{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.00002514322659408208 } ], "prob": 0.000025143227, "models": [ { "m": "az", "raw": 0.000025143227, "prob": 0.000025143227, "class": 0 }, { "m": "az/scripts", "raw": 0.000033408403, "prob": 0.000033408403, "class": 0 }, { "m": "az/shell", "raw": 0.00019413233, "prob": 0.00019413233, "class": 0 } ], "version": "v18.18", "analyzed_at": "2026-06-09T04:20:24Z" }, "path": "run.sh", "raw": { "v": "6", "fs": [ { "f": "O(Dy)H(Po)", "x": 3, "ff": { "i": [ [ "", "set" ], [ "", "set" ], [ "", "set" ], [ "", "set" ], [ "", "set" ], [ "", "set" ], [ "", "cd" ], [ "", "cd" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "pwd" ], [ "", "pwd" ], [ "", "source" ], [ "", "source" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "command" ], [ "", "command" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "command" ], [ "", "command" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "print_test_case" ], [ "", "print_test_case" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "cd" ], [ "", "cd" ], [ "", "run" ], [ "", "run" ], [ "", "break" ], [ "", "break" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "cd" ], [ "", "cd" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "run" ], [ "", "run" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "run" ], [ "", "run" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "run" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "run_fail" ], [ "", "run_fail" ], [ "", "tty" ], [ "", "tty" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "print_error" ], [ "", "print_error" ], [ "", "exit" ], [ "", "exit" ], [ "", "print_h2" ], [ "", "print_h2" ], [ "", "${SOURCEPATH}" ] ], "m": { "ast": { "op.eq": 1.0, "op.lnot": 1.0, "max_depth": 11.0, "bind_count": 9.0, "call_count": 81.0, "node_count": 806.0, "op_density.eq": 0.0, "op_density.lnot": 0.0, "identifier_count": 37.0, "self_compare_count": 1.0, "string_literal_count": 58.0 }, "file": { "size": 4746.0, "entropy": 4.25, "size_bytes": 4746.0 }, "text": { "tab_count": 32.0, "digit_ratio": 0.04, "space_count": 343.0, "total_lines": 143.0, "char_entropy": 4.25, "unique_chars": 79.0, "string_density": 0.41, "ascii_art_lines": 18.0, "avg_line_length": 32.19, "max_line_length": 99.0, "empty_line_ratio": 0.24, "last_line_length": 46.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.38, "identifier_density": 1.5, "line_length_stddev": 34.15, "normalized_string_count": 4.85, "repeated_char_sequences": 18.0, "suspicious_string_ratio": 0.29, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 45.0, "normalized_unique_identifiers": 5.17 }, "binds": { "count": 9.0 }, "calls": { "count": 81.0 }, "binary": { "overall_entropy": 4.25 }, "imports": { "count": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 58.0, "avg_length": 31.9, "max_length": 72.0, "avg_entropy": 3.8, "empty_count": 1.0, "total_bytes": 1850.0, "entropy_stddev": 0.84, "shell_command_strings": 17.0 }, "comments": { "chars": 1916.0, "lines": 30.0, "total": 30.0, "to_code_ratio": 0.27 }, "identifiers": { "count": 37.0, "total": 214.0, "avg_length": 6.19, "max_length": 15.0, "min_length": 1.0, "avg_entropy": 2.09, "reuse_ratio": 0.17, "unique_count": 37.0, "length_stddev": 4.05, "has_digit_ratio": 0.14, "single_char_count": 2.0, "single_char_ratio": 0.05, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.46, "all_uppercase_ratio": 0.19, "numeric_suffix_count": 2.0 } }, "s": [ [ 63, "u8", "$( cd \"$(dirname \"$0\")\" \u003e/dev/null 2\u003e\u00261 ; pwd -P )" ], [ 70, "u8", "$(dirname \"$0\")" ], [ 81, "u8", "$0" ], [ 102, "10", "1" ], [ 127, "u8", "${SCRIPTPATH}/../../.lib/conf.sh" ], [ 141, "u8", "/../../.lib/conf.sh" ], [ 173, "u8", "${SCRIPTPATH}/" ], [ 187, "u8", "/" ], [ 225, "u8", "${SOURCEPATH}" ], [ 467, "10", "7" ], [ 483, "10", "15" ], [ 492, "u8", "scanner" ], [ 493, "u8", "scanner" ], [ 739, "u8", "${1:-3.8}" ], [ 762, "u8", "${SCRIPTPATH}/${COMPOSE}" ], [ 776, "u8", "/" ], [ 800, "u8", "${COMPOSEDIR}/docker-compose.yml" ], [ 814, "u8", "/docker-compose.yml" ], [ 856, "u8", "docker-compose.yml