5ouU\u003cT\u003cvruj4zuafWwnc5:uSy#/x(mD*m}D^lpYLctBAzkc0b(*/zz\u003crKz/xo9vrsy:0bVHZx(ThXrC)1{zE^9AwPQ).CYV?{y^IMKwDl7qzG//jwm4\u0026rBvoLVvnZVMlsB}D0aPX.z/oZ$xjVf@zGV23BAhhezuaJZy\u00261310b#\u003c$x)s04wO\u003e\u003c(x\u003eIq-w].D]0chTVy\u00261310c-D$By+CZvqG:#v/QjYv@#I!AbPMe0chTXB]Vb:zGGW{CxdztwP!5]wN/[2B7UF=wPR)9wb{WZzE^Q9x8()+wm/vVB8UMizG2O%z!0M]Bz$V5ASxY\u0026A++U]z/YSquVQf{CwZ=1x(4u/vpKy[z/fS6vpS[UxK\u003e*$uV6/.AbP/iCWCJhvrVP@w[=6)uTWC^x(v)guTWFQv}Yy!ASy5%B7](aB8UMizEETeA:JJ#x(\u003ct]z/YSquVQf{CwZ=1x(4u/vpKy[z/fS6x(mTb0b#\u003c$x)s0aAa9%duUj1*wNw\u003eQBzkVhB6\u0026u^wmP?4g5#oiB7](aB8UMizEETeA:J)0Bz$(kz/{10AbP/iCWCJhvrVP$BAzLgB7GD9y**%$0b#\u003c$x)s0aAa9%duUj1*wNw\u003eQBzkVhB6\u0026D?B98CvC(R/4B7](aB8UMizEETeA:Ju*B98CvC(R]1xjU}0BA}}sBo3w@xjksYB7GB[AbP/iCWCJhvrVP$BAzLgB7GDmx\u003eH%/w)]*#Bo2(\u0026C4\u003e#nzuaS]B7](aB8UMizG2O.wQ4{h0aZj\u003eg5#xbBz2SjB-qy4B7GDax\u003edi+wPS6ewb{WZBz$(bwb{WZBAqeb0cq\u003c!zEEtYwQ4=@C5NC2x\u003eg*^uUr}(Aa@?.Cvticx\u003edi+D2)FlzE@(/x(ESs0a{p]vrsy:0ae-zCwg@9uQwghyJKP9v}tT:vqf?5x\u003ediOx(W/@0bMZ/wOTgX0aZj\u003e0axtPA=.q2BzbYavpS.^wO+@UAcb=lwNPaRxjVf[BAzLgzG2O{BzbYavpS.NBAzLgxjVgaBywV{0cq\u003c!vpKy[z/bL]vrDT50b2\u003e+v%qC-B-82fzFGk*B97\u0026jhz+zPByxnHgYR9ix(\u003ct(zddxwgYRMcvqG)\u003eBz7U{wNPa=x(mX^B97\u0026jCMqw/BAg/cwn=q+uTEq/vpaa\u0026A+eV\u0026uTX4/CXInbx(d*90c03[A+eV\u0026uU:j#uT[a/vru5XAcb=lwNPaRyH}=#wmYN*By+C\u003eBzbYavpS.^wPS0jwN/B^x\u003e4cPwn=A#zE^E40chTVwmPy{hz+zRzFT38yHIq+xkR\u003c0xjVf(y?Wu*uV{13B7]Mg0b2\u003e+vrD*rvqC{+x\u003eH\u003c\u003cBAqLjv}#6-BzbYavpS.NBAzLgxjVf$BZYr3B7]@i0bVW}z//M2Bo2VPCYmq5B98ClA=M8suVDcRy\u0026sxawnc5:uSy#/x(mD*m}D^ovqY.2vp%dIAaJJ[w[+:yvrt]TuSy#/x(mD*m}D^lp!tLpzVBcAzG//jwm4\u0026rBw=W.x(v(/Byxii0ae-zCwg@9uSgJTm]xs]rC)1{zE^9MwPQHu0ae-zCwg@9uS7rDB7E^+v}xR3x(v\u003e?uSy$", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 5408, "z": 6, "cf": 0.92 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 4764, "z": 4, "cf": 0.66 }, { "c": 3, "d": "Uses recv socket call", "i": "micro-behaviors/communications/socket/receive::recv-symbol", "o": 4769, "z": 4, "cf": 0.66 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 4787, "z": 7, "cf": 0.66 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 4802, "z": 7, "cf": 0.66 }, { "c": 3, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 5683, "z": 8, "cf": 0.66 }, { "c": 3, "d": "Uses fdopendir", "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "o": 5559, "z": 9, "cf": 0.66 }, { "c": 3, "d": "Uses readdir64", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "o": 5569, "z": 9, "cf": 0.66 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::delete-comp", "o": 5579, "z": 8, "cf": 0.3 }, { "c": 3, "d": "Read file status and metadata (legacy 64-bit)", "i": "micro-behaviors/fs/file/stat::stat-legacy64", "o": 5273, "z": 7, "cf": 0.8 }, { "c": 3, "d": "Imports mprotect memory protection", "i": "micro-behaviors/mem/protect/modify::mprotect-import", "o": 5657, "z": 8, "cf": 0.9 }, { "c": 3, "d": "Child process stdio pipe redirect", "i": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "o": 4876, "z": 33, "cf": 0.88 }, { "c": 3, "d": "POSIX spawn attribute control", "i": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "o": 5124, "z": 29, "cf": 0.82 }, { "c": 3, "d": "POSIX spawn file actions", "i": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "o": 4931, "z": 29, "cf": 0.86 }, { "c": 3, "d": "POSIX spawn with FD actions", "i": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "o": 4839, "z": 36, "cf": 0.9 }, { "c": 3, "d": "POSIX spawn PATH execution", "i": "micro-behaviors/process/create/direct::posix-spawnp-import", "o": 5162, "z": 12, "cf": 0.9 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 5232, "z": 6, "cf": 0.8 }, { "c": 3, "d": "setsid symbol text", "i": "micro-behaviors/process/create/setsid::symbol-text", "o": 5218, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Set group ID (capability)", "i": "micro-behaviors/process/identity/setuid::setgid", "o": 5196, "z": 6, "cf": 0.6 }, { "c": 3, "d": "Set user ID (capability)", "i": "micro-behaviors/process/identity/setuid::setuid-dup", "o": 5203, "z": 6, "cf": 0.6 }, { "c": 2, "d": "IFUNC-related markers", "i": "metadata/binary/linking/runtime::ifunc-markers", "o": 5609, "z": 9, "cf": 0.4 }, { "c": 2, "d": "Imports __tls_get_addr from the dynamic loader", "i": "metadata/binary/linking/runtime::imports-tls-get-addr", "o": 4507, "z": 12, "cf": 1.0 }, { "c": 2, "d": "Iterate shared object list", "i": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "o": 4520, "z": 15, "cf": 0.5 }, { "c": 2, "d": "chdir syscall symbol", "i": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "o": 4594, "z": 5, "cf": 0.3 }, { "c": 2, "d": "Create directories", "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "o": 4637, "z": 5, "cf": 0.66 }, { "c": 2, "d": "File descriptor manipulation and control", "i": "micro-behaviors/fs/file/handle::fcntl", "o": 4774, "z": 5, "cf": 0.4 }, { "c": 2, "d": "Open files (legacy 64-bit)", "i": "micro-behaviors/fs/file/open::open64", "o": 4621, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4572, "z": 4, "cf": 0.8 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 4745, "z": 5, "cf": 0.66 }, { "c": 2, "d": "Read symbolic link target path", "i": "micro-behaviors/fs/link/symlink::readlink", "o": 5451, "z": 8, "cf": 0.8 }, { "c": 2, "d": "Resolve symbolic links to canonical", "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "o": 5442, "z": 8, "cf": 0.66 }, { "c": 2, "d": "Maps files or devices into memory", "i": "micro-behaviors/fs/memory/mmap::mmap64-fn", "o": 5435, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Unmap files from memory", "i": "micro-behaviors/fs/memory/mmap::munmap", "o": 4536, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Direct environ[] global access", "i": "micro-behaviors/os/env/access::native-environ-reference", "o": 5154, "z": 7, "cf": 0.75 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 4696, "z": 6, "cf": 0.4 }, { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 5466, "z": 9, "cf": 0.8 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 5325, "z": 5, "cf": 0.9 }, { "c": 2, "d": "Install signal handler (POSIX sigaction)", "i": "micro-behaviors/os/signal/handler::sigaction", "o": 5385, "z": 9, "cf": 0.9 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 5225, "z": 6, "cf": 0.9 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 5259, "z": 7, "cf": 0.4 }, { "c": 2, "d": "Wait for process state changes", "i": "micro-behaviors/process/control/wait::waitid", "o": 5252, "z": 6, "cf": 0.66 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 5299, "z": 7, "cf": 0.66 }, { "c": 2, "d": "Duplicate file descriptor", "i": "micro-behaviors/process/fd/dup::dup", "o": 5321, "z": 3, "cf": 0.5 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 5181, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 4834, "z": 4, "cf": 0.66 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 4795, "z": 6, "cf": 0.3 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 5176, "z": 4, "cf": 0.4 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 4498, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 5267, "z": 5, "cf": 0.85 }, { "c": 1, "d": "_Unwind_Resume exception-unwinding symbol", "i": "metadata/lang/compiled::unwind-resume-symbol", "o": 4456, "z": 13, "cf": 0.5 } ], "ln": 4360 }, { "b": "e]$}-f-TZhlTIS4fAsQglTIS4gxo{jlTIV5ga\u003elXy?Wu*e]$}-hullvnKt^Kga\u003esmh2{cunKt^Kga\u003eu.m[=GvlTIP3gCgG:m[=GvlTIP3gYQ3tnKt^Kga\u003eM!m[=GvlTIP3f/e(2oI4MruOTk*h2{cunKt^Kga\u003ept07PZOlpk9ne?]r=m[=GvlTIP3gbP54oI4MruOTk?h#(DxnKt^Kga\u003esx07PZOlpk9ne\u0026bfYm[=GvlTIP3gCO@2oI4MruOTk\u0026gxo{snKt^Kga\u003evt07PZOlpk9ne\u0026bG/yY", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 5944, "z": 5, "cf": 0.9 } ], "ln": 5848 }, { "b": "uU0.SB.tc0BzLVezc+uoekUUxCTnidAt%?D0000000000%nSc0%nSc02MK\u002682MK\u002682MK\u002682MK\u00268fFLssg=mfIi5%n\u003elQTvjvCv0J4PFOb)dPO\u003c\u00262m:3xM4]yCwhejePbczy?W=#eIeLaeIeLa0000000000zeS%5vrco%B7GDsvQ%4(0SSi20SSi20SSi200000001Yu001Yw0000000000v@Dm5wN/*@z/cXrwPIB80rAi40rAi40rAi40rAi4AEXpAAEXpAAEXpAAEXpA/w#GmD%TlB", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 79940, "z": 4, "cf": 0.8 } ], "ln": 79844 }, { "b": "(^EscUy/Zky.O6oarR^HarR^HarR^HarR^-n=]7)lJWt/lJWrtvflH*vflJelJWs+vflI+vflHMu\u0026{AdlJWt/lJWt/lJWr)vflIB6^dv4yH}E2xcp!{x(4u\u003eazbLjasB@acKG\u003c?g:3HAaARpdayYFcy?aV2vqfK?wftA9wGV8kayMyfx(!ufzF77*m]gszwQb*HA=(mX3igJ0k0y8\u003cvrcm1zF80MZ-%$oB0a)lB9RRsx(mYe\u0026^^moA+e\u003c9B7]J8aARJAA+eV\u00263im\u003cxaIX0+055wnB97[Bh90SIh-rxGwIE!9gbQ)xh.)j0w[2gUf/iA1ix5\u003cbh!s*OgDmoDfkLuiA::0lfjwWkz^$CwA:{+jz!%l3v@#B6zGvEuBAg@7fkUcpfj/3yA^ooTA@Vn5aIW%TtFHnB02ouZzeTDuayP85z!0i$x(v(iz!pcc4J]kaBy/Iow)]y\u0026wN(bFZYDLtZYjQsz//A7iV#iMaAg+0yHH\u003c!d03*WBz\u0026pvA=(nh3ih.)z/65swmYO0vpJ./fd{:yA+xqzA+e($B98CFflqezfkkrmwQ2?qA::63B1RfBeIPmxiB=UXv(v^NvL{24w?NUgvq]N.B.LV5wPxvVe\u0026CsoflqezflIwJy+Gypvrt\u003c[vq)\u0026tA@Vq\u0026eIj:rflhhRByM%YixeYKhzEa3f\u003eK\u0026Hh8E0CgbJDLvQS+3g?nK9h-th9wI^*Ki5SDzy?Wv0vrcSDvqG:#v\u003eR[zv\u003eR[BA+PA7e](1k0sDQytFHq3aoj6dz/65swmYO0vpJ./fd{:yA+xqzA+e($B98CFflqezfkkrmwQ2?qA::63B1RfBeIPmxiB=UXv(v^NvL{24w?NUgvq]N.B.LV5wPxvVe\u0026CsoflqezflIwJy+GBwvq])jA=RjlA=(CBv\u003ePY1i50oHf/AO$w))CLg+Z\u003czg?76avpI2Gwh=IchE[:Tg*@g1hzu!2x\u003c#9\u003eA^orVByW4CA:{+zD2\u003eSMz.C*yuVQ3$v}vrcz*2Y4e](1k0wqg6055wnB966CwPhYzxk8j0x!q1\u003egCQNsflqezflgSjwg}w2vSD46e](1k5mGT3wPz)bz/cX9y?mj2aIXKhA+Pf1Bylk6vqfK?wi7\u003cG2)}^$y?mj2iV#iA3lTw6xj#xFaIW#)0sw/cjIQ$Y05527zdLwhwO=D%v{%Eje[nsgxkYCzwOkZ#BAhTWB8\u003e+zx(mD)CRiGDvru74e[]kQf/.6Jv}EYghEXKMh8Ns8fjw:tBA}XleIO\u003eie?]goB8\u003e+zv@Dg4AXqxN055wnB97[Bh90SIh-rxGwIE!9gbQ)xh.)j0w[2gUf/iA1ix5\u003cbh!s*OgDmoDfkLuiA::0lfjO{vwInaBv\u003eR[tx\u003e7ZczdNM]xMt.CA@Zo4v\u003eRXcx(kLzA@-#RaIYfzAa9l(vp%d)ayPq4aAIvcBy!#9w]zYjA+f9aC42ht3igVQz/^aoze:r5zdNQbwN)?AZZ}Saz/^agaxix7wKyxLz/L?hxM4:0fjXTgBywV/Bt2m!B-RUEA4=rKz!@]%vqfR2flqkzvR/QcCSmP*hz^1dzFKcdCwY0Gx(n6reOw%zfkLuiflhhRBzLV2flqezflhhRBt4DAvSC)$C}TkXwg@1Av\u003eR[GzEUtrzEWlgA=Ri*ayMylx(dN2vr9Ha2{r/7x(!xqiV[zQA=(CBv\u003ePY1i50oHf/AO$w))CLg+Z\u003czg?76avpI2Gwh:", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 82317, "z": 6, "cf": 0.5 }, { "c": 3, "d": "Recognized runtime ships fork+setsid", "i": "objectives/persistence/system/daemon/init::recognized-fork-setsid-marker", "o": 81314, "z": 47, "cf": 1.0 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 81189, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Rust std backtrace symbolizer stack", "i": "metadata/lang/compiled::rust-backtrace-symbolizer", "o": 81908, "z": 14, "cf": 0.95 }, { "c": 2, "d": "Rust-compiled binary", "i": "metadata/lang/compiler/systems::rust-binary", "o": 81401, "z": 9, "cf": 0.95 }, { "c": 1, "d": "Go allocation symbol bytes", "i": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "o": 81369, "z": 7, "cf": 0.76 }, { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 81591, "z": 12, "cf": 0.86 } ], "ln": 81093 }, { "b": "y\u0026\u003c8}vrsdPv{%y\u003cz.Dcxxk8BeA^orVA:{+pzE^s6e[n{gBy/ICx(tNTiw-:aw\u0026KoUvL}QLh8/b2v@bN)uU\u003cp#eIO\u003eje?!@1A:{+lCYUMUA@W\u003elB-RTTwmY.3fjwy4AX.DBzE\u003eyNe\u00262ppf!WP*v\u003eRCpzEW^5z/dgFA@W\u003elB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}TkXwg@1Av\u003eRCax!KyCuVQsfe](1kflhhRByM%YixeYKhzEa3f\u003eK\u0026Hh8E0CgbJDLvQS+3g?l", "n": [ { "c": 2, "d": "Rust addr2line backtrace symbolizer crate", "i": "metadata/lang/compiled::addr2line-crate", "o": 84035, "z": 18, "cf": 0.9 } ], "ln": 83939 }, { "b": "d8k%dz!pcc0X2nc2oUAXlq]ru0kFPI6D?QrA+]nsB7GCoB-p(1By!#9d8lGswO#Qgx\u003equdv}Yp*xjUQ5e^.Oeo\u003e!V=vru0)ayX]7Cv+u6ay]4}x(mTbx(v(ivqYP#vpJ!UB8@Exw/$G%17i-7ZYl33z/65swmYO0vpJ./fd}o/B98LzflzbJy?4c!x(m#BB97\u00261y?khyi5Ub4g+A\u0026/yI[6mzy]WszGQgQxkR\u0026By?WuiA=(CBy?WuiB8\u003e+zA=(CBfkLuiA::0lfjwWkz^$CwA:{+jz!%j", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 86501, "z": 3, "cf": 0.8 } ], "ln": 86405 }, { "b": "wNPa5x(mD)CRj2T06a+hBy/GgvqE5$A=M8siV@0KBy/G7wfu2jA+eV?xKLv^wGUG3wmW!AB98B-i+AzJzc}Bcw\u0026IiO1sUDRaIYfzCvtLnwQ5f9v@#o)aARJAxKM6}atC0GxKL{jayYFnaIXNiv}Yp\u003eB0bWrA+cw9z/]@d055wnB966CwPhYzze0)4Ds7Pnx\u003eg^bfFksqiwkC]v\u003eRLlw]7)$wImLiA+c\u003ezA@:0uaAg+0yHH\u003c!az\u003eLjaz#ataz2!iB95KszxIkiq.xg(A^n^Kx([3bB-X-T", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 89372, "z": 4, "cf": 0.8 } ], "ln": 89276 }, { "b": "AbYJexcpU(v@3gbvpJ\u003c\u003eAb]VgBzkS9aARJAvrMN6wft\u0026fBy/uix\u003c\u003e*2A+e:6A=U@kzvcxV0u/e]iV}%KCw.5lvpT7\u0026xcqe4v@2H=wG.xXdlY{VavQr\u003ez/N(YB9h2iaz(oAv@DHawft=dBrC47aAIHgCwZ#5iV#is3igcPeX?t!eX?utxM4:0fjXTgBywV/Bt2mRvrc10flgSpx(!xpC}TkVv\u003eRLlwmZ0rv@=11wPGFrz.iX7g=Y5TiaB\u003cQhdwB2h!BZ:BAhCpz7NB]f!\u003epnflqezfkLui", "n": [ { "c": 1, "d": "sudo command keyword", "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "o": 90085, "z": 4, "cf": 0.7 } ], "ln": 89989 }, { "b": "azC)tz/{dAz!pb3z/]@dB0bykayI$=v88:+k0zdMmriA!AV/Nmx([6bxcp/8AV/BCwn-PjwO0[BZYs=xZZRzNz/6DfwPRG]arS8F1r.R{aIX4caIX0+0kI5Dra]#!ayO=4x(v(iv{%l$A+f9aC4z!gze:AlByx6eaAg+0yHH\u003c!B0hU$zxJ\u003erwmY^7Bz\u0026phwGV55w[u0laA.:p3ig/8k0y8TCX7xcBzkVhaz2Olz/M%GZYM2DaIX0+01Hb)z/65dB7]G9y*?ubZZk68wQ4{gBugJAjACQ+", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92931, "z": 4, "cf": 0.8 } ], "ln": 92835 }, { "b": "B7F^2v}YN]xcoGuqz6NO3ih-1B-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}SVCA+c[BA:{+jwO=foz/f5@e](1kfjXTqfk+]GyYDbeB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rvkx(3fFvlRvSC)$C}TkXwg@1Av\u003eR[GB1.Gvy+G{Gx)qpFz!7FvA@W\u003elB-RUmfeU:HfGg)AhF1QPvkoX%fGg:zvRf7Tv\u003e//Jh-S/Pwh!6Rve", "n": [ { "c": 2, "d": "/dev/null (legitimate discard device)", "i": "micro-behaviors/fs/path/device/special::dev-null", "o": 94275, "z": 9, "cf": 1.0 } ], "ln": 94179 }, { "b": "jrM[kz/PV8au*bParUljwPzA{auQ+#ePVhPv\u003c3dweIgWOw]w!Q3lQDlwO(10xjShqePLAzB.