{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8748640418052673,
        "class": 0,
        "threshold": 0.9989520311355591
      }
    ],
    "prob": 0.87486404,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.87486404,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.66233766,
        "class": 0
      },
      {
        "m": "az/powershell",
        "prob": 0.7714286,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99895203,
    "analyzed_at": "2026-05-30T00:26:23Z"
  },
  "path": "2b60b3be4225d6bbe43a102c77671d41af3d859c3042f83074fd42c6f9428d53.ps1",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 35,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 32.0,
              "call_count": 10.0,
              "node_count": 343.0,
              "identifier_count": 22.0,
              "string_literal_count": 8.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 840.0,
              "entropy": 5.1,
              "size_bytes": 840.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 91.0,
              "total_lines": 27.0,
              "char_entropy": 5.1,
              "unique_chars": 64.0,
              "string_density": 0.3,
              "avg_line_length": 29.19,
              "max_line_length": 82.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.17,
              "most_common_ratio": 0.07,
              "identifier_density": 1.26,
              "line_length_stddev": 25.34,
              "normalized_string_count": 1.54,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.25,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 4.63
            },
            "calls": {
              "count": 10.0
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 8.0,
              "avg_length": 16.0,
              "max_length": 24.0,
              "path_count": 1.0,
              "avg_entropy": 3.35,
              "total_bytes": 128.0,
              "entropy_stddev": 0.32
            },
            "comments": {
              "chars": 140.0,
              "lines": 4.0,
              "total": 4.0,
              "to_code_ratio": 0.17,
              "empty_comments": 1.0,
              "high_entropy_comments": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 22.0,
              "total": 34.0,
              "avg_length": 8.86,
              "max_length": 19.0,
              "min_length": 3.0,
              "avg_entropy": 2.72,
              "reuse_ratio": 0.65,
              "unique_count": 22.0,
              "length_stddev": 3.9,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.05,
              "all_lowercase_ratio": 0.05
            }
          },
          "s": [
            [
              237,
              "u8",
              "./pinglog.log"
            ],
            [
              237,
              "u8",
              "./pinglog.log"
            ],
            [
              333,
              "u8",
              "yyyy/MM/dd HH:mm:ss"
            ],
            [
              333,
              "u8",
              "yyyy/MM/dd HH:mm:ss"
            ],
            [
              371,
              "u8",
              "$Stamp $LogString"
            ],
            [
              371,
              "u8",
              "$Stamp $LogString"
            ],
            [
              457,
              "u8",
              "pinglist.txt"
            ],
            [
              457,
              "u8",
              "pinglist.txt"
            ],
            [
              556,
              "10",
              "1"
            ],
            [
              556,
              "10",
              "1"
            ],
            [
              606,
              "u8",
              "[WRK] $name"
            ],
            [
              606,
              "u8",
              "[WRK] $name"
            ],
            [
              680,
              "u8",
              "Ping succeeded for $name"
            ],
            [
              680,
              "u8",
              "Ping succeeded for $name"
            ],
            [
              737,
              "u8",
              "[ERR] $name"
            ],
            [
              737,
              "u8",
              "[ERR] $name"
            ],
            [
              809,
              "u8",
              "Ping failed for $name"
            ],
            [
              809,
              "u8",
              "Ping failed for $name"
            ]
          ],
          "v": {
            "file.stem": "2b60b3be4225d6bbe43a102c77671d41af3d859c3042f83074fd42c6f9428d53",
            "file.basename": "2b60b3be4225d6bbe43a102c77671d41af3d859c3042f83074fd42c6f9428d53.ps1",
            "source.language": "powershell",
            "source.strings[0]": "$Stamp $LogString",
            "source.strings[1]": "./pinglog.log",
            "source.strings[2]": "Ping failed for $name",
            "source.strings[3]": "Ping succeeded for $name",
            "source.strings[4]": "[ERR] $name",
            "source.strings[5]": "[WRK] $name",
            "source.strings[6]": "pinglist.txt",
            "source.strings[7]": "yyyy/MM/dd HH:mm:ss",
            "source.functions[0]": "anonymous"
          },
          "ct": [
            "Add-content",
            "Get-Date",
            "Get-content",
            "Set-ExecutionPolicy",
            "Test-Connection",
            "Write-Host",
            "WriteLog",
            "clear"
          ],
          "id": "powershell"
        },
        "id": 0,
        "sz": 840,
        "ts": [
          {
            "a": "T1047",
            "c": 0.8999999761581421,
            "d": "WMI remote computer target",
            "e": [
              " -ComputerName $name"
            ],
            "i": "objectives/execution/wmi::wmi-computername-target",
            "l": 1
          },
          {
            "a": "T1059.001",
            "c": 0.949999988079071,
            "d": "ExecutionPolicy bypass flag",
            "e": [
              "ExecutionPolicy Bypass"
            ],
            "i": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-flag",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "Test"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-source-test-target",
            "l": 1
          },
          {
            "d": "Five or fewer comment lines in file",
            "e": [
              "comments.lines = 4.00"
            ],
            "i": "metadata/file/text/metrics::few-comment-lines",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Destructive cleanup verb",
            "e": [
              "clear"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-destructive-clean-verb",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "Get-Content"
            ],
            "i": "objectives/command-and-control/dropper/execution/fileless::hidden-powershell-getcontent-iex--rx-23",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "Value"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047"
          },
          {
            "c": 1.0,
            "d": "Valid PowerShell code",
            "e": [
              "Param ("
            ],
            "i": "metadata/lang/scripted::ps-valid",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Accesses computername environment variable",
            "e": [
              "$env:computername"
            ],
            "i": "micro-behaviors/os/env/vars/access::env-computername",
            "l": 3
          },
          {
            "a": "T1059.001",
            "c": 0.8500000238418579,
            "d": "PowerShell execution policy bypass flag",
            "e": [
              "Set-ExecutionPolicy -ExecutionPolicy Bypass"
            ],
            "i": "objectives/evasion/security-bypass/policy/execution::bypass-execution-policy",
            "l": 4,
            "m": "E1027"
          }
        ],
        "sha": "2b60b3be4225d6bbe43a102c77671d41af3d859c3042f83074fd42c6f9428d53",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-06/2b60b3be4225d6bbe43a102c77671d41af3d859c3042f83074fd42c6f9428d53.ps1",
        "type": "powershell"
      }
    ],
    "tv": "ca5ef"
  }
}