not found in: ${COMPOSEDIR}/docker-compose.yml." ], [ 857, "u8", "docker-compose.yml not found in: " ], [ 903, "u8", "/docker-compose.yml." ], [ 931, "10", "1" ], [ 973, "10", "1" ], [ 994, "u8", "docker binary not found, but required." ], [ 995, "u8", "docker binary not found, but required." ], [ 1041, "10", "1" ], [ 1091, "10", "1" ], [ 1112, "u8", "docker-compose binary not found, but required." ], [ 1113, "u8", "docker-compose binary not found, but required." ], [ 1167, "10", "1" ], [ 1396, "u8", "PYTHON_VERSION=${PYTHON_VERSION}" ], [ 1397, "u8", "PYTHON_VERSION=" ], [ 1433, "u8", "${COMPOSEDIR}/.env" ], [ 1447, "u8", "/.env" ], [ 1470, "u8", "Python ${PYTHON_VERSION}" ], [ 1471, "u8", "Python " ], [ 1724, "u8", "(1/5) Get artifacts" ], [ 1725, "u8", "(1/5) Get artifacts" ], [ 1750, "u8", "${COMPOSEDIR}" ], [ 1803, "u8", "1" ], [ 1804, "u8", "1" ], [ 1811, "u8", "1" ], [ 1812, "u8", "1" ], [ 1829, "u8", "docker-compose pull" ], [ 1830, "u8", "docker-compose pull" ], [ 1876, "10", "1" ], [ 2105, "u8", "(1/5) Stopping Docker Compose" ], [ 2106, "u8", "(1/5) Stopping Docker Compose" ], [ 2142, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 2143, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 2188, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 2189, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 2450, "u8", "(2/5) Starting compose" ], [ 2451, "u8", "(2/5) Starting compose" ], [ 2479, "u8", "${COMPOSEDIR}" ], [ 2499, "u8", "docker-compose up -d" ], [ 2500, "u8", "docker-compose up -d" ], [ 2526, "u8", "sleep ${WAIT_STARTUP}" ], [ 2527, "u8", "sleep " ], [ 2772, "u8", "(3/5) Validate running" ], [ 2773, "u8", "(3/5) Validate running" ], [ 2807, "u8", "docker-compose ps --filter 'status=running' --services | grep ${NAME1}" ], [ 2808, "u8", "docker-compose ps --filter 'status=running' --services | grep " ], [ 2891, "u8", "docker-compose logs" ], [ 2892, "u8", "docker-compose logs" ], [ 2918, "u8", "docker-compose ps" ], [ 2919, "u8", "docker-compose ps" ], [ 2943, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true" ], [ 2944, "u8", "docker-compose exec " ], [ 2990, "u8", "-T" ], [ 3005, "u8", " ps || true" ], [ 3023, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 3024, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 3071, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 3072, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 3127, "u8", "Server is not running" ], [ 3128, "u8", "Server is not running" ], [ 3157, "10", "1" ], [ 3167, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true" ], [ 3168, "u8", "docker-compose exec " ], [ 3214, "u8", "-T" ], [ 3229, "u8", " ps || true" ], [ 3460, "u8", "(4/5) Test" ], [ 3461, "u8", "(4/5) Test" ], [ 3483, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} kill -2 1" ], [ 3484, "u8", "docker-compose exec " ], [ 3530, "u8", "-T" ], [ 3545, "u8", " kill -2 1" ], [ 3568, "u8", "docker-compose logs" ], [ 3569, "u8", "docker-compose logs" ], [ 3595, "u8", "docker-compose ps" ], [ 3596, "u8", "docker-compose ps" ], [ 3620, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true" ], [ 3621, "u8", "docker-compose exec " ], [ 3667, "u8", "-T" ], [ 3682, "u8", " ps || true" ], [ 3700, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 3701, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 3748, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 3749, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 3804, "u8", "Kill command not successful" ], [ 3805, "u8", "Kill command not successful" ], [ 3840, "10", "1" ], [ 3850, "u8", "sleep ${WAIT_SHUTDOWN}" ], [ 3851, "u8", "sleep " ], [ 3879, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true" ], [ 3880, "u8", "docker-compose exec " ], [ 3926, "u8", "-T" ], [ 3941, "u8", " ps || true" ], [ 3971, "u8", "docker-compose ps --filter 'status=running' --services | grep ${NAME1}" ], [ 3972, "u8", "docker-compose ps --filter 'status=running' --services | grep " ], [ 4055, "u8", "docker-compose logs" ], [ 4056, "u8", "docker-compose logs" ], [ 