$XjtoCHHAb]JiwO#33D($0)vrlibD($0)B8bGew[=pbBrB\u0026@arR!rzdN:2wGSMRxK#103qUR.x(v)giV{1Uf\u003e0BVl$H4bzG6Vtr^4:QarR^HarR^HarT(heIgyuB08OFarR^HarR^HarR^HarR^HarR^Hayc9]at2fNB-FPEarR^HarT}%arR^HarR^HarT(heIg)Uy\u003cvQMwPhNearR^HarR^HarR^HarR^Hayc9]at2f^yIv:bxk!$oarT}%arR^HarR^", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 94824, "z": 26, "cf": 0.94 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 94807, "z": 13, "cf": 0.95 } ], "ln": 94711 }, { "b": "zF-%9xjShdD($0)B-p(1By=NqarR!Oat2f=wOkN(eQ8bNy?aU]3lQDlarR^HarR!hat2f*wPz\u003caz/cWuarR^HarR^HarR^HarR^HarR^HarR^HarR^HaybrYarR^@z/M$qz/PzixK#10ay/tcB9hqvaARpdaw$S]l}{9hazt\u003esAc15[fk20vxMW=pv@DiqrC(tUA:@K1fF+TvvrDQ0eOe^gA+w}\u003cl3mo.z/N(YrC(tUA:@K1fF+S{flItRfjFTkfjw{vk0zdMnnh%-iV@cOB97\u0026by-)c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 95536, "z": 3, "cf": 0.8 } ], "ln": 95440 }, { "b": "wPF#oxKM09Cw?Ruwftt)az\u003eXgxjUQ8azCZoz/Px1AYMM@y?4Q7vruj3xcp.@AaJ]$wO#0(wPGERe*aXyzE\u003c%#asWy@ZYCS3.YO{V2M$bfaycb90sw*az//A7flz5Ifjx0zvj=5cwPzA{eN-afk0zdg0000007omOmnccqr6+zEr://!wLNe=mSiA!wk)nWwN[OVBy]5aaW3@1f:Y3CarR^Hat2fNB7w\u003c3B7foay?dH2xjVsfwPzVhb4LnawO+{/BzUPhvpS!*vnGP!lrcPJl$x\u003eFv@bZ+zu", "n": [ { "c": 2, "d": "Unix /tmp/ path reference", "i": "micro-behaviors/fs/path/temp::unix-temp", "o": 95803, "z": 5, "cf": 0.7 } ], "ln": 95707 }, { "b": "BAg@7yhWN5=cjx}eMcFceM380mmoZDayPslwo\u00265nx!.w5006/:eM3jlq!W\u003cpfe2NyuN)YYflQ=AfjXJBAbf7[vrb\u003c\u003e3nlNhAXy{hv}YBbwncabw[=6)A%:McflItRfjFTkflqnDz.DlOAXy)ozzc9ywIngEAXy)ozzb\u003cIflItRfjFTkflg[Yq/BruAb]VgBs?9yA=2lbc2K?KB$CpQz!%ujzE[05A+GMpAc15[fk20vy**^9vrb\u003c\u003ey?W^fCRi]Pxd)Xlv}YW)zGQgSAa9l(vp%p(xd[jjv@2H=wPGCAw?tPKvr:wCx(dAsmriA4wPRAnwO(10xjS-uz/PV8e]$PCfj/lnfj/0iA+w@pCw?Irwg?}mBs}VLA4LV=k0y9kz/PV8e]$PCaA.Tlvru6\u003ee^:^aj%ipmA=k$VaAIWozY\u0026[uazb4@y?mc1Cw7M9azbt9vqGU7x(mMaCw?Irwg?}mBs)[:k0y8TA=M8siV@G^wn-PjwN##}CXInhwfu8gBn", "n": [ { "c": 3, "d": "References real sudo binary path to wrap", "i": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "o": 96544, "z": 13, "cf": 0.6 }, { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 96699, "z": 5, "cf": 0.66 } ], "ln": 96448 }, { "b": "awM?$z/P/gvqYT!aAg+0yHH\u003c!B0bWrA+cw9z/]@daA8cuD2E?CaAI*HBy/qw3uZl6wPzA{k0zdMmriA!AYLsjvqfK?wft#jay/7@v@0i0z/M$sA=tY2zGvAqk0zdMrD8O\u003evpT7\u0026xcqnvB97#gasIeuw[+:?vqE6bwPhNedk0k93o*Tqaxrw[A:-G)zF77Trz\u003c@UvpK7YxjVcpe?NF.l3kvPj%ipmA=k$VaAIHkv}/L2aAg+0yHH\u003c!B0bNyay]58wO+{/BrCgoz/3Rvz/PV8e]$PCe^:^aj%ipmA=k$VaAIHkv}/L2aAd", "n": [ { "c": 1, "d": "Shell execution wrapper", "i": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "o": 97485, "z": 22, "cf": 0.8 } ], "ln": 97389 }, { "b": "azbB#xlcHop/HN%qBK2LwOD46Byx04ayP85aA}:Ay?aVcyIdY^mn)hXmn^YrB.$XjvixJfwP?^aB-RwAazC.nwPz*lAcbV4az\u003eXgxjU1mnL?(FqD3K[yIv-gBzbkdw[=pbBrCKhv@2H=wGUY8aARpdaAz4mB.$Xjy?W%jp/pp*mn^Ylz*2XmAa9l(vp%d)az#atazCZoCw?Irwg?}mBrz#JA=(nhdn\u0026P8mnu-(xjU%(A::63aAg+0yHH\u003c!az\u003eXivpS!*vix5*v}YA@c#@)iwO@}{mmP^wuSQ33oHI+", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 99621, "z": 11, "cf": 0.86 } ], "ln": 99525 }, { "b": "0009300093000310@@r30@@r30@@r30000200093000930000000ri30@@r30@@r3000930009300093000001onA40000000000006!njIQ$Y:SHOlu\u0026Qfbat3Agx(n2nxK#10asIqxwGU\u0026dA+cwqx([2hcOl]-wO=rkdnU50zGE1mwO=rdd05%hayMylB.$#7A^n^Kx([2hcOo0VdrYoyB7]Mgp\u0026Zn/BrCWsx(+zlwPI{3xjSi7AV/EqwGUU$y\u0026yInw/#hewGUS1C4CLlB9g@4z/6u1zE+epdrxSvv@Dj3vqYQypFBLHpdeIkl${ZYy*?Pix(d*9wO(0@Byxo9z/cXrwPS6nzE)u3vqWi0A=M8saA.NkCYmk7By/00D1go0y?mc1u@yMSB.(dXi^2s:A:-]ndpsopzxJw9ayESUA:Q2kvqH6$00000", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 106006, "z": 128, "cf": 0.94 } ], "ln": 105910 }, { "b": "z/Pzivrc16zdNQbBhd#\u003eA=M8si(@GAFm5uS0u.xTZYX:[A5#8-0dXCT000xHvixS9ze0/{AV\u0026d8az2!iB98E:asB$u:SHOlu\u0026ZldcJBe{Z}!5m0dXCS00aCEeIgTEy\u0026Eh9:SHOlu\u0026Qfb8dsUhvqH6$azC)tA+flkx(W=}azbLjasB$u:SHOlu\u0026QfycM((vBrCEtzE\u003c@mvriMjB-qqox\u003ep/P4@2{8vqGT*aA?gfB.8WyZ}!5m0dXCS00:\u003e]w]zYjc==t?Z@WY0Fm5AU0vE\u003e^z/Y#lvR/P#C3$", "n": [ { "c": 3, "d": "Network-capable utility profile", "i": "objectives/supply-chain/trojanized/backdoor::network-client-utility-profile", "o": 112540, "z": 6, "cf": 0.9 } ], "ln": 112444 }, { "b": "B9g@4z/6u1zE:(0B-X:AzE\u003c@mvriMez/^avA=lbnwmYoKB9g@4z/6u1zE^/e3jomvAV/jqA+cwczF0*czddK2z/d9GBAhTHc=0Ktaol}10009Ge^.OUzFKcdCwXKiA+xJiwO#Pjz/M$kA=l8tazCvsarTx!yH[SfB-I4oD2E*Fvrb{4B-RnmxcqqfwGUA4xlw65zGE1nwftq#wft=dBrCWswGV5cz/P}xz/M$pz/fhgw]7)*A%+uRA=k$DdmN-/vqE62zGGDgzEEu7wPz*fAXnFhy?m3@wGUG3zGxH", "n": [ { "c": 1, "d": "Interleaved wget command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "o": 113452, "z": 11, "cf": 0.86 } ], "ln": 113356 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ze0J6j%jVMzDg^\u003ci7m\u003edz/Q2fy?WA!B-pYfz!i%fz/Pi3wO#v0wfs5Uy?mG]vqG:\u003ewftnTwPJ0gBuhE9zG*bfA40eyaA8cuvqWh}mriARaA?gfB.9YPtqv{I8^tcWgI[7ng=^Eg8^tcWheKppg=NMOj8C{vgDmDNi#.xYi6e#V8^tcUj2e(V8^t9Tj2e(ptqXx4gclBVg+-+=tqO6K8^tcOz5VXogI[7ng=f4*tqOiO8^tcSz5VXoh/fHrf!+p#8^t3Jf(m\u003elf!+w18^t2", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 119972, "z": 91, "cf": 0.85 } ], "ln": 119876 }, { "b": "Cw7YbwGU\u0026dwnbU3x(mMax([zsB97\u00262yANLswPzy0z*9srzF0*czddK2z/d9GvpBd}BzkS93t9Z*vqE6bB-8qnzdK\u00263A=M8siV}%Nz/u?qw/#hewGU@2zFrP6Aaa3dz^^f0Aa9S#v@2T^efFwgz/P@lzF6qsB-889zdNlwuTE?@B97=2zE^9}xM4{kuT^CNyJKP9v}x1OA=(CBuT^OVx(mp0xM4{kuT^CNyJKP9v}xZlwmYj)xj27RvSD46e[xfAe[wK5B.t5\u003eBZF\u003c2wmZ0rwmYj)xj2v\u003cw]xp", "n": [ { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 127807, "z": 7, "cf": 1.0 } ], "ln": 127711 }, { "b": "az(mxBrC47aAz4nxMw3nzy=]svScpex(mL\u003cw)]^\u0026y-)+vzGGPfwGUM8A=k$Vax0u6BrC74zF\u003cxmay!\u00264v}V#%z/PA6xkO\u00266CW\u003er7BzkVhB1wCxvScpex(mL\u003cze0J6j%jVMzEW9\u003ey?mc1u@yMSB.(dXi^2s:A:-]ndpsopzxJw9ayESUA:Q2kvqH6$w)]^\u0026y-)+vzGGPfwGUM8A=k$VayPtjwPz)bz/cXfvqfK?wi7\u0026GwQbzbB0bQDx)KtkaW3@vmoJ$@mnu/.k$\u0026*LvpBd}BzkS93uQi8az\u003eL8C{3K9Bzk]faAz44wftYbv@3cdz/cW}Ct8{+yHIp9wPz)bz/cXfvqfK?wi7\u0026EB6\u003c6cy\u0026r*0wN)igByxo5drw{nx([Ryv}YB-yJ9##w[km\u0026Aa9%dA3fjAv}f7YwmYo]vS==nBzbkdv}YN)wg8Bvp!s4$", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 128342, "z": 128, "cf": 0.85 } ], "ln": 128246 }, { "b": "z/65dwmY\u003c\u003ex(4\u0026kvrb{4z/6igBy!#laAzQxaA}KwxDQXXrz#\u003e7lp0$ir8M1HmlLm9y\u00260G4w]zYjvix-8A:\u0026%dwGUC\u003cv@3gbvpJ\u003e33t9ZXy?mc1Bz\u0026puAaJ]ffjXTqflgGswn=s7z!%kra$)FrB$W(AzE^W5a$jTDvqfK?wm/m:y?mc1Bz\u0026pmwO#71vru66A:-\u0026@z/3Rcvrt{hB-RNRy?WuiwmYj)xd\u003e(DB.LV5eOO-Gw)]^\u0026y-)+vzGGPfwGUM8A=k$VaARpdax9MbBy/qivqG:#v{%E$AV/jcC{40yBrCZEwGT@CqY{o#Bz8!cwPI%lBZ]JiA=S=OvpBd}BzkS93t9Z*vqE6bB-8qnzdK\u00263A=M8siV@u-BrCHlaxh3kazULlB1wCxvScpex(mL\u003cB98ClA=M8suVEo3vqfL2A+fcbatmXOz^$CwwO+%iwQ4=evrM6[y**^?wIb8%B09bPA=kCgzeTMmBy!#Ex(n37A=br4az2Olz/N(YwO#Q3A+e=7B-8khvpJ$VvR/P#v@C)?iV@JTwGV8dA+eV\u0026azC.9zY\u003cajBAIKBy\u0026r%2v\u003c2GbzyoJGA+e:6A=U@rwPRP%A+cwcB0bvsazk/", "n": [ { "c": 2, "d": "Read own executable path (/proc/self/exe)", "i": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "o": 130972, "z": 14, "cf": 0.66 }, { "c": 2, "d": "Secure random number generation", "i": "micro-behaviors/os/random/crypto::secure-random", "o": 130727, "z": 11, "cf": 0.8 } ], "ln": 130631 }, { "b": "A+e:5z/Qa{B3SidA+e:5z/Qa\u003ex(W={Bz(hBph+kyze:PxqE%oEpI%#]mRMWIB9R?GwO\u003c[Jy?mWkB97#goMa\u0026*q/(C:wLM/UCw?IqmRMWInmuyDy?lgQC42i3wjZVTB-Zh)C42i3wjf\u003cFvomF-By!S!A=j(#z/Po0wKZ/Uy!![\u003cq!oJQvpB4:qfu/0vmtAJwO2y-wjyoHwMiO^oKR%OwM08Xz/{8gwKpJXC%#%?v%8)4vR/QBx(4uEB-R*}A=l2uwPHmJC4\u003eC$B5W6@o\u003c}{+oLFxWB4Hm)vqC", "n": [ { "c": 2, "d": "Joystick, gamepad, or DirectInput keyword", "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "o": 131607, "z": 6, "cf": 0.95 } ], "ln": 131511 }, { "b": "X\u003e\u0026\u003ep(}[k)lSax])nBF{lSax]lSax]A8m2Ah=6$:A8m2AlSax]h=6$:A8m2Ah=6$:A8m2AbVb3KlSax]lSax]h=6$:A8m2AlSax]lSax]lSax]h=6$:A8m2ADVAXcB-ILqz/cXlx(dNaaAz44v}YB:ElRaKzfd*1mriA!A:S@hB7/Gmy?aU$wGUY7AbP/sx\u003c$)\u0026aA}KwxM53nayMy2w]hSJi.14dzddKdwPzfxas[THzGGDgzEEu7wPz*fAYLsOzGGDgwN({azGoq%v}YpWy?j-0z!9ADB-8new[r8eat4hyc[cn?auyS:B-8Fmz!9BaEj/tLC5n\u003cwvqG:\u003ewftnTwPJ0gBuhE9zG*bfA40eyaA8cuvqWh}mriARaA?gfB.9mht@\u003e2ci^UvMz/Z5wwJz4#j%?y4v@DmaBrAT/c[F.qvqH0@DMWUTaBLv}", "n": [ { "c": 2, "d": "Rust expect failure message", "i": "metadata/lang/compiler/systems::expect-failed", "o": 133156, "z": 128, "cf": 0.85 } ], "ln": 133060 }, { "b": "1POJ5007fgi@/lX0086/r0041008kanezma000Ob!Au(j005Wjp8Boq002og5C669004L?Q\u003c!p9000992[mBV7AaqqbQU8{f/p{LaBtjZauyR/DKqqhc[2AfEjlZMaBNDDe?QBtvqG:\u003ewftnQAcb/jzAo?3zG*bfA40eyaA8cuviw@Mz/fb]aA?gfB.bJ2zFrP6x(k54ay]58BAhIlBz(gxwoz{bzF784y?m3)B-oGbaW6WJByO#}B8UM9x\u003e5o1zxJvgw{503BzkVhaARp9BrC74zF\u003cxmaA.NCx(mDnfFCjngb7Hrg+Z^vhzv6zi50uEfFLppgbgNtg+*\u003cxhzEcBi59AGfFUvrgbpTvg+{{zhzNiDi5iGIfF+BtgbyZxg=40BhzWoFi5rMKfF\u003eHvgbH^zg=d6Dhz^uHi5ASMfF$NxgbQ\u003cBg=mcFhz)AJ", "n": [ { "c": 2, "d": "Rust unwrap failure message", "i": "metadata/lang/compiler/systems::unwrap-failed", "o": 137915, "z": 128, "cf": 0.85 } ], "ln": 137819 }, { "b": "1PXVb0rJAf2M+kh0S-rc0r\u0026-h1onMd1owG61Qk2i0Tw@l1Qbbm1{1(i0TG8k0%FY91QLel2($nh0S\u0026Pb1PO=k0rJA90%/bp2m7Lu00-=g1oX(j2l+nj2)yzq1QCnj0rSGb1P]5h1{a@j2)gCs2)gFl0%[@j0S\u0026Sf2l$Co2l\u003eFt2)7nl1{Utl1{\u003eCn0rJAb1o]en1o]eo0sn]i1{1\u0026c2NyXq0%/2n2)HCo2M\u003etk0%w\u0026k1Qk2i0s5Yf2lB#g2l+zs1{+hl00@=h0rAGd1oX#h0%[#m00SVg2M+nj0Te\u0026l2lLeh2lLhq2NyLk0%F/j0SSxg1{a\u0026e00S-k2)yzk1{\u003eqk00SGd00000tgL=#!(hkekrCLydxkPA{*[1Qx0+W92Gm%:s\u003c1=SCe3knF8NMwn+K.B[vT3Lq/x%s?\u003cEWj*\u0026E-Leg/DCLM![ie1\u003eKSy3niEN\u0026qPT}9]w1hPOU4GYp\u003c8G5Ps/X0SdHm0^\u003eMc7tUQbo4Q2A^@tryk^1\u0026{Af$c{3:WmpOi}TH3]qMhk%CVgCcqNbs/zMw?e!@F!No7FoSSECc1W$aO#}jg0D*Ap%g{]Lnw0%\u003e^/GJj??{=b!=[dC?[6Dv^3+z4x(G.T./9gyPogej-O#bxSZwYJau%-29/hiJe+@U.wBv(UL!@Anv(Rn[9\u0026A*]4)$88[=\u003c=zfhfAM3f0Ss4=@}fT:QPH(\u003c(IjjIMLeNyy]Y}.e+(nu\u003c)n@k)XXPJTUTv@*@VF?E5=xTlqLl)G3(*EhZ9#WY*lI{8x{Zu]p\u003eiAY)REk)=68Dj.{d/*Q\u00263Gw(=]uREM:^4]V)5InN6mY\u0026F[86AuumlXUR/A^uV9kJv.yIIhJT(R9FpvG{Ly6VDN)TUl:NH2\u003crJgQB)Ov?eJWJzS\u003c3oczz\u0026^::UQj){\u003e=-I!sl-V3wrqhYtg2aB$vIS3pECP", "n": [ { "c": 1, "d": "Peak 1KB region at cipher entropy", "i": "metadata/file/metrics::peak-region-cipher-entropy", "o": 141312, "z": 512, "cf": 0.85 } ], "ln": 141216 }, { "b": "7^XYzk[je2001$U000M\u003e008wR2lnMu0000=4Ig@p7^XYPk[kqe4LSIsJ0bdyJ@\u003cInc{Xs=ljK\u002604Ig@p2TF}O002K\u0026002XN001dk2ll4J0000+4Ig@p7^XYPljLzg4LQfUi6!3tG9NttJrLsBJ@$ar0$Lzxi6!3dljLzg4J[7F7^XYzk[je2000Mg005xE000d]2lkFs00000001$U0068Y000O52lkkm0000+4Ig@p7^XYPk[kqe4LSIsJS+yBH5}CS0s*Iz4J[7F7^XYzk[je2001$U008jz0088L2lnMu0000=4Ig@p7^XYPk[kqe4LSIsJ0bdyJ@", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 180146, "z": 41, "cf": 1.0 } ], "ln": 180050 }, { "b": "4Ig]o2TF@Z0rr91nb@R\u002607)j\u003eoGryV8uP%t06}8aljK\u002604J[7Fc{!y$k[k\u003ex4Q:[]J0tmBJS+yBH5}CT0$EpR4LQiVc{!y^ljK\u002604Ig]o2MK\u002685c8XgoIbo+[h}0S5c8Xg000005c8Xgu}Hz0(]UNOi@/lX00000nb@R\u0026Bv(Jk7^ef9Hx4qO074ebljK\u002604J[7Fc{Xs%G9EnrJrCmzJ@/w{4K:TNavlLPljKL[4HtJlfHlf%ljLb84J4Ix5jc\u003cjnb@R\u0026Z!aOboHGf!F=C=J074ebljK\u002604J[7Fc{Xs%G9EnrJrCmzJ@/w\u003e4K:TNavlLPljKL[4G", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 184224, "z": 37, "cf": 1.0 } ], "ln": 184128 }, { "b": "4Ijl]p.0=G5c8Xg/IqFE\u003cAy[g?2EAP000005c8Xg(}WPYUY{DO9@(ov000005c8Xg08JT}YM:..nb@R\u0026000005c8Xg6I[=f{\u0026)8Bi@/lX0bA5Qc\u0026:kEc@o)zbZxW@{w+f[06}8al\u003eg]60S}6=5j3^ik[kOF4Ig]o2MK\u002685c8Xgr8rL{{\u003c0eC5c8Xg000005c8XgxIXWe]MZ-yc\u0026:kE00000kMy=:D@6!y5paS.ZYjum074ebljK\u002604J[7Fc{Xs%l\u003ei4C28\u0026.B1DAOB0+hY]k[kqf4J[7F7^XYzljKn!4P0c95c8XgZ!+1hJcU^ga]?P", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 185724, "z": 31, "cf": 1.0 } ], "ln": 185628 }, { "b": "rbIWo\u003eV52\u003emGrz*089\u003elH5%ZK26HyW2/V\u0026AbME/ABz.6U{/v\u003e7cij8D06}8aH5%ZK226TMJS+yB0#g?B2m7qf5c8XgOnFrbkW1M@1][S600000bME/AUX\u003cBvjx-c[!C]NH06}8aH5%ZK22o^PJ0kjAJ@]E23\u003cN4r7YTKo/LQV?ByCTU8uo:q06}8aH5%ZK1][S6c\u0026:kE]LKTeCW.6YiSPiX06}8aH5%ZK226TMJS+yB0($=P2TF\u003e65c8Xg7YTKoaA4kWJaim@6Awak06}8aH5%ZK210}A7YTKojz$i1KyFX02(\u003c@906}8aH5%ZK1][S6aohxwsz[ftV$6NBH5.hN06}8aH5%ZK21KpGJSPue3\u003cN4rec2UID#w#+5n8yKli3#=06}8aH5%ZK21a1CJSS(42m9Q71}Tok2m9Q71}Q+m8#]%sTzX7s\u0026a-V2bME/A08\u003cvsH5%ZK21x1a2/V\u0026Ac\u0026:kE+X)", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 193540, "z": 52, "cf": 1.0 } ], "ln": 193444 }, { "b": "nDm1biMzU.Sr951n@Tk}nichJGnY\u003ci06}d7eib%RedcHFoAL$Oo]m]@TBLWzvGl{)lhQYZnq*B)p!lISb-\u00260a07-3bb:XMi01VIabW:e%^HR0B0rr9\u003ciM.\u003e+1PXP6FijT-4#*O\u003c008n?0rr9\u003cI^dJDpk{I3nJDzNGy]3u%4FtQbXP(fr3UphI+Cy7nqN:2nSuvxnqQ1=5kFiw5(jGH5:Ho80MdD+?+GdR2qLQpItG\u003e8]BDOm0000=54jOAnE}P[Bkont\u003cvLi:4\u003c7^AJxwyQiMDg^on%ufnichJ", "n": [ { "c": 1, "d": "SOCKS5 client greeting bytes", "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "o": 245865, "z": 8, "cf": 0.9 } ], "ln": 245769 }, { "b": "bW:f5YD\u003e\u00267002YH@@i.(STO@4IejCJoO)p9A7C[Sb*VI\u003e08erLb?J7%08erDb\u0026wU508bAA4#3FM002-E\u003cpv9n0000N*ENgUoO}{i6@O5v0o]^N0093l1Gz[hZx1rm0knEl0093l@hyb9nqj?\u0026GJ4%L0lb1lnxjd00rr91nqP+vnxjdg0rr91oGzY!4[IRabRXBJg64yt[=Y0[nqk/u6g!4ebRV!g0000\u0026IqFmEnu9a0nq?NnkUcR54$@dg002MFD)zm]0rr91(9*/@07.@.bPb\u0026xnqRdd7\u003c4[u6)DR^0j@mi006.l0000)IrB)NyY", "n": [ { "c": 1, "d": "SIGHUP signal ignore pattern (x86_64)", "i": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "o": 246892, "z": 29, "cf": 0.4 } ], "ln": 246796 }, { "b": "002MHYD/fm006Ot0002f0rr91lau{}001+E\u003e**yH07-95b!%DY07-9lbSC@c07-3bbSC@c07-3PbTqIk07:\u003cEC4CYnx(v(WIf}2Ynwv#wx(n2nC4Bj3jtxxV-TLE}V)m)u002MFJ3H7X000Jv0Ul-kbV1*F07Yc6BpX%hGD%w3000JUGD@kP002MDJ3L[m003Qwz?Gw\u00261POL]4$sNIJL3J!6-Xk8JKf$T0002gsonE5@$Q*}2()IOOSA*K07YhxFb/MHBQZ)3Y){7.0ri^0@S@M}y5q0l002K", "n": [ { "c": 2, "d": "Contains version information", "i": "metadata/package/quality/profile::versioned", "o": 488345, "z": 7, "cf": 0.85 } ], "ln": 488249 }, { "b": "g08$Auc3R\u0026w[CT!e!o4S0000001VH$Gzv-O3p6dw0s%%%4GDF]54qH7Itq!!E[n5KnEteXGVK:Y]A20)n=M}7%g\u003co62tG{2B\u0026S.]4GDFtWVfkA%nO6Q%b25!fXnMH/lf{X54{qu}u7}gnr2^-sm#O:v?+n20S2GFmBq7]o[?1YY8R*h01T+.4fcwsWGbNM0@@r)Jryj(GtmOC:hdiInwTH3nqP^B(0:!@08eqt=}e/D00960Io9J\u003e2Ut6jnRs!@mkrMYX=R{jnSr\u0026)nq1XWIo0E32Uq!}5j?TDXj5a", "n": [ { "c": 3, "d": "Mozi XOR encrypted configuration", "i": "well-known/malware/botnet/mozi::xor-config", "o": 815131, "z": 11, "cf": 0.85 } ], "ln": 815035 }, { "b": "002MDMeIPu%450O\u003e(7LYnS0B3Z^{J\u003cC)TYP4$M}D002N100000WGcvdnqS4B}V3OFRgwBx@@uU-Rg!ZB@@y5)FCPrC0z6.iy?ttqvq{oUJKo]0%nLSDmH8F]fk$@Iv\u003eR[mnqNL\u003cmH]F\u0026JH+Q^%nM*Bt1BIc@$N6O1os6o0zFuTnDn.\u0026BQpP#1XuYq0p8jcI)Xxc%nLSHO-6wA%45cmC(4EunqVl/[Pa:iGf68AG$dr^07-34\u003e\u003e+tVnr7q9[=eRWI3JlxEGfvtY-n3j00000Fk7)?nr6e.[=eRWGcHv!:3Qar0000\u0026GjtC", "n": [ { "c": 2, "d": "/proc fs path in native binary", "i": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "o": 820331, "z": 9, "cf": 0.4 } ], "ln": 820235 }, { "b": ".VG[.+/[qP+/\u003c6TIrd38k#{]PF:x(E002MF2ty4noP9\u0026}nxgYg0000[H5RWpW/uydnqV}eXbVHe0jz[d07.@n/VcCs00000x2^v30072c?#MxUfjXTqflIqznqS3O@@r2sG/G8i%88v=zn}n(@@q##nr554nr72h@@r2f4fcwd@$R]Y0%0$4UMn\u003eSoPqi!O=X%:GfxoTbKl^HI/(K2JEw(sJAaS{HdREDGmg/wBSBelEB7Mrj]/WgoO@Jc)O%k^o]h6O0%eD50p6\u0026EmA!5O2s%A:Xb=Nftr#NYuTpMu", "n": [ { "c": 2, "d": "Access /dev/urandom", "i": "micro-behaviors/os/random/crypto::urandom", "o": 896470, "z": 12, "cf": 1.0 } ], "ln": 896374 }, { "b": "g0a3tw[CTc4\u003ccD800000mgV?F%aybiBQyA+@S9K+i$Iw(mgV\u003c2mtZ+8GxvUP!8\u003csg{c\u003cVmC[#4G2ta%in=MX1GztK\u003c:ls-U003R)oO($cn+Z[iIaY*0H4V4g1P!V7nq*binr3asnio9G4$+5/002M9Z\u0026h*Dk)S0=y5@C!nq\u0026D#%nS9\u0026%g}l.ohDednn9UK9y#3nXdsmc0SSi(IpCdN:aKgu4#6iG0093lXln$mnR$!WI=p@)nr7p]%nS9\u0026JDl^AInwAO6Aw7yWUkp)%nLhV4$$o2002MFB5ky?", "n": [ { "c": 1, "d": "SOCKS5 BIND request opcode", "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "o": 924304, "z": 8, "cf": 0.6 } ], "ln": 924208 }, { "b": "np/.10rr8n\u003c{jGU[KOqG8bb%xC(N*z(aWh#07.+x0$QbM0@@sV0p8:rGz#e!Hbn#j01VIe2m[pu1p}}W2ePBk3d+1mnwTBpnwTi\u0026nd1=R53i?T(Kuyq@@AT+1P[-854qKfI/(*aF-V$j%nLSx=qJ[1}#uW/GztPWHdhmB07q.B(Qal@}3dB+hV\u003c3W54k1l54uGXl\u003euZ\u003e20{8-5j3S(IVut+\u00263.dj\u00260r0.Z!6x#nE}]z2\u003cR%(GztJUH5}CS07mvb07-2xS7qG#0rr90nq22Znq?SiUMmpKG-IeM", "n": [ { "c": 1, "d": "SOCKS5 UDP ASSOCIATE request opcode", "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "o": 927429, "z": 8, "cf": 0.6 } ], "ln": 927333 }, { "b": "@$Qex0SU/G-{jgcIn\u00268Aubf0+*Jjf7I*-WT0rr91oO@^uIqFmEwITw/oO@JcuebCX+/[qP+/[qP+/[qP+Vdh\u003c\u003cV#%lr-qLu)6)5@07.$znXUl9000000dWRIB7Gf1fj/xtnqS3:@@r0?Xg./wz^$CwwK}Viir5%T-!u[Y%nJ6\u0026JEwrcJKp+B%nPUv000306}vn=0e2Zf0D/!YJxL2/0SU=FEB}kIEB7VEB\u003ezMCGwV\u00265JsBHg]8zl\u003c1C68A:P7f?I/(*aJExgqnGv^hoGvKFBXbbZEB}kMB\u003ezMCGwV\u00265Jsz!R]8zl\u003c1C68A:P7feWNQ)ZZ\u0026Z{*j4Nf", "n": [ { "c": 2, "d": "Read own executable path fragment (self/ex)", "i": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "o": 998367, "z": 7, "cf": 0.58 }, { "c": 2, "d": "Read own executable path (/proc/self/exe)", "i": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "o": 998392, "z": 14, "cf": 0.66 } ], "ln": 998271 }, { "b": "6/+\u003c!0kpO@0093lTQUyj-S.I-0SSk^20}$40D=%.G-qNp1PXP654hT%hV-#jZZ(d)0000\u0026XbVHe0jz[d07.@nZ@F)+00000x2^u:0072c:n[\u0026wfjXTqflgGsnqS3q@@r2sG=*r]%88v=zn}nO@@q##nr54+nr71]@@r2f3\u0026*nc@$T#o0SW\u003e3M\u0026N.J3JZqdnq?R-nr554nr3S+\u003e//v)%at:70s%\u003eV0rr9/I*.%2Im\u003c=9%nQb[9rc0r0rr91oPud\u003e@@r0(IZnPz0SS+t1\u003e+^n0eedgl+SN3002YH[4eJ", "n": [ { "c": 2, "d": "/dev/random access", "i": "micro-behaviors/os/random/crypto::dev-random", "o": 1008027, "z": 11, "cf": 0.7 } ], "ln": 1007931 }, { "b": "83o\u003cK01P757.D-F0001l000000000d8uP%L01P5L]ag)40000-1onA4000128uP%L01P6q{yEr80002I1onA40001:8uP%L01P8001/hh0001a0000000000e[]iBwPz.\u0026e]CPHwIcnnnIb3)x8\u003cM4z//LyxkR\u0026AvS=y3wg.Ia04}/czGy8u04}]4BUm\u0026GA=U@kzu8q4zGNNPwPz\u003caz/e{504}]4BUmuoB7+Lawo\u00266lBAdvlA+f5}e[xlB04@q6y*!@ny\u0026/UfxjCBUwQ4Y@AcbDevpB4:04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04@w8CYS{rx(mTb04}\u003e$zFo86AboQ@e{7SjByte4ByGrj04}\u003e$zFrD^A=LPl04}#6x()Y\u003cA=LPl04}!\u003cByu!xwO-#tzVzz2D2v5cx\u003e4b}xk.\u003e(e[Y9Ae]USG04@q6y\u0026TD3Aa9o/x(mL-e{7@qv@c73wNxK/vR/PQe[wyjve}]?B8}slv@Dj3wO#O\u0026e]#qPBywRUe]$YEBAhFivGn34BAhFivGlynuTWzTuVYZ?0af8jo*-nYnMeO}uJsRFA+e($B97#luVV", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 1211799, "z": 8, "cf": 0.9 }, { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 1211648, "z": 7, "cf": 0.9 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 1211602, "z": 7, "cf": 0.9 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 1211561, "z": 7, "cf": 0.9 } ], "ln": 1211465 }, { "b": "07PyzuUaE(wPh-#BywS{wIC$vm)/TJwQ4Y@AcbDevpB4:f/e(2lQLi(CW\u003er7Byfb#vR/Qgh2{cllTKzHv}xR3uVYZ=y?ksV0ae]8f/0lPvq]N.B.LV5wPxRIBzkLJw]7)$uU%j\u003cgb8glvrtjLA3OaRbUGyIbVVfXr3TwozGxxfBtkZ/ggSr#wJ8w5w\u0026zXeg=vfDmf2?BlTKzHv}xR3uVYZ=y?kvQ07PyzuUaE(wPh-#BywS{wIL$um)/TJwQ4Y@AcbDevpB4:gbn\u00261lQLi(CW\u003er7Byfb#vR/QhgYQ3k", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1242674, "z": 12, "cf": 0.86 } ], "ln": 1242578 }, { "b": "y\u0026131e?Ri!A+PA7e?Q7AA+PA7bU7/VbU7/Vf/J=6hA9AGf/RcFg=EuKg?wBh0ae]8g?gDAwIXpEAXPycwo8QcuUKy+Abn@)wH6@GbX7U0A9)6%x(4r\u003eAXn$!BzkLze[O{dBye([A4S+jy*?AWvq)F=r3U%\u0026vq]N.B.LV5wPxyQB-.tle?Q\u003cGe?P.abTS?=y\u0026131e?RrUv\u003eGxmwN=#Vr3U%\u0026vq]N.B.LV5wPxyQB-.tle?Q\u003cGe?P.abU7/VbU7/VbU7/Vf/J=TwObH+ia+0Ti5\u0026(Qf/RfZ07PyzuUaE(wD", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1246925, "z": 13, "cf": 0.86 } ], "ln": 1246829 }, { "b": "y=L\u0026UB97}HB9RUkiD5!BwNxm(v@1UhBv4=\u003ci8sB4wLv2LyFF$DBv4][gg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{Ah^XvZD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMln@mbx(t\u003euA=M8shaqLaz/Ookh^VL(qCIygC20cOBwu{BB82.^q:\u003ch]q8r2GuO=+BwhwpLB2F5EzE^W5heD#AB:b]VwPR%3zE^W5hBG#mnKC]DuS6D\u003cC20cDB7W{Uw\u003eK)Jf\u0026HFsuO(nhA+d4CBAf8(wo8QcuUKy+Abn@)wL2Tspin/VuP8}oB9hqvhD1acB.(expiolMpin\u003cAyh#\u003czmmRk)gI/6UgJNUGghgU:wPz*fAY3paA=k$!mm5Z?uJrO-lTKzH", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1263527, "z": 9, "cf": 0.8 } ], "ln": 1263431 }, { "b": "q8r2GuO=+Bwhm\u003eqhdZ/Gz/NZ7A=M8smm6ZQ0aeS0C20cOBwu{MBvga:A.6a$m@zfWy=L\u0026UB97}EggBW4yJKP9v}x1/B2!q!zdmB1x)KtFxk8j0x!?wUx\u003c#c\u003cwnCQ!By/G3By!/#xK(cyv{%g\u0026vQS+Z0aeS0C20cOBwu{BB82.^q:\u003ch]q8r2GuO=+Bwhb\u0026GvpK7{A:-D?uVHiFB9RRiz!%clwI[amzer]yzeAZ20aeS0C1)3+piolMpiolMlVW0.nk?@EzC-iaiBsN-ByW9YvQS+ZBAg/1wNxF0iDGE.vSc5", "n": [ { "c": 2, "d": "Iterate shared object list", "i": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "o": 1264196, "z": 15, "cf": 0.5 } ], "ln": 1264100 }, { "b": "f?bIsmm5.5uJsChnLTC7BvgaZmqVTfgd:i0l@NCHv@Dy0gJmCRf/9uXz/x5$zEmv0vpJ\u003eupiolOpin\u003cAyh#\u003czmmRk)gI/6UgJNUGghgUYh!lGivrDyduW3K8By!/\u003ezfdZ5wmoC0wPyvqBwu{AoKxX/B-ILwAYcpcA=Vetqb.c%mmxKruJsChnLTC7BvgaZmqVTfgd:i0l@NCHv@Dy0gJmCRf/9uXz/x5$zEmv0vpJ\u003eupiolOsAw:{piolMpin\u003cAy!!b0A==BWx*#cghdprqz^$HRv@Dg1wN/*@z/fQ", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1275519, "z": 11, "cf": 0.86 } ], "ln": 1275423 }, { "b": "pd4PFC1\u003e.NlsBjYz/f5@uU\u003cT\u003cyE}oylnq}Ri8sB4wLv2LyFF$DBv6FAgg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{Av{.3kD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMlsTvTx(t\u003euA=M8shaqLaz/Oo2mkd5ruJrO-lTKzHv}xR3uVYZ=y?ksXgxp=WpiGxQpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e#PvpK7{A:-D?g\u0026d8uyCXZXlRvzHlQLi(CW\u003er7Byfb#vR/Qgi5yRxqu", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1286257, "z": 9, "cf": 0.8 } ], "ln": 1286161 }, { "b": "CwhejuT[k0A+fcguV6p?wLLP/lR./1Bv4@]iDezAx\u003e7{)zF7WVwmYvYB.(ebxM4*8fFESrfHv:a0aeS0C20cOBvga:A.6a$m@zfWy=L\u0026UB97}JBzbYavpR8Ezddc@uVY$4wNPaao*IuCe?^ojqCIyqB1}xopin\u003cAxglVHoeo6[q::L\u003eg?gDAwIW}nBw=WBBv4()h:?w3Abn%dgIgGClVW0.nk?@EzC-iaiBsN-ByUwUqCIyqB1}xopin\u003cAxglVHoeo6[q::L\u003eg?gDAwIW}nBw+\u003eQpiolMli", "n": [ { "c": 1, "d": "main_* architecture payload name", "i": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "o": 1286861, "z": 5, "cf": 0.96 } ], "ln": 1286765 }, { "b": "C@68yv\u003e//Lx(mD*wOtBVv@#B6zGxesloexMm)/TJwQ4Y@AcbDevpB4:gbg=?uS6TxpiolMpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e=XvqE=yzFstJz/WS?xkzo\u003ev{:y\u003cA=U@kzu9f]lTKzHv}xR3uVYZ=y?kvSg5%*ilTKzHv}xR3uVYZ=y?kvSgxp=Wpe:]hsX.sQpiGuMfKEN%pin\u003cAyh#\u003czmmRk)gI/6UgJNUGg\u0026)}Wv(eawv}wzSls:BWpI%VNf/rDHy\u00260D%zEWl+w]zZ1wLLP:p5", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 1288283, "z": 5, "cf": 0.8 } ], "ln": 1288187 }, { "b": "pd4PFC1\u003e.Nls%N+z/f5@uU\u003cT\u003cyE}oylnraWi8sB4wLv2LyFF$DBv6UFgg\u003eO:mRMWImklGgzFsibvqGU7wLLP/C20cOBwu{AxKrMpD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z7[.bpiolMltfZYx(t\u003euA=M8shaqLaz/Oo2mkdqdBwu{MBvgaZmqVTfgd:i0l@NCHv@Dy0gJdkNia^qJv@#B6zz\u003c$4pI%VNr8MFkls:B-pI%VNq/(C\u0026wKP3Fv{%g\u0026uVf*(wJ1ZNvpB4:ltfZam)/TJwQ4Y@AcbDeve", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1289293, "z": 9, "cf": 0.8 } ], "ln": 1289197 }, { "b": "uVYZ=y?kHYirhMplTKzHv}xR3uVYZ=y?kHZgxo{jlTKzHv}xR3uVYZ=y?kHZgYQ(XpiGxOpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z2^{vpiGxQpiolMpin\u003cAyh#\u003czmmRk)gI/6UgJNUGgJN?.hGAkzwn=rxy?W^fCSxzFBAg/cwn=rtiy=IqqBa5CpFCgZrZxqJk%!mle?^ojqCIygC20cOBwu{BB82.^q:\u003ch]q8r2GuO=+BwhwpLB2F5EzE^W5heD#AB:b]VwPR%3zE^W5gbzA#pdeCXpe:OGrz(m)k#{oyoHh0smj{m]uS6TxpiGxOpiolMlVW0.nk?@EzC-iaiBsN-ByWgGD2\u003e(:vqYQ]z8DczzGQg:xjVg9vqYQ]z80?DqBa5CpFCg]ml%sAe?^n}lQLi(CW\u003er7Byfb#vR/Qlh8UC8lQLi(", "n": [ { "c": 2, "d": "getrandom syscall", "i": "micro-behaviors/os/random/crypto::getrandom", "o": 1298458, "z": 9, "cf": 0.8 } ], "ln": 1298362 }, { "b": "BywS{wI(jym)/TJwQ4Y@AcbDevpB4:h8UCKwO\u003e{\u003cAXovgg+@U%v}vOSvl3qShz)6@xlt*X0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}Cr6nHzE^9}B7E9bvpS[?ghHVxwIb=0vLxL[ix7Ich.!+%whbVCxlt*X0aeR}piGxOlVV)ezdVA@nIKdiq^Rv\u003ez/PzBAccaPgH$JAA9)r%uVo*\u0026v}wzSpin\u003cAy!!b0A==BWx*#cghdl", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 1308476, "z": 6, "cf": 0.3 } ], "ln": 1308380 }, { "b": "haqLaz/NZBvrDT5f/J=9wNNGdw?U}@wIW}ch8NuZ0aeS0C34HYpin\u003cAxglVHoeo6[q::L\u003eg?gDAwIXjDz8C)BA=k$[Bv4-\u0026f/q{JC$8*)zaOR!mriA!A.ZZKBv4()gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AY4unB-RaGh!V!-ggSaKggq\u003eDh-22Rf/8k#uS6TxsAuo9piolMlVV)ezdVA@nIKdiq^Rv\u003ez/PzBzGP!NwPz*fA.ZZyhd56]p*[x=wL3=YmriA!A.ZZKBv4#{gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AY4unB-RaGh!VUXhdXK5g=WAGvMuk3vMl^RuS{h-gHzz3r3Uo=BUUS@vriYpgb6$-y*?o\u0026vS=y3wmY^le[e%qy?d9$e?RrQy\u0026%q@Aa9^dwPxyQl2H%GvqH6$p*[x=wD", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1335837, "z": 13, "cf": 0.86 } ], "ln": 1335741 }, { "b": "e?]joy\u00261oie\u00262pygc46Bf!$QAfF\u003eEugb7Ev0aeS0C35/)piolMlVV)ezdVA@nIKdiq^Rv\u003ez/PzBzGP!PwmYmaw]8M:Bv4/\u003ef/q^oA=U!Yy\u0026r:7mriA!A.ZZKBv4@]gIgGCh:?w3Abn%dgIgGC0ae]8g?gDAwI[4tA=k$QmriA!AYd#SB-H#6f/J=5v(k#2f!+N@vkP(NwIV8ge]kuEz7WO3h.)xFgCHTxhzu%wg+{:uh2{#YpiGxQpin\u003cAxglVHoeo6[q::L\u003eg?gDAwI[KBx\u003e7ZffK]3uD0+f7z/5\u003c5yY", "n": [ { "c": 1, "d": "Interleaved tftp command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "o": 1343139, "z": 13, "cf": 0.86 } ], "ln": 1343043 }, { "b": "bU7/VgbB5\u003czE)r?B8$=gD0+92BZ/e#uU0O^xFzCVh.^s8h!a*chz!\u0026KvM2#Jmf3W#pbaIly*?o\u0026vS=y3wmY^swPz*fAXPytA=M8sbURe.mKgG6bR.i1zFKcdCwZ+@A+xJiwO#PAh!VYfv(b\u003e{vkhmKvpJ.Rh8dJ1uS{hVggLceA9)6%x(4r\u003eAYd(BA=U/jia=-gBAIRnB1]y\u003cB.tt#B98bmzGvJ/wnbNYD2E?jzdNc[f/J=9iBKW6w?U[)i5t83hE{k+0ae]8f/0lPvq]N.B.LV5wPxUtA=M8sf/hr", "n": [ { "c": 1, "d": "Interleaved wget command token", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "o": 1362572, "z": 11, "cf": 0.86 } ], "ln": 1362476 }, { "b": "z*bMbzE(dluJsCkzG//jwm5kyx(^\u0026OCW\u003er7BzkVh0ae-zCwg@9uQOEwwPRGLCW\u003er7BzkVh0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}CqqS.0aeS0C20iQBwu{MBvgaVr8uZ/piGGipbMxpzdNM]xMt}rA:@=vCSmP*hz^sewO\u003e{\u003cAXPm+wO\u003e{\u003cA:J\u0026}Cq-#yBy!%70aeR}piGxQo(\u00266%pin\u003cAy!!b0A==BWx*#cghdprqz^$.DvrV74wN!qbBv4@]f!