4082, "u8", "docker-compose ps" ], [ 4083, "u8", "docker-compose ps" ], [ 4107, "u8", "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true" ], [ 4108, "u8", "docker-compose exec " ], [ 4154, "u8", "-T" ], [ 4169, "u8", " ps || true" ], [ 4187, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 4188, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 4235, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 4236, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 4291, "u8", "Server was supposed to stop, it is running" ], [ 4292, "u8", "Server was supposed to stop, it is running" ], [ 4342, "10", "1" ], [ 4569, "u8", "(5/5) Stopping Docker Compose" ], [ 4570, "u8", "(5/5) Stopping Docker Compose" ], [ 4606, "u8", "docker-compose logs" ], [ 4607, "u8", "docker-compose logs" ], [ 4632, "u8", "docker-compose ps" ], [ 4633, "u8", "docker-compose ps" ], [ 4656, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 4657, "u8", "docker-compose kill || true 2\u003e/dev/null" ], [ 4703, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ], [ 4704, "u8", "docker-compose rm -f || true 2\u003e/dev/null" ] ], "v": { "file.stem": "run", "file.basename": "run.sh", "source.shebang": "/usr/bin/env bash", "source.language": "bash", "source.imports[0]": "${SOURCEPATH}", "source.imports[1]": "break", "source.imports[2]": "cd", "source.imports[3]": "command", "source.imports[4]": "dirname", "source.imports[5]": "echo", "source.imports[6]": "exit", "source.imports[7]": "print_error", "source.imports[8]": "print_h2", "source.imports[9]": "print_test_case", "source.strings[0]": " kill -2 1", "source.strings[1]": " ps || true", "source.strings[2]": "$( cd \"$(dirname \"$0\")\" \u003e/dev/null 2\u003e\u00261 ; pwd -P )", "source.strings[3]": "$(dirname \"$0\")", "source.strings[4]": "${1:-3.8}", "source.strings[5]": "${COMPOSEDIR}", "source.strings[6]": "${COMPOSEDIR}/.env", "source.strings[7]": "${COMPOSEDIR}/docker-compose.yml", "source.strings[8]": "${SCRIPTPATH}/", "source.strings[9]": "${SCRIPTPATH}/${COMPOSE}", "source.has_imports": true, "source.imports[10]": "pwd", "source.imports[11]": "run", "source.imports[12]": "run_fail", "source.imports[13]": "set", "source.imports[14]": "sleep", "source.imports[15]": "source", "source.imports[16]": "tty", "source.strings[10]": "${SCRIPTPATH}/../../.lib/conf.sh", "source.strings[11]": "${SOURCEPATH}", "source.strings[12]": "(1/5) Get artifacts", "source.strings[13]": "(1/5) Stopping Docker Compose", "source.strings[14]": "(2/5) Starting compose", "source.strings[15]": "(3/5) Validate running", "source.strings[16]": "(4/5) Test", "source.strings[17]": "(5/5) Stopping Docker Compose", "source.strings[18]": "/../../.lib/conf.sh", "source.strings[19]": "/docker-compose.yml", "source.strings[20]": "/docker-compose.yml.", "source.strings[21]": "Kill command not successful", "source.strings[22]": "PYTHON_VERSION=", "source.strings[23]": "PYTHON_VERSION=${PYTHON_VERSION}", "source.strings[24]": "Python ", "source.strings[25]": "Python ${PYTHON_VERSION}", "source.strings[26]": "Server is not running", "source.strings[27]": "Server was supposed to stop, it is running", "source.strings[28]": "docker binary not found, but required.", "source.strings[29]": "docker-compose binary not found, but required.", "source.strings[30]": "docker-compose exec ", "source.strings[31]": "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} kill -2 1", "source.strings[32]": "docker-compose exec $( tty -s \u0026\u0026 echo || echo '-T' ) ${NAME1} ps || true", "source.strings[33]": "docker-compose kill || true 2\u003e/dev/null", "source.strings[34]": "docker-compose kill || true 2\u003e/dev/null", "source.strings[35]": "docker-compose logs", "source.strings[36]": "docker-compose ps", "source.strings[37]": "docker-compose ps --filter 'status=running' --services | grep ", "source.strings[38]": "docker-compose ps --filter 'status=running' --services | grep ${NAME1}", "source.strings[39]": "docker-compose pull", "source.strings[40]": "docker-compose rm -f || true 2\u003e/dev/null", "source.strings[41]": "docker-compose