(NmCueo+nP5ASA=sDaA+fr6A=#1Hf\u003etifA+fr6A=#23vqYQ.xKL^?y?lv-pin*huO}", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 1407564, "z": 6, "cf": 0.3 } ], "ln": 1407468 } ], "depth": 5, "facts": { "imp": [ [ "", "libc_start_main" ], [ "", "gmon_start__" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "ITM_registerTMCloneTable" ], [ "", "cxa_finalize" ], [ "", "memcpy" ], [ "", "bcmp" ], [ "", "Unwind_Resume" ], [ "", "close" ], [ "", "memmove" ], [ "", "memset" ], [ "", "memcmp" ], [ "", "isatty" ], [ "", "tls_get_addr" ], [ "", "dl_iterate_phdr" ], [ "", "munmap" ], [ "", "syscall" ], [ "", "pthread_attr_destroy" ], [ "", "read" ], [ "", "errno_location" ], [ "", "chdir" ], [ "", "Unwind_GetIP" ], [ "", "gettid" ], [ "", "open64" ], [ "", "openat64" ], [ "", "mkdir" ], [ "", "Unwind_GetTextRelBase" ], [ "", "Unwind_GetDataRelBase" ], [ "", "chroot" ], [ "", "getenv" ], [ "", "strlen" ], [ "", "malloc" ], [ "", "posix_memalign" ], [ "", "free" ], [ "", "realloc" ], [ "", "write" ], [ "", "calloc" ], [ "", "ioctl" ], [ "", "poll" ], [ "", "recv" ], [ "", "fcntl" ], [ "", "writev" ], [ "", "recvmsg" ], [ "", "getpid" ], [ "", "sendmsg" ], [ "", "pidfd_spawnp" ], [ "", "socketpair" ], [ "", "fork" ], [ "", "posix_spawn_file_actions_addchdir_np" ], [ "", "posix_spawn_file_actions_addchdir" ], [ "", "posix_spawnattr_init" ], [ "", "posix_spawn_file_actions_init" ], [ "", "posix_spawn_file_actions_adddup2" ], [ "", "posix_spawnattr_setpgroup" ], [ "", "posix_spawnattr_setflags" ], [ "", "posix_spawn_file_actions_destroy" ], [ "", "posix_spawnattr_destroy" ], [ "", "sigemptyset" ], [ "", "sigaddset" ], [ "", "posix_spawnattr_setsigdefault" ], [ "", "environ" ], [ "", "posix_spawnp" ], [ "", "exit" ], [ "", "dup2" ], [ "", "setgroups" ], [ "", "setgid" ], [ "", "setuid" ], [ "", "setpgid" ], [ "", "setsid" ], [ "", "signal" ], [ "", "execvp" ], [ "", "pidfd_getpid" ], [ "", "waitid" ], [ "", "sysconf" ], [ "", "pipe2" ], [ "", "fstat64" ], [ "", "Unwind_Backtrace" ], [ "", "waitpid" ], [ "", "dirfd" ], [ "", "lseek64" ], [ "", "dup" ], [ "", "abort" ], [ "", "pthread_self" ], [ "", "pthread_getattr_np" ], [ "", "pthread_attr_getstack" ], [ "", "sigaction" ], [ "", "pause" ], [ "", "getcwd" ], [ "", "unlink" ], [ "", "lstat64" ], [ "", "stat64" ], [ "", "exit" ], [ "", "mmap64" ], [ "", "realpath" ], [ "", "readlink" ], [ "", "statx" ], [ "", "getrandom" ], [ "", "cxa_thread_atexit_impl" ], [ "", "pthread_key_create" ], [ "", "pthread_key_delete" ], [ "", "pthread_setspecific" ], [ "", "fdopendir" ], [ "", "readdir64" ], [ "", "unlinkat" ], [ "", "gnu_get_libc_version" ], [ "", "getauxval" ], [ "", "sigaltstack" ], [ "", "pthread_attr_getguardsize" ], [ "", "mprotect" ], [ "", "xpg_strerror_r" ], [ "", "closedir" ], [ "", "Unwind_GetLanguageSpecificData" ], [ "", "Unwind_GetIPInfo" ], [ "", "Unwind_GetRegionStart" ], [ "", "Unwind_SetGR" ], [ "", "Unwind_SetIP" ], [ "", "Unwind_RaiseException" ], [ "", "Unwind_DeleteException" ] ], "sec": [ [ ".interp", 736, 28, 3.94, "alloc" ], [ ".note.ABI-tag", 764, 32, 1.5, "alloc" ], [ ".note.gnu.build-id", 796, 36, 4.19, "alloc" ], [ ".dynsym", 832, 2856, 1.07, "alloc" ], [ ".gnu.version", 3688, 238, 2.06, "alloc" ], [ ".gnu.version_r", 3928, 384, 3.35, "alloc" ], [ ".gnu.hash", 4312, 28, 0.81, "alloc" ], [ ".dynstr", 4340, 1757, 4.86, "alloc" ], [ ".rela.dyn", 6104, 34560, 2.56, "alloc" ], [ ".rela.plt", 40664, 24, 1.22, "alloc,info_link" ], [ ".gcc_except_table", 40688, 39100, 6.01, "alloc" ], [ ".rodata", 79792, 73212, 6.44, "alloc,merge,strings" ], [ ".eh_frame_hdr", 153004, 12196, 5.57, "alloc" ], [ ".eh_frame", 165200, 77848, 5.15, "alloc" ], [ ".text", 243056, 877155, 6.21, "alloc,executable" ], [ ".init", 1120212, 27, 4.24, "alloc,executable" ], [ ".fini", 1120240, 13, 3.24, "alloc,executable" ], [ ".plt", 1120256, 32, 3.05, "alloc,executable" ], [ ".tdata", 1120288, 32, 0.2, "write,alloc" ], [ ".fini_array", 1120320, 8, 0.0, "write,alloc" ], [ ".init_array", 1120328, 16, 0.0, "write,alloc" ], [ ".data.rel.ro", 1120344, 17384, 1.17, "write,alloc" ], [ ".dynamic", 1137728, 464, 1.81, "write,alloc" ], [ ".got", 1138192, 4104, 0.0, "write,alloc" ], [ ".got.plt", 1142296, 32, 1.12, "write,alloc" ], [ ".data", 1142328, 2512, 0.04, "write,alloc" ], [ ".comment", 1144840, 166, 5.09, "merge,strings" ], [ ".symtab", 1145008, 66552, 3.12, "" ], [ ".shstrtab", 1211560, 339, 4.29, "" ], [ ".strtab", 1211899, 203507, 5.45, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 247152.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 1324.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 119.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "symtab_count": 2773.0, "dynrela_count": 1440.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 119.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 2.0, "wx_segment_count": 0.0, "comment_entry_count": 3.0, "hidden_symbol_count": 579.0, "program_header_count": 12.0, "has_direct_loader_dep": 1.0, "comment_distinct_count": 3.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 877232.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 877232.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 1417648.0, "entropy": 6.36, "size_bytes": 1417648.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.21, "data_entropy": 0.87, "overlay_size": 2242.0, "string_count": 2670.0, "overlay_ratio": 0.0, "overall_entropy": 6.36, "overlay_entropy": 1.66, "entropy_variance": 4.29, "avg_string_length": 75.55, "max_string_length": 5734.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.97, "peak_region_entropy": 7.84, "string_length_stddev": 133.22, "largest_section_ratio": 0.62, "sentence_string_count": 209.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 118.0 }, "sections": { "count": 35.0, "code_size": 877227.0, "entropy_max": 6.44, "entropy_mean": 2.92, "name_entropy": 4.24, "writable_count": 12.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 52, "mol": "H₅(Cm₂F₂MgPo₃U)Md(Bi)", "path": "main!!aura-emerge-main/target/release/aura-emerge", "pid": 0, "risk": 12, "sha": "b47adeedc852f17231454e3d16a3c9cc22759bb061e1338013d0fce33f24b805", "size": 1417648, "traits": [ { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword", "spans": [ [ 90085, 4 ] ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string", "spans": [ [ 180146, 41 ], [ 184224, 37 ], [ 185724, 31 ], [ 193540, 52 ], [ 193646, 48 ] ] }, { "id": "metadata/unsigned", "conf": 1.0, "crit": 2, "desc": "Binary is not digitally signed" }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.7, "crit": 2, "desc": "Short -h help flag", "spans": [ [ 106074, 3 ] ] }, { "id": "micro-behaviors/process/control/wait::waitid", "conf": 0.66, "crit": 2, "desc": "Wait for process state changes", "spans": [ [ 5252, 6 ] ] }, { "id": "micro-behaviors/os/signal/handler::sigaction", "conf": 0.9, "crit": 2, "desc": "Install signal handler (POSIX sigaction)", "spans": [ [ 5385, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.66, "crit": 2, "desc": "Write files (write)", "spans": [ [ 4745, 5 ] ] }, { "id": "metadata/binary/linking/static::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "spans": [ [ 1211648, 7 ] ] }, { "id": "micro-behaviors/fs/memory/mmap::mmap64-fn", "conf": 0.66, "crit": 2, "desc": "Maps files or devices into memory", "spans": [ [ 5435, 6 ] ] }, { "id": "objectives/command-and-control/dropper/keywords::payload", "conf": 0.6, "crit": 1, "desc": "payload keyword", "spans": [ [ 127807, 7 ] ] }, { "id": "micro-behaviors/process/terminate/signal::_exit", "conf": 0.4, "crit": 2, "desc": "Terminates process immediately without cleanup", "spans": [ [ 5176, 4 ] ] }, { "id": "micro-behaviors/os/env/access::native-environ-reference", "conf": 0.75, "crit": 2, "desc": "Direct environ[] global access", "spans": [ [ 5154, 7 ] ] }, { "id": "metadata/binary/linking/static::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "spans": [ [ 1211561, 7 ] ] }, { "id": "metadata/binary/metrics/structural::sentence-strings-20-plus", "conf": 0.9, "crit": 2, "desc": "Binary has 20+ sentence strings", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 488345, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "spans": [ [ 79940, 4 ], [ 81189, 3 ], [ 81206, 3 ], [ 86501, 3 ], [ 89372, 4 ], [ 92931, 4 ], [ 95536, 3 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-40", "conf": 1.0, "crit": 1, "desc": "Binary has 40+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/handle::fcntl", "atk": "T1083", "mbc": "E1083", "conf": 0.4, "crit": 2, "desc": "File descriptor manipulation and control", "spans": [ [ 4774, 5 ] ] }, { "id": "micro-behaviors/mem/protect/modify::mprotect-import", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "Imports mprotect memory protection", "spans": [ [ 5657, 8 ] ] }, { "id": "micro-behaviors/dylib/enumerate::dl-iterate-phdr", "crit": 2, "desc": "Iterate shared object list", "spans": [ [ 4520, 15 ], [ 1264196, 15 ] ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "spans": [ [ 94275, 9 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 94824, 26 ] ] }, { "id": "objectives/credential-access/capture/sudo-pty::sudo-binary-exec-target", "atk": "T1056.002", "conf": 0.6, "crit": 3, "desc": "References real sudo binary path to wrap", "spans": [ [ 96544, 13 ] ] }, { "id": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "conf": 0.95, "crit": 2, "desc": "Joystick, gamepad, or DirectInput keyword", "spans": [ [ 131607, 6 ] ] }, { "id": "metadata/binary/metrics/structural::many-strings-large-elf", "conf": 0.9, "crit": 2, "desc": "Large ELF with 500+ strings", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setgid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setgid)", "spans": [ [ 5196, 6 ] ] }, { "id": "micro-behaviors/os/random/crypto::dev-random", "conf": 0.7, "crit": 2, "desc": "/dev/random access", "spans": [ [ 130727, 11 ], [ 130744, 11 ], [ 1008027, 11 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-base", "conf": 0.66, "crit": 2, "desc": "Create directories", "spans": [ [ 4637, 5 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 95804, 3 ] ] }, { "id": "micro-behaviors/os/signal/handler::abort", "conf": 0.9, "crit": 2, "desc": "Abort program execution", "spans": [ [ 5325, 5 ] ] }, { "id": "micro-behaviors/process/create/setsid::symbol-text", "mbc": "F0003", "conf": 0.75, "crit": 3, "desc": "setsid symbol text", "spans": [ [ 5218, 6 ] ] }, { "id": "metadata/lang/compiler/systems::rust-src-path", "conf": 0.85, "crit": 2, "desc": "Rust source file path (.rs)", "spans": [ [ 81401, 9 ], [ 81594, 12 ], [ 81678, 10 ], [ 81794, 9 ], [ 81883, 9 ], [ 81930, 10 ], [ 82096, 9 ], [ 82176, 10 ] ] }, { "id": "micro-behaviors/process/fd/dup::dup", "crit": 2, "desc": "Duplicate file descriptor", "spans": [ [ 5321, 3 ] ] }, { "id": "metadata/binary/metrics/threshold::many-sections-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ sections (installer/packer)", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::procfs-path-reference", "conf": 0.4, "crit": 2, "desc": "/proc fs path in native binary", "spans": [ [ 820331, 9 ], [ 820339, 15 ], [ 998392, 14 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "atk": "T1082", "mbc": "E1082", "conf": 0.3, "crit": 2, "desc": "x86_64 architecture string", "spans": [ [ 82317, 6 ], [ 1308476, 6 ], [ 1407564, 6 ], [ 1407632, 6 ] ] }, { "id": "micro-behaviors/fs/link/symlink::symlink-resolve", "conf": 0.66, "crit": 2, "desc": "Resolve symbolic links to canonical", "spans": [ [ 5442, 8 ] ] }, { "id": "objectives/privilege-escalation/exploit/kernel::suid-binary-target", "atk": "T1068", "mbc": "E1068", "conf": 0.85, "crit": 1, "desc": "Targets a setuid system binary", "spans": [ [ 96544, 13 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-version-string", "conf": 0.8, "crit": 2, "desc": "libc version string pattern", "spans": [ [ 5944, 5 ], [ 1288283, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-30", "conf": 1.0, "crit": 1, "desc": "Binary has 30+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 4572, 4 ] ] }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "conf": 0.7, "crit": 1, "desc": "ELF symbol tables stripped from binary", "spans": [ [ 0, 42 ] ] }, { "id": "micro-behaviors/process/identity/query::getpid", "conf": 0.3, "crit": 2, "desc": "Get process ID", "spans": [ [ 4795, 6 ] ] }, { "id": "micro-behaviors/process/control/wait::waitpid", "conf": 0.66, "crit": 2, "desc": "Wait for child process state", "spans": [ [ 5299, 7 ] ] }, { "id": "metadata/file/metrics::concealed-payload-mass-8k", "conf": 0.85, "crit": 1, "desc": "High-entropy region mass over 8KB", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/setsid::import", "mbc": "F0003", "conf": 1.0, "crit": 1, "desc": "setsid() function import", "spans": [ [ 5218, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-20", "conf": 1.0, "crit": 1, "desc": "Binary has 20+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-25", "conf": 1.0, "crit": 1, "desc": "Binary has 25+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/os/random/crypto::getrandom", "conf": 0.8, "crit": 2, "desc": "getrandom syscall", "spans": [ [ 5466, 9 ], [ 1263527, 9 ], [ 1263614, 9 ], [ 1286257, 9 ], [ 1289293, 9 ], [ 1298458, 9 ], [ 1298516, 9 ], [ 1298597, 9 ] ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setuid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setuid)", "spans": [ [ 5203, 6 ] ] }, { "id": "micro-behaviors/os/sysinfo/config::sysconf", "atk": "T1082", "mbc": "E1082", "conf": 0.4, "crit": 2, "desc": "Query system configuration information", "spans": [ [ 5259, 7 ] ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "spans": [ [ 94807, 13 ], [ 106006, 128 ], [ 112540, 6 ] ] }, { "id": "micro-behaviors/process/tty/terminal::isatty", "crit": 2, "desc": "Detect if running in terminal (isatty)", "spans": [ [ 4498, 6 ] ] }, { "id": "metadata/binary/linking/runtime::getauxval-ref", "conf": 0.3, "crit": 2, "desc": "getauxval function reference", "spans": [ [ 5609, 9 ] ] }, { "id": "metadata/lang/compiler/systems::unwrap-failed", "conf": 0.85, "crit": 2, "desc": "Rust unwrap failure message", "spans": [ [ 137915, 128 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 4769, 4 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 95803, 5 ] ] }, { "id": "metadata/lang/compiled::unwind-resume-symbol", "crit": 1, "desc": "_Unwind_Resume exception-unwinding symbol", "spans": [ [ 4456, 13 ] ] }, { "id": "metadata/binary/linking/runtime::interpreter", "conf": 1.0, "crit": 2, "desc": "ELF program interpreter metadata" }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.9, "crit": 1, "desc": "Binary high overall entropy (packed/encrypted)", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.66, "crit": 2, "desc": "Process forking", "spans": [ [ 4834, 4 ] ] }, { "id": "metadata/lang/compiler/systems::rustc-path", "conf": 0.95, "crit": 2, "desc": "Rust compiler path in binary", "spans": [ [ 81314, 47 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawnp-import", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn PATH execution", "spans": [ [ 5162, 12 ] ] }, { "id": "metadata/binary/linking/static::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "spans": [ [ 1211799, 8 ] ] }, { "id": "micro-behaviors/os/signal/handler::signal", "conf": 0.9, "crit": 2, "desc": "Install signal handler", "spans": [ [ 5225, 6 ] ] }, { "id": "micro-behaviors/os/random/crypto::urandom", "conf": 1.0, "crit": 2, "desc": "Access /dev/urandom", "spans": [ [ 896470, 12 ] ] }, { "id": "micro-behaviors/process/create/direct::pipe-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "POSIX pipe creation symbol", "spans": [ [ 5267, 5 ] ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "Shared library binds dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "spans": [ [ 130978, 7 ], [ 998367, 7 ], [ 998398, 7 ] ] }, { "id": "metadata/binary/metrics/threshold::large-binary-500k", "conf": 1.0, "crit": 1, "desc": "Binary is 500KB+", "spans": [ [ 0, 43 ] ] }, { "id": "metadata/binary/linking/runtime::needed-lib", "conf": 1.0, "crit": 2, "desc": "ELF needed library metadata" }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 94824, 26 ] ] }, { "id": "metadata/binary/metrics/size::large-file-1mb", "conf": 1.0, "crit": 2, "desc": "File larger than 1MB", "spans": [ [ 0, 43 ] ] }, { "id": "micro-behaviors/fs/path/system::system-lib64", "conf": 0.66, "crit": 2, "desc": "Reference to /lib64", "spans": [ [ 736, 27 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "conf": 0.3, "crit": 2, "desc": "chdir syscall symbol", "spans": [ [ 4594, 5 ] ] }, { "id": "objectives/credential-access/capture/sudo-pty::execvp-symbol", "atk": "T1056.002", "conf": 0.6, "crit": 1, "desc": "execvp child-exec symbol", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "crit": 2, "desc": "Duplicate file descriptor (I/O redirection)", "spans": [ [ 5181, 4 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/crypto/library/provider::openssl-static-keys", "conf": 0.8, "crit": 2, "desc": "OpenSSL/BoringSSL static key markers", "spans": [ [ 128449, 11 ] ] }, { "id": "metadata/binary/anomaly/format::elf-relacount-present", "conf": 0.95, "crit": 2, "desc": "ELF declares DT_RELACOUNT", "spans": [ [ 0, 23 ] ] }, { "id": "metadata/binary/linking/runtime::imports-tls-get-addr", "conf": 1.0, "crit": 2, "desc": "Imports __tls_get_addr from the dynamic loader", "spans": [ [ 4507, 12 ] ] }, { "id": "micro-behaviors/fs/path/config/system::config-etc", "conf": 0.66, "crit": 2, "desc": "Reference to /etc configuration files", "spans": [ [ 96699, 5 ], [ 96720, 5 ] ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 2, "desc": "Read symbolic link target path", "spans": [ [ 5451, 8 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-legacy64", "conf": 0.8, "crit": 3, "desc": "Read file status and metadata (legacy 64-bit)", "spans": [ [ 5273, 7 ], [ 5415, 7 ], [ 5423, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "atk": "T1106", "conf": 0.82, "crit": 3, "desc": "POSIX spawn attribute control", "spans": [ [ 4910, 20 ], [ 4994, 25 ], [ 5020, 24 ], [ 5078, 23 ], [ 5124, 29 ] ] }, { "id": "metadata/lang/compiled::gimli-crate", "conf": 0.9, "crit": 2, "desc": "Rust gimli crate (DWARF parsing)", "spans": [ [ 81908, 14 ] ] }, { "id": "micro-behaviors/dylib/library/libc::glibc-ref", "conf": 0.3, "crit": 2, "desc": "glibc reference", "spans": [ [ 1288283, 5 ] ] }, { "id": "metadata/lang/compiler/systems::expect-failed", "conf": 0.85, "crit": 2, "desc": "Rust expect failure message", "spans": [ [ 106006, 128 ], [ 119972, 91 ], [ 128342, 128 ], [ 133156, 128 ] ] }, { "id": "micro-behaviors/fs/memory/mmap::munmap", "conf": 0.66, "crit": 2, "desc": "Unmap files from memory", "spans": [ [ 4536, 6 ] ] }, { "id": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "conf": 0.76, "crit": 1, "desc": "Go allocation symbol bytes", "spans": [ [ 81369, 7 ] ] }, { "id": "metadata/binary/linking/static::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "spans": [ [ 1211602, 7 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "atk": "T1106", "conf": 0.86, "crit": 3, "desc": "POSIX spawn file actions", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ] ] }, { "id": "metadata/lang/compiled::addr2line-crate", "conf": 0.9, "crit": 2, "desc": "Rust addr2line backtrace symbolizer crate", "spans": [ [ 84035, 18 ] ] }, { "id": "metadata/file/metrics::peak-region-cipher-entropy", "conf": 0.85, "crit": 1, "desc": "Peak 1KB region at cipher entropy", "spans": [ [ 141312, 5120 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 4764, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/open::open64", "conf": 0.66, "crit": 2, "desc": "Open files (legacy 64-bit)", "spans": [ [ 4621, 6 ] ] }, { "id": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "conf": 0.8, "crit": 2, "desc": "Low ratio of sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 BIND request opcode", "spans": [ [ 924304, 8 ] ] }, { "id": "metadata/package/metrics::import-count-under-80", "conf": 0.84, "crit": 2, "desc": "Large binary with few DLL dependencies", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/process/create/local-exec::main-arch-payload-name", "conf": 0.96, "crit": 1, "desc": "main_* architecture payload name", "spans": [ [ 1286861, 5 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.3, "crit": 2, "desc": "Delete files", "spans": [ [ 5408, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.3, "crit": 2, "desc": "Delete files by fd/path", "spans": [ [ 5579, 8 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/os/signal/handler::sig-ign-sighup-x64", "conf": 0.4, "crit": 1, "desc": "SIGHUP signal ignore pattern (x86_64)", "spans": [ [ 246892, 29 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "spans": [ [ 5683, 8 ] ] }, { "id": "metadata/hardening/missing::elf-interpreter-section-name", "conf": 0.9, "crit": 2, "desc": "ELF interpreter section name", "spans": [ [ 1211561, 7 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-wget-token", "conf": 0.86, "crit": 1, "desc": "Interleaved wget command token", "spans": [ [ 113452, 11 ], [ 1362572, 11 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.9, "crit": 1, "desc": "SOCKS5 client greeting bytes", "spans": [ [ 245865, 8 ] ] }, { "id": "metadata/hardening/missing::elf-dynamic-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynamic section name", "spans": [ [ 1211799, 8 ] ] }, { "id": "micro-behaviors/os/env/vars/access::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "spans": [ [ 4696, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 4787, 7 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "conf": 0.66, "crit": 2, "desc": "Read own executable path (/proc/self/exe)", "spans": [ [ 130972, 14 ], [ 998392, 14 ] ] }, { "id": "metadata/hardening/missing::elf-dynsym-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynsym section name", "spans": [ [ 1211602, 7 ] ] }, { "id": "metadata/hardening/missing::elf-dynstr-section-name", "conf": 0.9, "crit": 2, "desc": "ELF dynstr section name", "spans": [ [ 1211648, 7 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-2000", "conf": 0.9, "crit": 1, "desc": "High plaintext string count", "spans": [ [ 0, 29 ] ] }, { "id": "well-known/malware/botnet/mozi::xor-pattern-2", "conf": 1.0, "crit": 1, "desc": "XOR loop pattern variant 2", "spans": [ [ 815131, 11 ] ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "conf": 0.6, "crit": 1, "desc": "SOCKS5 UDP ASSOCIATE request opcode", "spans": [ [ 927429, 8 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "conf": 0.66, "crit": 3, "desc": "Uses fdopendir", "spans": [ [ 5559, 9 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "conf": 0.66, "crit": 3, "desc": "Uses readdir64", "spans": [ [ 5569, 9 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6, "crit": 3, "desc": "ELF debug stripped with .symtab", "spans": [ [ 0, 38 ] ] }, { "id": "objectives/command-and-control/dropper/delivery/fetch-exec::interleaved-tftp-token", "conf": 0.86, "crit": 1, "desc": "Interleaved tftp command token", "spans": [ [ 81591, 12 ], [ 99621, 11 ], [ 1242674, 12 ], [ 1246925, 13 ], [ 1275519, 11 ], [ 1335837, 13 ], [ 1335969, 13 ], [ 1343139, 13 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 4802, 7 ] ] }, { "id": "objectives/evasion/indicator-removal/cleanup::shell-exec-wrapper", "atk": "T1059", "conf": 0.8, "crit": 1, "desc": "Shell execution wrapper", "spans": [ [ 97485, 22 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 5232, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn with FD actions", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ], [ 5162, 12 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.66, "crit": 2, "desc": "Write files", "spans": [ [ 4745, 5 ] ] }, { "id": "objectives/persistence/system/daemon/init::daemonize-self-reexec", "atk": "T1543", "mbc": "F0006", "crit": 2, "desc": "Daemonizes via self-exe re-exec + fork/setsid", "spans": [ [ 5218, 6 ], [ 130972, 14 ], [ 998392, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 94824, 26 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 94807, 13 ], [ 94824, 26 ], [ 106006, 128 ], [ 112540, 6 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.3, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "spans": [ [ 4834, 4 ], [ 5218, 6 ], [ 94275, 9 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-core", "conf": 0.66, "crit": 2, "desc": "Core directory iteration symbols", "spans": [ [ 5559, 9 ], [ 5569, 9 ], [ 5683, 8 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 4572, 4 ] ] }, { "id": "metadata/lang/compiler/systems::rust-binary", "conf": 0.95, "crit": 2, "desc": "Rust-compiled binary", "spans": [ [ 81314, 47 ], [ 81401, 9 ], [ 81594, 12 ], [ 81678, 10 ], [ 81794, 9 ], [ 81883, 9 ], [ 81930, 10 ], [ 82096, 9 ] ] }, { "id": "metadata/lang/compiled::rust-backtrace-symbolizer", "conf": 0.95, "crit": 2, "desc": "Rust std backtrace symbolizer stack", "spans": [ [ 81908, 14 ], [ 84035, 18 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 2, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 4572, 4 ], [ 4745, 5 ] ] }, { "id": "micro-behaviors/process/create/direct::child-stdio-pipe-redirect", "atk": "T1106", "conf": 0.88, "crit": 3, "desc": "Child process stdio pipe redirect", "spans": [ [ 4839, 36 ], [ 4876, 33 ], [ 4931, 29 ], [ 4961, 32 ], [ 5045, 32 ], [ 5162, 12 ], [ 5267, 5 ] ] }, { "id": "micro-behaviors/ui/help::documented-cli-binary", "conf": 0.85, "crit": 1, "desc": "Documented command line program", "spans": [ [ 0, 22 ], [ 94824, 26 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "fdD", "ln": 1, "addr": 0 }, { "b": "lVl{?A+Pf1Brz#0diHx1gbZmPzE^s0v{%EkgDb", "ln": 2, "addr": 3 }, { "b": "ra]#!aAhvtxl4A$azC)tw].D]aAIEkBA.elwJy@Vz/)gjvqWidwN]H@BAh88B-.gqx(\u003eFazE+zsAV/jqwnbU3", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 34, "z": 4, "cf": 0.8 } ], "ln": 3, "addr": 34 }, { "b": "x(\u003eFuzE^s0aARpdaARgnzf3?rw/#hewGTGrruK!yzE)\u0026%y-(L%vR/:*awuGVwO#N2ayPslAckSax(^%0wftub", "ln": 4, "addr": 103 }, { "b": "BzbkdmSJ6Kax9h\u003cBA.elwGTDXB-7.#BzkVhefFIrBzblaaA?spB7]MgatUcUw/#hewGTVXv}xL0wH[%xAS", "ln": 5, "addr": 172 }, { "b": "B-RapB97}Ni=GaTv}x.5iY.QPz/6u1zE+pvq/(L:z*:X", "ln": 16, "addr": 461 }, { "b": "", "ln": 17, "addr": 497 }, { "b": "fe1EcLZ}+TFfmf)zEENhaAg+hxMCrQLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z", "n": [ { "c": 2, "d": "Box drawing text banner", "i": "metadata/file/format::box-drawing-banner", "o": 521, "z": 165, "cf": 0.9 } ], "ln": 18, "addr": 498 }, { "b": "", "ln": 19, "addr": 687 }, { "b": "v@DmaBrA\u003eHqBaURnLRq?arS1LBAeG!ar\u0026EYB8\u0026{yx(kOjB-H[mi@", "ln": 20, "addr": 688 }, { "b": "", "ln": 33, "addr": 1392 }, { "b": "v@DmaBrBTXqCoF=q:\u003cU)mOcoxiV]K(B98BBjS\u003e}4wPRAnwO(10xjS-uz/PV8e]$PCb0b", "ln": 34, "addr": 1393 }, { "b": "v@DmaBrA\u003eoq^R\u003c\u003enLzJVlp1KsiV]K(B98BBjS\u003e}4BzU$IvrDQ0eOe^gA+w@nvpBp4i@", "n": [ { "c": 1, "d": "tmp keyword", "i": "metadata/file/string/file::tmp", "o": 1480, "z": 3, "cf": 0.2 } ], "ln": 35, "addr": 1448 }, { "b": "v@DmaBrBTXqCoF=q:\u003cU)r83gIarS1LBAeG!ar\u0026EIByM$nzdN:2wInmCA+]nsB7GCCBzU$vi@", "ln": 36, "addr": 1502 }, { "b": "", "ln": 37, "addr": 1560 }, { "b": "arR^HA+e({zAn[Hz/oCy", "ln": 149, "addr": 4625 }, { "b": "", "ln": 150, "addr": 4642 }, { "b": "arR^Hfe1$3qE}C2wPI^aC4z!pwPhNex([olC{46DwObU3wPF#az/M$ey?$kkvpK7YxjVcbx(k5qz/PV8e]$PC", "n": [ { "c": 1, "d": "Source/repository/workspace target-word component", "i": "objectives/impact/destroy/keywords::destructive-code-target", "o": 4662, "z": 10, "cf": 1.0 } ], "ln": 151, "addr": 4643 }, { "b": "arR^Hbu[O%xddOmzF77Par\u003e\u0026qxjU%jCw?IrwfJEd", "ln": 152, "addr": 4712 }, { "b": "arR^HA+e({zEmQaA+]nEayYncy+b", "ln": 153, "addr": 4745 }, { "b": "arR^HarR^He[O*lBy/FvD#KDQDJ", "ln": 264, "addr": 9973 }, { "b": "arR^HarR^HarR^Hx\u003ewFhC42i3wmoN\u003euVo^[c#ZQTDJ", "ln": 265, "addr": 9995 }, { "b": "arR^HarR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8XzGYD8x\u003eeu9vpK7YxjSi6vqPM#d06frAbYx0dlnO#EiHi+A49\u003c", "n": [ { "c": 1, "d": "String literal contains invalid word", "i": "metadata/file/format::vocab-invalid", "o": 10060, "z": 7, "cf": 0.97 } ], "ln": 266, "addr": 10029 }, { "b": "arR^HarR^HarR^HarR^Hw)]H%wD", "ln": 267, "addr": 10101 }, { "b": "arR^HarR^HarR^HEir9qB7DFv", "ln": 268, "addr": 10123 }, { "b": "arR^Hw]zYjvRGZ5x(k4utr#m!l0(@IpaNI:k%[vjpg3sVpaNI^ryxR\u0026lp\u003c{6axg=#uQvsVefEU/uQvsVefE?+uQvsVt{aE", "ln": 280, "addr": 10493 }, { "b": "arR^HarR^Hx\u003ewFhB97}Ni=FIHxGwgJvrufzi=nIMc$l[ddk2gRx(!xqc[co=", "ln": 281, "addr": 10569 }, { "b": "arR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8Uvrt{]iV@DOADL#owN(])x(mv1C{40yBrCglB-7.JaBwIXefFzozyET", "n": [ { "c": 1, "d": "String literal contains required word", "i": "metadata/file/format::vocab-required", "o": 10652, "z": 8, "cf": 0.97 } ], "ln": 282, "addr": 10618 }, { "b": "arR^HarR^HarR^HB97}Ni=GaTv}x.5iYZ?%x(\u003e:Tdlv", "ln": 283, "addr": 10690 }, { "b": "arR^HarR^HEe", "ln": 284, "addr": 10725 }, { "b": "arR^HzEEx[iV}vyA+PA7ec", "ln": 302, "addr": 11444 }, { "b": "arR^HC4CYnx(v(Iax9x5x(mMm", "ln": 303, "addr": 11462 }, { "b": "arR^HA+fidiV}vyA+PA7ec", "n": [ { "c": 1, "d": "Codebase/repository target word: repo", "i": "objectives/impact/destroy/keywords::target-codebase--repo", "o": 11487, "z": 4, "cf": 0.88 } ], "ln": 304, "addr": 11483 }, { "b": "arR^Hfe1$3b2fs8zE[2yar\u003c/faA.ToA:-G\u0026efDc8a%pAmCw.5lvpS}2ar\u003cYcaAz4czGx]dy?%", "ln": 305, "addr": 11501 }, { "b": "arR^HB97\u0026jB-PO^q/)4]zF7H", "ln": 306, "addr": 11560 }, { "b": "fe1$3lVl*XB-.gqx(n0lvqG:5B97\u0026jB-PO^pcAGaCpT\u003epj-$ZRA:-G\u0026efEtzwn=Wfxl4A\u003ewH[%4j-UaFzGx]dy?