up -d", "source.strings[42]": "docker-compose.yml not found in: ", "source.strings[43]": "docker-compose.yml not found in: ${COMPOSEDIR}/docker-compose.yml.", "source.strings[44]": "scanner", "source.strings[45]": "sleep ", "source.strings[46]": "sleep ${WAIT_SHUTDOWN}", "source.strings[47]": "sleep ${WAIT_STARTUP}" }, "ct": [ "break", "cd", "command", "dirname", "echo", "exit", "print_error", "print_h2", "print_test_case", "pwd", "run", "run_fail", "set", "sleep", "source", "tty" ], "id": "shell" }, "id": 0, "sz": 4746, "ts": [ { "c": 1.0, "d": "shell code embedded in string", "e": [ "docker-compose ps --filter 'status=running' --services | grep ${NAME1}", "docker-compose ps --filter 'status=running' --services | grep" ], "i": "metadata/lang/embedded::shell", "l": 2, "el": [ "embedded@0xaf7:0xaf7", "embedded@0xaf8:0xaf8" ] }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 143.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/process/daemonize/detach::redirect-dev-null", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory path literal", "e": [ "/.lib/", "/.env" ], "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "l": 1, "el": [ "7f", "599" ] }, { "a": "T1552.001", "c": 0.8799999952316284, "d": "Targets notebook/web-stack config or scheduler state", "e": [ "docker-compose.yml" ], "i": "objectives/discovery/host/application/endpoint::notebook-stack-config-targets", "l": 3 }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Generic env-based shebang line", "e": [ "#!/usr/bin/env bash" ], "i": "metadata/lang/shebang::env-interpreter", "l": 2 }, { "c": 0.6000000238418579, "d": "Stderr redirected to /dev/null", "e": [ "2\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::stderr-to-dev-null", "l": 2 }, { "c": 0.699999988079071, "d": "grep command keyword", "e": [ "grep" ], "i": "micro-behaviors/fs/search::grep-keyword", "l": 1 }, { "c": 0.8799999952316284, "d": "Source or test deletion target", "e": [ "TEST" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test", "l": 1 }, { "c": 1.0, "d": "Bash shell shebang line", "e": [ "#!/usr/bin/env bash" ], "i": "metadata/lang/shebang::bash", "l": 2 }, { "a": "T1070.004", "c": 0.800000011920929, "d": "rm -f shell command (force, non-recursive)", "e": [ "docker-compose rm -f || true 2\u003e/dev/null" ], "i": "micro-behaviors/fs/directory/delete::rm-f", "l": 1, "m": "C0047", "el": [ "88c" ] }, { "c": 0.20000000298023224, "d": "pwd keyword", "e": [ "pwd" ], "i": "micro-behaviors/data/text/keywords/lexicon::pwd", "l": 1 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "a": "T1543", "c": 0.8199999928474426, "d": "Launch helper used with /root binary", "e": [ "exec " ], "i": "objectives/persistence/system/init/script::root-binary-launcher", "l": 1 }, { "c": 1.0, "d": "Shell script extension family A", "e": [ "run.sh" ], "i": "metadata/file/extension::shell-a", "l": 2 }, { "a": "T1046", "c": 0.8500000238418579, "d": "References hidden scripts", "e": [ "./.lib" ], "i": "objectives/discovery/network/scan/port::dotfiles-in-script", "l": 1, "m": "E1046" }, { "c": 0.8799999952316284, "d": "Destructive cleanup verb", "e": [ "CLEAN" ], "i": "micro-behaviors/data/text/keywords/lexicon::cleanup-verb", "l": 1 }, { "c": 1.0, "d": "scanner word", "e": [ "scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1 }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "\"Python " ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "c": 0.800000011920929, "d": "Combined stdout+stderr redirect to /dev/null", "e": [ "\u003e/dev/null 2\u003e\u00261" ], "i": "micro-behaviors/os/console/io::null-redirect-stdout-stderr", "l": 2 }, { "a": "T1552.001", "c": 0.30000001192092896, "d": "Dotenv environment file path reference", "e": [ "/.env" ], "i": "objectives/credential-access/cloud/token::dotenv-file-dup", "l": 3, "el": [ "599" ] } ], "sha": "2f0ec93cfd3e36d6f41fa7dcc3cbeb5b1bac953943ffc4344bd06603a7c01c30", "path": "/data/samples/bad/projects/pwncat/tests/smoke/300---tcp---port_scan---no_banner/run.sh", "type": "shell" } ], "tv": "35641" } }