$Z", "ln": 309, "addr": 11583 }, { "b": "w]n-gyId0}ByxolB0${mzdL:JcuBoHefF?wCvbJ8AYLr\u0026B98BKat2=1q/)4]zF78s", "ln": 310, "addr": 11655 }, { "b": "arR^Hy?mYhz/{dAjS[//wi8+\u003cA=kD0B8%x6lVl*UvqYQpi=nIMc@rh%o*IJYlp\u003c{3", "n": [ { "c": 3, "d": "Builds process via Command::new", "i": "micro-behaviors/process/create/direct::rust-async-process", "o": 11736, "z": 13, "cf": 0.92 } ], "ln": 311, "addr": 11708 }, { "b": "arR^HarR^He[5^kB0$lpeM0Yyaz$R8wNc.", "ln": 312, "addr": 11761 }, { "b": "arR^HarR^He[F{zc)ztLuQmvVa$K\u0026XlN0@", "ln": 313, "addr": 11789 }, { "b": "arR^HarR^He]#bBz/{dIB97}Ni=GaTv}x.5iYZhYwnb%yi=F!LwN)hrdf", "ln": 314, "addr": 11817 }, { "b": "arR^HarR^He]#bBwPz/tB97}Ni=GaTv}x.5iYZhYwnb%yi=o7Ry:Z.Y", "ln": 315, "addr": 11863 }, { "b": "arR^HarR^He]L(OAclmJdlv", "n": [ { "c": 1, "d": "build.rs captures command output", "i": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "o": 11916, "z": 9, "cf": 0.88 } ], "ln": 316, "addr": 11908 }, { "b": "arR^Hy?mYhx(n0lvqG:\u003ewfs2TzddJ@xDRkoBrC]", "ln": 317, "addr": 11927 }, { "b": "arR^HarR^HpIRv%diJtpaA5(NByxolB1RJRv}f7\u003eB0@EWjW70n", "ln": 318, "addr": 11959 }, { "b": "fe1$3mRcWKxDPPvqxP{!v@2H=wGUY8w]w/nx\u003c\u0026bol1}DWB-.OBBrCKhA=U@jxd:", "ln": 440, "addr": 16354 }, { "b": "w]n-iwPI^aC4C2?B-F)HyIdYHaspq\u003eBAh8kxi=@eeJ$pTwN^\u00260yIcjRw]x\u003cQDJ", "ln": 441, "addr": 16405 }, { "b": "arR^Hy?mYhzfo}yA+frmy\u0026*^.axA5-iY.d\u0026Cpj[4", "n": [ { "c": 1, "d": "Command/result vocabulary pair", "i": "objectives/command-and-control/remote-command/keywords::command-result-word", "o": 16467, "z": 71, "cf": 0.4 } ], "ln": 442, "addr": 16455 }, { "b": "arR^Hw]zYjAbf8ex(k5jyIdYhDJ", "ln": 443, "addr": 16488 }, { "b": "arR^HarR^Hy?mYhz/{evB-X-?avy6:zddr)iY.d\u0026Cpk:SqBaURnLQY", "ln": 444, "addr": 16510 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HzEEx[auZ\u0026\u003ce{8bFz73?=Bz\u003eJcBAh8kxdbh\u003c", "ln": 457, "addr": 17016 }, { "b": "arR^HarR^HarR^HarR^HarR^HEe", "ln": 458, "addr": 17069 }, { "b": "arR^HarR^HarR^HarR^HEir9qB7DFdw/$]7zE\u003eCwByxiiB6\u003cc9Bz96Dr+lq)x(v(kdiJ%", "n": [ { "c": 1, "d": "WMI Version result field", "i": "objectives/discovery/host/fingerprint::version-field", "o": 17135, "z": 7, "cf": 0.9 } ], "ln": 459, "addr": 17091 }, { "b": "arR^HarR^HarR^HarR^HarR^Hx\u003ewG7wPP4[z/65lB$1K%az++fwIe4yy?W#tcPSR7e]C=Ac]0d[DJ", "ln": 460, "addr": 17147 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HC4CYnx(v(ijS[]2BAh8jc[c=\u003cz^NNcA+PA7c[dj", "ln": 461, "addr": 17209 }, { "b": "fe1$3m}D=+BzbkdA+fidB7]-mA^n^oaAg+0yHH\u003c!aA}mnazC.mByx04wN(]}A=k!qc$L2ze*8uFvpJ$@z/WHwCYW$meP@]]efDcBB-FVPe=", "ln": 473, "addr": 17489 }, { "b": "fe1%", "ln": 474, "addr": 17575 }, { "b": "fe1$3Aa9l[vqWiaB-.OBBrCpsaz+$avqGHbwmYZ\u003ezE^r@Brz$QqE%/=B7]-mA^n\u0026KfczE=Q0XOvZr\u003cgjXy3eWWiu.Dar\u003cY{AbP/iBz(hBa%pDsv\u003eGh.", "n": [ { "c": 3, "d": "Cyrillic script detection (Russian/Ukrainian)", "i": "metadata/file/profile/language::lang-russian", "o": 17634, "z": 14, "cf": 0.8 } ], "ln": 475, "addr": 17579 }, { "b": "fe1$3s7JH^z/Pu0awtdfk$\u003c%nlM*C*azbt0y?aVavqPN%ayPq4ayP8gvr(]pmq=:Ox(^@u", "ln": 476, "addr": 17672 }, { "b": "fe1%", "ln": 477, "addr": 17729 }, { "b": "arR^HarR^Hv@k:evrc0eA49\u003c", "ln": 602, "addr": 22373 }, { "b": "arR^HEe", "ln": 603, "addr": 22393 }, { "b": "arR^HzddJ@xDQ/4wg?}BvruTkc[co=", "n": [ { "c": 1, "d": "build.rs waits on command status", "i": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "o": 22412, "z": 9, "cf": 0.86 } ], "ln": 604, "addr": 22399 }, { "b": "arR^HarR^HpIRw1diH=qaAGeRBZ[])B8@-Uec", "ln": 605, "addr": 22424 }, { "b": "arR^HarR^Hmriz%wHO-+j%kg", "ln": 606, "addr": 22454 }, { "b": "arR^Hfe1CEA^n^HzY\u0026U6ByO#be(LUnnLR-JazbUjz6ht.BwcaLaAy[mave*}", "ln": 617, "addr": 22859 }, { "b": "arR^Hy?mYhB-IpvjS[uPA=2lbaT!KYEj]}}flgGBfgXI$l[Ze\u003eqBs2JmO+iVaves)uQ)W!oHh0Llp1KsefF[Exdk[", "ln": 618, "addr": 22908 }, { "b": "arR^Hy?mYhz/{evB-X-?avy6:zddr)iY.d\u0026CpjUBB-Ipxdf", "n": [ { "c": 3, "d": "Rust invokes curl or wget", "i": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "o": 22997, "z": 19, "cf": 0.82 } ], "ln": 619, "addr": 22980 }, { "b": "arR^HarR^He[5^kB0$lpePUIFefDb*eP1{veP+YzwG\u0026VFa#HL}asqkKy*wE", "ln": 620, "addr": 23018 }, { "b": "arR^HarR^He]#bBz/{dIq/(L:z-P{#x(ES]c[cO", "ln": 621, "addr": 23066 }, { "b": "arR^HarR^Hx\u003ewFhC42i3wmoN\u003euVo^[c$lR9wHO:HD(#)bA+c\u003ekz/fV9x(m#ucOD?@aBs", "ln": 654, "addr": 24255 }, { "b": "arR^HarR^HarR^HwPhW7zGGYjaT!J#k0y8TA=M8siV@cOC42i3wft\u00261v@2H=wGU(0zdK?qDWNm:\u0026^^moB8bGeAa%i5a$K\u003cCvrb{di@", "n": [ { "c": 1, "d": "String literal contains invalid word", "i": "metadata/file/format::vocab-invalid", "o": 24344, "z": 7, "cf": 0.97 } ], "ln": 655, "addr": 24310 }, { "b": "arR^HarR^HarR^HA+funA=90{z/fbF", "ln": 656, "addr": 24392 }, { "b": "arR^HarR^Hfe1CzAaJ]fp!KqBry]\u003eLazCZobT\u003e9)r8lymvR6d\u0026A+cw5B.LV5x(mMax\u003ewFteOeEbBrCpsaAIao", "ln": 737, "addr": 27183 }, { "b": "arR^HarR^Hx\u003ewG0wnccdDJ", "ln": 738, "addr": 27252 }, { "b": "arR^HarR^HarR^Hy?mYhwN]H%z/M%-aAITniYZ?\u0026B#?Wcvr9+ummoZDpF@w=", "n": [ { "c": 3, "d": "Rust environment variable lookup", "i": "micro-behaviors/os/env/access::std-env-var", "o": 27295, "z": 14, "cf": 0.86 } ], "ln": 739, "addr": 27270 }, { "b": "arR^HarR^HarR^HarR^He]L=qwO=B0d12xHaAITniYZ?\u0026B#?Wcvr9+ur.lj\u0026k$\u0026EKdf", "ln": 740, "addr": 27319 }, { "b": "arR^HarR^HarR^HarR^He{h5QA:-]]z/Ph@y\u0026:eoD%.mzb5Q?bzZ3/Qz^NNcA+PA7c[cPb", "ln": 741, "addr": 27373 }, { "b": "arR^HarR^HarR^HB97}Ni=GaTv}x.5iYZ?%x(\u003e:Tdlv", "ln": 977, "addr": 36130 }, { "b": "arR^HarR^HEe", "ln": 978, "addr": 36165 }, { "b": "arR^HarR^Hy?mYhCw?Irwm5!OA+doOnmuNMq!p5kq/)4]zF8cQjS[PIByO#bw]*0]mRMWIiY.g#wO@[$pF%\u003eOuSfx)uQ^QXmjxva", "n": [ { "c": 2, "d": "Rust file open call", "i": "micro-behaviors/fs/file/open::rust-file-open", "o": 36227, "z": 11, "cf": 0.86 } ], "ln": 979, "addr": 36175 }, { "b": "arR^HarR^HarR^HpIRv\u003cx(4ufau.[hx(u3[luM)rwNPaXAYMm0wP]Lmx(4uf", "ln": 980, "addr": 36256 }, { "b": "arR^HarR^HarR^HarR^He]kltwPGmG", "ln": 981, "addr": 36305 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1CTz/P(fv@@\u0026lwPhMgAb]J4x)p+twPw]jvpK7YxjSXrra]#!az\u003eLeBy/GlazbLjayL", "ln": 1344, "addr": 51425 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C+x)si1aA7\u003e7x\u003e7\u003c=y+4!KqxPW\u003eB97\u0026by-)}nwPzu8z/fbexKLZ?ay!?$aAIWnv}xjZ", "ln": 1345, "addr": 51500 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C(xLzo]aARpdaA8vnwPw]9vqfL0aMv{oaA}xtzfo]waz#ataz+$qwGV8nvpK6}z!pblxK}", "n": [ { "c": 2, "d": "Rust while loop", "i": "micro-behaviors/data/control-flow/loop::rust-while-loop", "o": 51600, "z": 6, "cf": 0.75 } ], "ln": 1346, "addr": 51577 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1CYvqGJ#Bzb98aA}:AyH}3cayPd#az(mxBrCEtBrCglA:@V6vqWhivrDPmaAhvjw[=F", "ln": 1347, "addr": 51656 }, { "b": "arR^HarR^HarR^HarR^HarR^Hfe1C^zGG!tvqWiaw[C:!x\u003c\u003e*2Aa9l(vp%c]z/M$zx\u003e7Y%C4CYnvj?", "ln": 1348, "addr": 51732 }, { "b": "", "ln": 1412, "addr": 54230 }, { "b": "arR^Hx\u003ewF$xKL^\u003ewN(]DjS(B3DJ", "ln": 1413, "addr": 54231 }, { "b": "arR^HarR^HAb]VgBzL?rc)B1^aA}:Ay?betwPP5eB0a[cA+eV\u0026C{4lGaARJAwmoN\u003ee*q??b0FgOa$^IGwO2:cdk27Fy?a}ydlv", "n": [ { "c": 1, "d": "String literal contains date word", "i": "metadata/file/format::vocab-date", "o": 54301, "z": 4, "cf": 0.97 } ], "ln": 1414, "addr": 54253 }, { "b": "arR^HarR^HA+funA=9@", "ln": 1415, "addr": 54332 }, { "b": "arR^HEe", "ln": 1416, "addr": 54348 }, { "b": "arR^HarR^HarR^He]#bBx(ks$ByY97iY.j]AaJMddjC", "ln": 1520, "addr": 58015 }, { "b": "arR^HarR^HarR^He]#bBz/{dIq/(L:z-P{%B.\u003e\u003exdjC", "ln": 1521, "addr": 58050 }, { "b": "arR^HarR^HarR^He]$#uCwX/Ti@", "n": [ { "c": 3, "d": "spawn API call", "i": "micro-behaviors/process/create/exec::spawn-api-call", "o": 58098, "z": 6, "cf": 0.85 } ], "ln": 1522, "addr": 58085 }, { "b": "", "ln": 1523, "addr": 58107 }, { "b": "arR^HarR^HzddJ@xDQ!#x(4r!Ab](baBs", "ln": 1524, "addr": 58108 }, { "b": "arR^HDJ", "ln": 1548, "addr": 59050 }, { "b": "arR^HarR^HpIRw1diJtpaAGeRBZ[])B8@-Uau.[hAb]VgBzL?rc)y\u0026sj%k5/A+]nsB7GCoB-p(1By!#na$k5", "ln": 1549, "addr": 59056 }, { "b": "arR^HarR^HpIRv=diH=qaz2Ijx(n3ezxQzLk0zdMmriA!AYLs:B.2zkzfv4lvqfK?wfu8fwO@S5x(mu}x)KGhxcqzpA+]nsB7GCCa$k5", "n": [ { "c": 1, "d": "sudo command keyword", "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "o": 59163, "z": 4, "cf": 0.7 } ], "ln": 1550, "addr": 59124 }, { "b": "arR^HarR^Hmriz%wHO-+j%jAQA+PAky\u0026gyAb0FgOavQr\u003ez/N(YB9h2iaz(oAv@DHawft=dBrC47aAIHgCwZ#5iV@=$a$K\u003cFdj+", "ln": 1551, "addr": 59208 }, { "b": "arR^HEe", "ln": 1552, "addr": 59287 }, { "b": "Ee", "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 118304, "z": 52, "cf": 1.0 } ], "ln": 1553, "addr": 59293 } ], "depth": 5, "facts": { "imp": [ [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "pkg.starts_with" ], [ "", "pkg.contains" ], [ "", "pkg.contains" ], [ "", "pkg.chars.all" ], [ "", "pkg.chars" ], [ "", "c.is_alphanumeric" ], [ "", "\"@._+-/\".contains" ], [ "", "packages.iter.filter.cloned.collect" ], [ "", "packages.iter.filter.cloned" ], [ "", "packages.iter.filter" ], [ "", "packages.iter" ], [ "", "validate_pkg" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "meta.file_type.is_symlink" ], [ "", "meta.file_type" ], [ "", "o.status.success" ], [ "", "s.split_whitespace.nth.unwrap_or.to_string" ], [ "", "s.split_whitespace.nth.unwrap_or" ], [ "", "s.split_whitespace.nth" ], [ "", "s.split_whitespace" ], [ "", "\"N\".to_string" ], [ "", "installed.is_empty" ], [ "", "\"N\".to_string" ], [ "", "\"R\".to_string" ], [ "", "\"U\".to_string" ], [ "", "\"R\".to_string" ], [ "", "\"D\".to_string" ], [ "", "p.repo.is_empty" ], [ "", "format" ], [ "", "format" ], [ "", "status.green.bold.to_string" ], [ "", "status.green.bold" ], [ "", "status.green" ], [ "", "status.yellow.bold.to_string" ], [ "", "status.yellow.bold" ], [ "", "status.yellow" ], [ "", "status.red.bold.to_string" ], [ "", "status.red.bold" ], [ "", "status.red" ], [ "", "status.cyan.bold.to_string" ], [ "", "status.cyan.bold" ], [ "", "status.cyan" ], [ "", "vec" ], [ "", "pkgs.iter.map.collect" ], [ "", "pkgs.iter.map" ], [ "", "pkgs.iter" ], [ "", "args.extend_from_slice" ], [ "", "output.status.success" ], [ "", "stdout.lines.filter.map.collect" ], [ "", "stdout.lines.filter.map" ], [ "", "stdout.lines.filter" ], [ "", "stdout.lines" ], [ "", "l.is_empty" ], [ "", "line.splitn" ], [ "", "parts.next.unwrap_or.to_string" ], [ "", "parts.next.unwrap_or" ], [ "", "parts.next" ], [ "", "parts.next.unwrap_or.to_string" ], [ "", "parts.next.unwrap_or" ], [ "", "parts.next" ], [ "", "name.contains" ], [ "", "name.splitn" ], [ "", "p.next.unwrap_or.to_string" ], [ "", "p.next.unwrap_or" ], [ "", "p.next" ], [ "", "p.next.unwrap_or.to_string" ], [ "", "p.next.unwrap_or" ], [ "", "p.next" ], [ "", "name.clone" ], [ "", "pkg_status" ], [ "", "infos.is_empty" ], [ "", "Some" ], [ "", "p.split.last.unwrap_or.to_string" ], [ "", "p.split.last.unwrap_or" ], [ "", "p.split.last" ], [ "", "p.split" ], [ "", "probe_official" ], [ "", "found_names.insert" ], [ "", "info.name.clone" ], [ "", "found.push" ], [ "", "pkgs.iter.filter.collect" ], [ "", "pkgs.iter.filter" ], [ "", "pkgs.iter" ], [ "", "found_names.contains" ], [ "", "bare_of" ], [ "", "probe_official" ], [ "", "infos.is_empty" ], [ "", "found.append" ], [ "", "missing.push" ], [ "", "pkg.clone" ], [ "", "pkg.clone" ], [ "", "stdout.lines" ], [ "", "line.starts_with" ], [ "", "line.split.nth" ], [ "", "line.split" ], [ "", "v.trim.to_string" ], [ "", "v.trim" ], [ "", "line.starts_with" ], [ "", "line.split.nth" ], [ "", "line.split" ], [ "", "v.trim.to_string" ], [ "", "v.trim" ], [ "", "pkg_status" ], [ "", "result.push" ], [ "", "\"aur\".to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "out.status.success" ], [ "", "Some" ], [ "", "stdout.lines" ], [ "", "line.starts_with" ], [ "", "line.starts_with" ], [ "", "line.splitn.nth" ], [ "", "line.splitn" ], [ "", "val.trim.to_string" ], [ "", "val.trim" ], [ "", "r.is_empty" ], [ "", "Some" ], [ "", "pacman_c" ], [ "", "first_repo" ], [ "", "pacman_c" ], [ "", "first_repo" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "get_pkg_repo" ], [ "", "format" ], [ "", "forced_prefix.unwrap_or" ], [ "", "format" ], [ "", "bare.to_string" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "println" ], [ "", "pkgs.len" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "pkgs.iter.enumerate" ], [ "", "pkgs.iter" ], [ "", "pkgs.len" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "pkgs.iter.enumerate" ], [ "", "pkgs.iter" ], [ "", "format_atom.green.bold.to_string" ], [ "", "format_atom.green.bold" ], [ "", "format_atom.green" ], [ "", "format_atom" ], [ "", "total.to_string.yellow.bold.to_string" ], [ "", "total.to_string.yellow.bold" ], [ "", "total.to_string.yellow" ], [ "", "total.to_string" ], [ "", "total.to_string.green.bold.to_string" ], [ "", "total.to_string.green.bold" ], [ "", "total.to_string.green" ], [ "", "total.to_string" ], [ "", "cmd.args" ], [ "", "cmd.arg" ], [ "", "cmd.status" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "format" ], [ "", "out.status.success" ], [ "", "text.lines" ], [ "", "line.trim" ], [ "", "line.starts_with" ], [ "", "\"pkgver = \".len" ], [ "", "\"?\".to_string" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "pkgs.iter.filter_map.collect" ], [ "", "pkgs.iter.filter_map" ], [ "", "pkgs.iter" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "validate_pkg" ], [ "", "bare.contains" ], [ "", "eprintln" ], [ "", "abs_get_version" ], [ "", "pkg_status" ], [ "", "Some" ], [ "", "bare.to_string" ], [ "", "\"abs\".to_string" ], [ "", "pkg_infos.is_empty" ], [ "", "format" ], [ "", "build_base.exists" ], [ "", "pkg_infos.iter.enumerate" ], [ "", "pkg_infos.iter" ], [ "", "\"\u003e\u003e\u003e\".green.bold" ], [ "", "\"\u003e\u003e\u003e\".green" ], [ "", "build_base.join" ], [ "", "pkg_dir.starts_with" ], [ "", "eprintln" ], [ "", "pkg_dir.exists" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "pkg_dir.join" ], [ "", "trunk_dir.exists" ], [ "", "pkg_dir.clone" ], [ "", "\"nano\".to_string" ], [ "", "build_dir.join" ], [ "", "vec" ], [ "", "makepkg_args.push" ], [ "", "makepkg_args.push" ], [ "", "makepkg_args.push" ], [ "", "s.success" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "args.get.map.unwrap_or" ], [ "", "args.get.map" ], [ "", "args.get" ], [ "", "args.get.map.unwrap_or" ], [ "", "args.get.map" ], [ "", "args.get" ], [ "", "args.get.or_else.map.unwrap_or" ], [ "", "args.get.or_else.map" ], [ "", "args.get.or_else" ], [ "", "args.get" ], [ "", "args.get" ], [ "", "s.lines" ], [ "", "line.splitn" ], [ "", "p.next" ], [ "", "p.next" ], [ "", "print" ], [ "", "n.to_str" ], [ "", "portageq_shim" ], [ "", "print_help" ], [ "", "check_binaries" ], [ "", "eprintln" ], [ "", "cli.packages.iter.any" ], [ "", "cli.packages.iter" ], [ "", "validate_packages" ], [ "", "cli.packages.iter.filter.cloned" ], [ "", "cli.packages.iter.filter" ], [ "", "cli.packages.iter" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "probe_official.is_some" ], [ "", "probe_official" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "target_pkgs.is_empty" ], [ "", "run_cmd" ], [ "", "regen_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "l.trim.is_empty" ], [ "", "l.trim" ], [ "", "l.trim.split.last.unwrap_or.to_string" ], [ "", "l.trim.split.last.unwrap_or" ], [ "", "l.trim.split.last" ], [ "", "l.trim.split" ], [ "", "l.trim" ], [ "", "eprintln" ], [ "", "l.trim.to_string" ], [ "", "l.trim" ], [ "", "l.is_empty" ], [ "", "installed.into_iter.filter.collect" ], [ "", "installed.into_iter.filter" ], [ "", "installed.into_iter" ], [ "", "world_bare.contains" ], [ "", "to_remove.is_empty" ], [ "", "vec" ], [ "", "args.push" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "vec" ], [ "", "args.push" ], [ "", "run_cmd" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "add_to_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "remove_from_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "vec" ], [ "", "s_args.push" ], [ "", "run_cmd" ], [ "", "run_cmd" ], [ "", "orphans_str.lines.map.filter.collect" ], [ "", "orphans_str.lines.map.filter" ], [ "", "orphans_str.lines.map" ], [ "", "orphans_str.lines" ], [ "", "s.trim.to_string" ], [ "", "s.trim" ], [ "", "s.is_empty" ], [ "", "orphans.is_empty" ], [ "", "vec" ], [ "", "pacman_args.push" ], [ "", "pacman_args.push" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "target_pkgs.is_empty" ], [ "", "eprintln" ], [ "", "p.split.last.unwrap_or" ], [ "", "p.split.last" ], [ "", "p.split" ], [ "", "o.status.success" ], [ "", "\"?\".to_string" ], [ "", "get_pkg_repo.unwrap_or_default" ], [ "", "get_pkg_repo" ], [ "", "repo.is_empty" ], [ "", "bare.to_string" ], [ "", "format" ], [ "", "vec" ], [ "", "aura_args.push" ], [ "", "aura_args.push" ], [ "", "aura_args.push" ], [ "", "run_cmd" ], [ "", "remove_from_world_set" ], [ "", "target_pkgs.is_empty" ], [ "", "base_args.push" ], [ "", "base_args.push" ], [ "", "base_args.push" ], [ "", "abs_install" ], [ "", "resolve_aur" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "probe_official_split" ], [ "", "missing.is_empty" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "eprintln" ], [ "", "eprintln" ], [ "", "official_infos.is_empty" ], [ "", "eprintln" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "official_infos.iter.map.collect" ], [ "", "official_infos.iter.map" ], [ "", "official_infos.iter" ], [ "", "p.name.clone" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "official_infos.is_empty" ], [ "", "resolve_aur" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "resolve_aur" ], [ "", "official_infos.clone" ], [ "", "all_infos.extend" ], [ "", "aur_infos.clone" ], [ "", "print_emerge_plan" ], [ "", "print_emerge_emerging" ], [ "", "official_infos.iter.map.collect" ], [ "", "official_infos.iter.map" ], [ "", "official_infos.iter" ], [ "", "p.name.clone" ], [ "", "vec" ], [ "", "off_args.push" ], [ "", "off_args.extend" ], [ "", "run_cmd" ], [ "", "installed_infos.extend" ], [ "", "vec" ], [ "", "aur_args.extend" ], [ "", "run_cmd" ], [ "", "installed_infos.extend" ], [ "", "installed_infos.is_empty" ], [ "", "print_emerge_completed" ], [ "", "add_to_world_set" ], [ "", "Some" ], [ "", "installed_infos.is_empty" ], [ "", "installed_infos.iter.filter.map.collect" ], [ "", "installed_infos.iter.filter.map" ], [ "", "installed_infos.iter.filter" ], [ "", "installed_infos.iter" ], [ "", "p.name.clone" ], [ "", "installed_infos.iter.filter.map.collect" ], [ "", "installed_infos.iter.filter.map" ], [ "", "installed_infos.iter.filter" ], [ "", "installed_infos.iter" ], [ "", "p.name.clone" ], [ "", "official_names.is_empty" ], [ "", "add_to_world_set" ], [ "", "aur_names.is_empty" ], [ "", "add_to_world_set" ], [ "", "Some" ], [ "", "eprintln" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "l.trim.to_string" ], [ "", "l.trim" ], [ "", "l.is_empty" ], [ "", "eprintln" ], [ "", "entry.split.last.unwrap_or" ], [ "", "entry.split.last" ], [ "", "entry.split" ], [ "", "pkg_world_entry" ], [ "", "updated.push" ], [ "", "updated.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "line.trim.to_string" ], [ "", "line.trim" ], [ "", "trimmed.is_empty" ], [ "", "validate_pkg" ], [ "", "trimmed.split.last.unwrap_or.to_string" ], [ "", "trimmed.split.last.unwrap_or" ], [ "", "trimmed.split.last" ], [ "", "trimmed.split" ], [ "", "current_set.insert" ], [ "", "pkg.split.last.unwrap_or.to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "pkg_world_entry" ], [ "", "current_set.get.map.unwrap_or" ], [ "", "current_set.get.map" ], [ "", "current_set.get" ], [ "", "current_set.insert" ], [ "", "current_set.into_values.collect" ], [ "", "current_set.into_values" ], [ "", "sorted.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "line.trim.to_string" ], [ "", "line.trim" ], [ "", "trimmed.is_empty" ], [ "", "validate_pkg" ], [ "", "trimmed.split.last.unwrap_or.to_string" ], [ "", "trimmed.split.last.unwrap_or" ], [ "", "trimmed.split.last" ], [ "", "trimmed.split" ], [ "", "current_set.insert" ], [ "", "pkg.split.last.unwrap_or.to_string" ], [ "", "pkg.split.last.unwrap_or" ], [ "", "pkg.split.last" ], [ "", "pkg.split" ], [ "", "current_set.remove.is_some" ], [ "", "current_set.remove" ], [ "", "current_set.into_values.collect" ], [ "", "current_set.into_values" ], [ "", "sorted.sort" ], [ "", "write_world_set" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "is_safe_path" ], [ "", "eprintln" ], [ "", "child.stdin.take" ], [ "", "writeln" ], [ "", "child.wait" ], [ "", "s.success" ], [ "", "s.success" ], [ "", "clap" ], [ "", "colored" ], [ "", "std" ] ], "mbr": [ "all_infos.extend", "args.extend_from_slice", "args.get", "args.get().map", "args.get().map().unwrap_or", "args.get().or_else", "args.get().or_else().map", "args.get().or_else().map().unwrap_or", "args.push", "aur_args.extend", "aur_infos.clone", "aur_names.is_empty", "aura_args.push", "bare.contains", "bare.to_string", "base_args.push", "build_base.exists", "build_base.join", "build_dir.join", "c.is_alphanumeric", "child.stdin", "child.stdin.take", "child.wait", "cli.abs", "cli.ask", "cli.aur", "cli.depclean", "cli.deselect", "cli.edit", "cli.help", "cli.noreplace", "cli.oneshot", "cli.only_repos", "cli.packages", "cli.packages.iter", "cli.packages.iter().any", "cli.packages.iter().filter", "cli.packages.iter().filter().cloned", "cli.packages.iter().filter().cloned().collect", "cli.pretend", "cli.prune", "cli.refresh", "cli.regen", "cli.regen_world", "cli.resume", "cli.search", "cli.searchdesc", "cli.select", "cli.skipfirst", "cli.skippgp", "cli.sync", "cli.unmerge", "cli.update", "cli.verbose", "cli.version", "cmd.arg", "cmd.args", "cmd.status", "current_set.get", "current_set.get().map", "current_set.get().map().unwrap_or", "current_set.insert", "current_set.into_values", "current_set.into_values().collect", "current_set.remove", "current_set.remove().is_some", "entry.split", "entry.split().last", "entry.split().last().unwrap_or", "forced_prefix.unwrap_or", "format_atom().green", "format_atom().green().bold", "format_atom().green().bold().to_string", "found.append", "found.push", "found_names.contains", "found_names.insert", "get_pkg_repo().unwrap_or_default", "info.name", "info.name.clone", "infos.is_empty", "installed.into_iter", "installed.into_iter().filter", "installed.into_iter().filter().collect", "installed.is_empty", "installed_infos.extend", "installed_infos.is_empty", "installed_infos.iter", "installed_infos.iter().filter", "installed_infos.iter().filter().map", "installed_infos.iter().filter().map().collect", "l.is_empty", "l.trim", "l.trim().is_empty", "l.trim().split", "l.trim().split().last", "l.trim().split().last().unwrap_or", "l.trim().split().last().unwrap_or().to_string", "l.trim().to_string", "line.split", "line.split().nth", "line.splitn", "line.splitn().nth", "line.starts_with", "line.trim", "line.trim().to_string", "makepkg_args.push", "meta.file_type", "meta.file_type().is_symlink", "missing.is_empty", "missing.push", "n.to_str", "name.clone", "name.contains", "name.splitn", "o.status", "o.status.success", "o.stdout", "off_args.extend", "off_args.push", "official_infos.clone", "official_infos.is_empty", "official_infos.iter", "official_infos.iter().map", "official_infos.iter().map().collect", "official_names.is_empty", "orphans.is_empty", "orphans_str.lines", "orphans_str.lines().map", "orphans_str.lines().map().filter", "orphans_str.lines().map().filter().collect", "out.status", "out.status.success", "out.stdout", "output.status", "output.status.success", "output.stdout", "p.name", "p.name.clone", "p.next", "p.next().unwrap_or", "p.next().unwrap_or().to_string", "p.repo", "p.repo.is_empty", "p.split", "p.split().last", "p.split().last().unwrap_or", "p.split().last().unwrap_or().to_string", "p.status", "packages.iter", "packages.iter().filter", "packages.iter().filter().cloned", "packages.iter().filter().cloned().collect", "pacman_args.push", "parts.next", "parts.next().unwrap_or", "parts.next().unwrap_or().to_string", "pkg.chars", "pkg.chars().all", "pkg.clone", "pkg.contains", "pkg.split", "pkg.split().last", "pkg.split().last().unwrap_or", "pkg.split().last().unwrap_or().to_string", "pkg.starts_with", "pkg_dir.clone", "pkg_dir.exists", "pkg_dir.join", "pkg_dir.starts_with", "pkg_infos.is_empty", "pkg_infos.iter", "pkg_infos.iter().enumerate", "pkgs.iter", "pkgs.iter().enumerate", "pkgs.iter().filter", "pkgs.iter().filter().collect", "pkgs.iter().filter_map", "pkgs.iter().filter_map().collect", "pkgs.iter().map", "pkgs.iter().map().collect", "pkgs.len", "probe_official().is_some", "r.is_empty", "repo.is_empty", "result.push", "s.is_empty", "s.lines", "s.split_whitespace", "s.split_whitespace().nth", "s.split_whitespace().nth().unwrap_or", "s.split_whitespace().nth().unwrap_or().to_string", "s.success", "s.trim", "s.trim().to_string", "s_args.push", "sorted.sort", "status.cyan", "status.cyan().bold", "status.cyan().bold().to_string", "status.green", "status.green().bold", "status.green().bold().to_string", "status.red", "status.red().bold", "status.red().bold().to_string", "status.yellow", "status.yellow().bold", "status.yellow().bold().to_string", "stdout.lines", "stdout.lines().filter", "stdout.lines().filter().map", "stdout.lines().filter().map().collect", "target_pkgs.is_empty", "text.lines", "to_remove.is_empty", "total.to_string", "total.to_string().green", "total.to_string().green().bold", "total.to_string().green().bold().to_string", "total.to_string().yellow", "total.to_string().yellow().bold", "total.to_string().yellow().bold().to_string", "trimmed.is_empty", "trimmed.split", "trimmed.split().last", "trimmed.split().last().unwrap_or", "trimmed.split().last().unwrap_or().to_string", "trunk_dir.exists", "updated.push", "updated.sort", "v.trim", "v.trim().to_string", "val.trim", "val.trim().to_string", "world_bare.contains" ], "tgt": [ "Some", "abs_get_version", "abs_install", "add_to_world_set", "all_infos.extend", "args.extend_from_slice", "args.get", "args.get().map", "args.get().map().unwrap_or", "args.get().or_else", "args.get().or_else().map", "args.get().or_else().map().unwrap_or", "args.push", "aur_args.extend", "aur_infos.clone", "aur_names.is_empty", "aura_args.push", "bare.contains", "bare.to_string", "bare_of", "base_args.push", "build_base.exists", "build_base.join", "build_dir.join", "c.is_alphanumeric", "check_binaries", "child.stdin.take", "child.wait", "cli.packages.iter", "cli.packages.iter().any", "cli.packages.iter().filter", "cli.packages.iter().filter().cloned", "cmd.arg", "cmd.args", "cmd.status", "current_set.get", "current_set.get().map", "current_set.get().map().unwrap_or", "current_set.insert", "current_set.into_values", "current_set.into_values().collect", "current_set.remove", "current_set.remove().is_some", "entry.split", "entry.split().last", "entry.split().last().unwrap_or", "first_repo", "forced_prefix.unwrap_or", "format_atom", "format_atom().green", "format_atom().green().bold", "format_atom().green().bold().to_string", "found.append", "found.push", "found_names.contains", "found_names.insert", "get_pkg_repo", "get_pkg_repo().unwrap_or_default", "info.name.clone", "infos.is_empty", "installed.into_iter", "installed.into_iter().filter", "installed.into_iter().filter().collect", "installed.is_empty", "installed_infos.extend", "installed_infos.is_empty", "installed_infos.iter", "installed_infos.iter().filter", "installed_infos.iter().filter().map", "installed_infos.iter().filter().map().collect", "is_safe_path", "l.is_empty", "l.trim", "l.trim().is_empty", "l.trim().split", "l.trim().split().last", "l.trim().split().last().unwrap_or", "l.trim().split().last().unwrap_or().to_string", "l.trim().to_string", "line.split", "line.split().nth", "line.splitn", "line.splitn().nth", "line.starts_with", "line.trim", "line.trim().to_string", "makepkg_args.push", "meta.file_type", "meta.file_type().is_symlink", "missing.is_empty", "missing.push", "n.to_str", "name.clone", "name.contains", "name.splitn", "o.status.success", "off_args.extend", "off_args.push", "official_infos.clone", "official_infos.is_empty", "official_infos.iter", "official_infos.iter().map", "official_infos.iter().map().collect", "official_names.is_empty", "orphans.is_empty", "orphans_str.lines", "orphans_str.lines().map", "orphans_str.lines().map().filter", "orphans_str.lines().map().filter().collect", "out.status.success", "output.status.success", "p.name.clone", "p.next", "p.next().unwrap_or", "p.next().unwrap_or().to_string", "p.repo.is_empty", "p.split", "p.split().last", "p.split().last().unwrap_or", "p.split().last().unwrap_or().to_string", "packages.iter", "packages.iter().filter", "packages.iter().filter().cloned", "packages.iter().filter().cloned().collect", "pacman_args.push", "pacman_c", "parts.next", "parts.next().unwrap_or", "parts.next().unwrap_or().to_string", "pkg.chars", "pkg.chars().all", "pkg.clone", "pkg.contains", "pkg.split", "pkg.split().last", "pkg.split().last().unwrap_or", "pkg.split().last().unwrap_or().to_string", "pkg.starts_with", "pkg_dir.clone", "pkg_dir.exists", "pkg_dir.join", "pkg_dir.starts_with", "pkg_infos.is_empty", "pkg_infos.iter", "pkg_infos.iter().enumerate", "pkg_status", "pkg_world_entry", "pkgs.iter", "pkgs.iter().enumerate", "pkgs.iter().filter", "pkgs.iter().filter().collect", "pkgs.iter().filter_map", "pkgs.iter().filter_map().collect", "pkgs.iter().map", "pkgs.iter().map().collect", "pkgs.len", "portageq_shim", "print_emerge_completed", "print_emerge_emerging", "print_emerge_plan", "print_help", "probe_official", "probe_official().is_some", "probe_official_split", "r.is_empty", "regen_world_set", "remove_from_world_set", "repo.is_empty", "resolve_aur", "result.push", "run_cmd", "s.is_empty", "s.lines", "s.split_whitespace", "s.split_whitespace().nth", "s.split_whitespace().nth().unwrap_or", "s.split_whitespace().nth().unwrap_or().to_string", "s.success", "s.trim", "s.trim().to_string", "s_args.push", "sorted.sort", "status.cyan", "status.cyan().bold", "status.cyan().bold().to_string", "status.green", "status.green().bold", "status.green().bold().to_string", "status.red", "status.red().bold", "status.red().bold().to_string", "status.yellow", "status.yellow().bold", "status.yellow().bold().to_string", "stdout.lines", "stdout.lines().filter", "stdout.lines().filter().map", "stdout.lines().filter().map().collect", "target_pkgs.is_empty", "text.lines", "to_remove.is_empty", "total.to_string", "total.to_string().green", "total.to_string().green().bold", "total.to_string().green().bold().to_string", "total.to_string().yellow", "total.to_string().yellow().bold", "total.to_string().yellow().bold().to_string", "trimmed.is_empty", "trimmed.split", "trimmed.split().last", "trimmed.split().last().unwrap_or", "trimmed.split().last().unwrap_or().to_string", "trunk_dir.exists", "updated.push", "updated.sort", "v.trim", "v.trim().to_string", "val.trim", "val.trim().to_string", "validate_packages", "validate_pkg", "world_bare.contains", "write_world_set" ], "metrics": { "ast": { "op.eq": 8.0, "op.lt": 1.0, "op.ne": 5.0, "op.add": 2.0, "op.lor": 7.0, "op.land": 10.0, "max_depth": 29.0, "bind_count": 18.0, "call_count": 618.0, "node_count": 16226.0, "member_count": 236.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "identifier_count": 334.0, "member_depth_max": 6.0, "string_literal_count": 424.0, "array_literal_max_length": 6.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 59294.0, "entropy": 4.73, "size_bytes": 59294.0 }, "text": { "digit_ratio": 0.0, "space_count": 16925.0, "total_lines": 1553.0, "char_entropy": 4.73, "unique_chars": 104.0, "lines_over_200": 9.0, "string_density": 0.27, "avg_line_length": 37.18, "high_byte_ratio": 0.04, "max_line_length": 227.0, "non_ascii_ratio": 0.04, "empty_line_ratio": 0.12, "last_line_length": 1.0, "long_token_count": 13.0, "whitespace_ratio": 0.31, "most_common_ratio": 0.05, "identifier_density": 1.7, "line_length_stddev": 31.05, "normalized_string_count": 10.76, "repeated_char_sequences": 573.0, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.05, "max_inline_whitespace_run": 31.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 31.51 }, "binds": { "count": 18.0 }, "calls": { "count": 618.0 }, "binary": { "overall_entropy": 4.73, "peak_region_bytes": 16384.0, "peak_region_entropy": 5.13 }, "source": { "class_count": 2.0, "function_count": 27.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 236.0 }, "strings": { "total": 424.0, "url_count": 1.0, "avg_length": 16.7, "max_length": 157.0, "path_count": 16.0, "avg_entropy": 2.43, "email_count": 1.0, "empty_count": 10.0, "sql_strings": 8.0, "total_bytes": 7082.0, "entropy_stddev": 1.36, "shell_command_strings": 1.0, "embedded_code_candidates": 1.0 }, "comments": { "chars": 10685.0, "lines": 174.0, "total": 167.0, "to_code_ratio": 0.13, "high_entropy_comments": 9.0 }, "functions": { "count": 29.0, "avg_params": 1.22, "max_params": 6.0, "length_stddev": 98.06, "over_100_lines": 2.0, "over_500_lines": 1.0, "avg_name_length": 13.59, "no_params_count": 4.0, "avg_length_lines": 46.63, "max_length_lines": 528.0, "min_length_lines": 6.0, "nested_functions": 1.0, "avg_nesting_depth": 0.07, "max_nesting_depth": 1.0, "high_entropy_names": 4.0, "single_char_params": 1.0, "avg_param_name_length": 5.39, "density_per_100_lines": 1.74, "code_in_functions_ratio": 0.81 }, "identifiers": { "count": 334.0, "total": 2638.0, "avg_length": 7.43, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.43, "reuse_ratio": 0.13, "unique_count": 334.0, "length_stddev": 4.05, "has_digit_ratio": 0.0, "sequential_names": 12.0, "single_char_count": 13.0, "single_char_ratio": 0.04, "high_entropy_count": 11.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 1.0 } } }, "id": 53, "mol": "H₃(CmOsPo₂)Md", "path": "main!!aura-emerge-main/src/main.rs", "pid": 0, "risk": 5, "sha": "523f67490cdb81e60886bcd60dd953926109481b24f95881cad40c6bced467d4", "size": 59294, "traits": [ { "id": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword", "atk": "T1548.003", "conf": 0.7, "crit": 1, "desc": "sudo command keyword", "spans": [ [ 59163, 4 ] ] }, { "id": "metadata/lang/embedded::shell", "conf": 1.0, "crit": 2, "desc": "shell code embedded in string", "spans": [ [ 118304, 52 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repository", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repository", "spans": [ [ 4662, 10 ] ] }, { "id": "micro-behaviors/process/create/exec::rust-command-new-call", "atk": "T1059", "conf": 0.85, "crit": 1, "desc": "Rust Command::new call", "spans": [ [ 11736, 13 ] ] }, { "id": "objectives/discovery/host/fingerprint::version-field", "atk": "T1082", "conf": 0.9, "crit": 1, "desc": "WMI Version result field", "spans": [ [ 17135, 7 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.8, "crit": 2, "desc": "English language detection", "spans": [ [ 34, 4 ] ] }, { "id": "micro-behaviors/data/control-flow/loop::rust-while-loop", "conf": 0.75, "crit": 2, "desc": "Rust while loop", "spans": [ [ 51600, 6 ] ] }, { "id": "micro-behaviors/process/create/direct::rust-spawn-call", "atk": "T1059", "mbc": "E1059", "conf": 0.8, "crit": 1, "desc": "Rust spawn() method call", "spans": [ [ 58097, 7 ] ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 1480, 3 ] ] }, { "id": "micro-behaviors/os/env/access::std-env-var", "conf": 0.86, "crit": 3, "desc": "Rust environment variable lookup", "spans": [ [ 27295, 14 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::rust-curl-wget-command", "atk": "T1105", "conf": 0.82, "crit": 3, "desc": "Rust invokes curl or wget", "spans": [ [ 22997, 19 ] ] }, { "id": "objectives/command-and-control/remote-command/keywords::command-result-word", "conf": 0.4, "crit": 1, "desc": "Command/result vocabulary pair", "spans": [ [ 16467, 71 ] ] }, { "id": "micro-behaviors/process/create/direct::rust-async-process", "atk": "T1059", "mbc": "E1059", "conf": 0.92, "crit": 3, "desc": "Builds process via Command::new", "spans": [ [ 11736, 13 ] ] }, { "id": "micro-behaviors/fs/file/open::rust-file-open", "conf": 0.86, "crit": 2, "desc": "Rust file open call", "spans": [ [ 36227, 11 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase--repo", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target word: repo", "spans": [ [ 11487, 4 ] ] }, { "id": "metadata/file/format::box-drawing-banner", "conf": 0.9, "crit": 2, "desc": "Box drawing text banner", "spans": [ [ 521, 165 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-status", "atk": "T1195.002", "conf": 0.86, "crit": 1, "desc": "build.rs waits on command status", "spans": [ [ 22412, 9 ] ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::rust-build-rs-command-output", "atk": "T1195.002", "conf": 0.88, "crit": 1, "desc": "build.rs captures command output", "spans": [ [ 11916, 9 ] ] }, { "id": "metadata/file/format::vocab-date", "conf": 0.97, "crit": 1, "desc": "String literal contains date word", "spans": [ [ 54301, 4 ] ] }, { "id": "metadata/file/format::vocab-required", "conf": 0.97, "crit": 1, "desc": "String literal contains required word", "spans": [ [ 10652, 8 ] ] }, { "id": "metadata/file/profile/language::lang-russian", "conf": 0.8, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)", "spans": [ [ 17634, 14 ] ] }, { "id": "metadata/file/format::vocab-invalid", "conf": 0.97, "crit": 1, "desc": "String literal contains invalid word", "spans": [ [ 10060, 7 ], [ 24344, 7 ] ] }, { "id": "micro-behaviors/process/create/exec::spawn-api-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "spawn API call", "spans": [ [ 58098, 6 ] ] }, { "id": "objectives/impact/destroy/keywords::target-codebase", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target-word component", "spans": [ [ 4662, 10 ], [ 11487, 4 ] ] }, { "id": "metadata/file/format::i18n-validation-vocab", "conf": 0.97, "crit": 1, "desc": "Form-validation vocabulary in dense non-ASCII file", "spans": [ [ 10060, 7 ], [ 10652, 8 ], [ 24344, 7 ], [ 54301, 4 ] ] } ], "type": "rust" }, { "id": 54, "mol": "Md", "sha": "df1972dd0970672eccfc212634e0623594ab1d3a90c06b868abbc2c18bc325ca", "path": "main!!aura-emerge-main/repo-files/UA-README.MD", "risk": 1, "size": 8180, "type": "markdown", "depth": 5 }, { "ctx": [ { "b": "AbP/tuUKz0Byx04c[co=3lQEczxHJLw/@:HB8\u0026{Iz!0i(fjFTkfj/0iA+w@aflItRfkLMpvqEPax(kOyz/P@dxjV5\u0026Ef{s2z/Z2cB-p#lvpS{$diJ%AarUSwB97=6zGx]dy?%Db3jp-)wNxE?zeTPec[co=3lQEiz6gAxatm\u003eUAXzlEv{%gbvRGZkAbP=svp%d\u003e3vI", "ln": 0, "col": 1, "line": 1 } ], "depth": 5, "facts": { "imp": [ [ "", "ln" ], [ "", "post_install" ], [ "", "rm" ] ], "tgt": [ "ln", "post_install", "rm" ], "funcs": [ [ "post_install", 0 ], [ "post_upgrade", 75 ], [ "pre_remove", 110 ] ], "metrics": { "ast": { "max_depth": 5, "call_count": 3, "node_count": 36 }, "file": { "size": 158, "entropy": 4.52 }, "text": { "lines": 11, "top_char": 47, "max_ws_run": 1, "space_count": 14, "char_entropy": 4.52, "unique_chars": 28, "top_char_null": 0, "top_char_ratio": 0.08, "avg_line_length": 13.45, "max_line_length": 54, "empty_line_ratio": 0.18, "last_line_length": 1, "whitespace_ratio": 0.15, "identifier_density": 1.27, "line_length_stddev": 15.93, "normalized_unique_identifiers": 2.6 }, "binary": { "peak_region_bytes": 158, "peak_region_entropy": 4.52 }, "source": { "function_count": 3 }, "functions": { "count": 3, "density": 27.27, "avg_params": 1, "code_ratio": 0.82, "max_params": 1, "avg_name_length": 11.33, "avg_length_lines": 3, "max_length_lines": 3, "min_length_lines": 3, "avg_param_name_length": 5.33 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 14, "unique": 9, "avg_length": 9.67, "max_length": 23, "min_length": 2, "avg_entropy": 2.35, "reuse_ratio": 0.64, "length_stddev": 7.73, "high_entropy_count": 2, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.56 } } }, "id": 55, "mol": "Md₂(Bk)", "path": "main!!aura-emerge-main/aura-emerge.install", "pid": 0, "risk": 2, "sha": "d63dff760e1f9e62567cf81cf46a7e1299c715445c31ea677f2e2692e928bb26", "size": 158, "traits": [ { "id": "metadata/build/package/maintainer-scripts::pacman-lifecycle-hook-fn", "conf": 0.9, "crit": 3, "desc": "Lifecycle-style shell function declaration", "spans": [ [ 0, 16 ], [ 74, 17 ], [ 109, 15 ] ] }, { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "metadata/build/package/maintainer-scripts::pacman-scriptlet-hook-fn", "conf": 0.9, "crit": 1, "desc": "Non-PKGBUILD lifecycle-style shell function", "spans": [ [ 0, 0 ] ] } ], "type": "shell" }, { "id": 56, "mol": "H(Cm)Md₂(BkPa)", "sha": "60d1535afa8836bca90945ab558460ec248ab202fb1ec45a7fd6e5579176427c", "path": "main!!aura-emerge-main/PKGBUILD", "risk": 3, "size": 1214, "type": "shell", "depth": 5 }, { "id": 57, "sha": "3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986", "path": "main!!aura-emerge-main/LICENSE", "risk": 1, "size": 35149, "type": "text", "depth": 5 }, { "id": 58, "sha": "7eb932c1d98dbc08e89c59c86b72a2b4e1394409650d83ab9a16a8486f9a270e", "path": "main!!aura-emerge-main/Cargo.toml", "risk": 1, "size": 173, "type": "cargo.toml", "depth": 5 }, { "id": 59, "sha": "dd27df4d004f8f2c92b3fa43a25dee88f26a83c2b9c021171e21d42702953103", "path": "main!!aura-emerge-main/Cargo.lock", "size": 7659, "type": "cargo.lock", "depth": 5 }, { "id": 60, "sha": "2116fe1191a50e7761f0c50a3cf2198d77b2b29e0644afad14ec9a58e2809f2f", "path": "main!!aura-emerge-main/.SRCINFO", "size": 618, "type": "src_info", "depth": 5 }, { "id": 61, "sha": "dc27b5fd02af2b6c1605928ba9379298fff227096132b28c5936bd79033d2a2c", "path": "main!!aura-emerge-main/README.MD", "size": 5830, "type": "markdown", "depth": 5 }, { "id": 62, "mol": "Md", "sha": "4a9f41cab26a41eac44687ba9adf4f1a48a98b9fd07768788d21c2799a1087a7", "path": "aura-emerge@1.23.0-1.registry.json", "risk": 1, "size": 843, "type": "registry", "depth": 1 } ], "omitted_files": 52, "rev": "e4daa", "v": "8" } }