{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.03974149003624916, "class": 0 } ], "prob": 0.03974149, "class": 0, "models": [ { "m": "az", "prob": 0.03974149, "class": 0 }, { "m": "az/scripts", "prob": 0.015207841, "class": 0 }, { "m": "az/shell", "prob": 0.007598466, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T06:44:42Z" }, "path": "cachyos-config.zsh", "raw": { "v": "4", "fs": [ { "f": "O₄(CErP₂S)H₄(CmPo₂DbOs)Md(Pa)", "x": 6, "id": 0, "is": [ "source", "source", "source", "source", "tput", "tput", "tput", "tput", "tput", "tput", "alias", "alias", "nproc", "nproc", "alias", "alias", "nproc", "nproc", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "alias", "pacman", "pacman", "alias", "alias", "alias", "alias", "source", "source", "source", "source", "source", "source", "source", "source", "source", "source", "source", "source" ], "ms": { "text": { "digit_ratio": 0.01, "space_count": 495.0, "total_lines": 103.0, "char_entropy": 5.14, "unique_chars": 84.0, "import_density": 56.31, "string_density": 0.48, "avg_line_length": 33.74, "max_line_length": 91.0, "empty_line_ratio": 0.31, "last_line_length": 30.0, "most_common_char": "-", "whitespace_ratio": 0.17, "most_common_ratio": 0.07, "line_length_stddev": 28.84, "normalized_import_count": 5.71, "normalized_string_count": 4.83, "suspicious_string_ratio": 0.1, "suspicious_comment_ratio": 0.03, "max_inline_whitespace_run": 1.0 }, "imports": { "total": 58.0, "unique_modules": 5.0, "third_party_count": 58.0, "third_party_ratio": 1.0 }, "strings": { "total": 49.0, "avg_length": 20.04, "max_length": 66.0, "path_count": 6.0, "avg_entropy": 3.24, "total_bytes": 982.0, "entropy_stddev": 0.89, "high_entropy_count": 2.0, "shell_command_strings": 5.0 }, "comments": { "chars": 1888.0, "lines": 35.0, "total": 35.0, "to_code_ratio": 0.51, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": {} }, "ss": [ [ 247, "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ], [ 279, "/p10k-instant-prompt-" ], [ 334, "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ], [ 366, "/p10k-instant-prompt-" ], [ 458, "/usr/share/oh-my-zsh" ], [ 459, "/usr/share/oh-my-zsh" ], [ 582, "true" ], [ 583, "true" ], [ 674, "true" ], [ 675, "true" ], [ 788, "true" ], [ 789, "true" ], [ 1067, "${plugins[*]}" ], [ 1472, "(\\\u0026|[bf]g|c|clear|history|exit|q|pwd|* --help)" ], [ 1473, "(\\\u0026|[bf]g|c|clear|history|exit|q|pwd|* --help)" ], [ 1663, "$(tput bold 2\u003e /dev/null; tput setaf 2 2\u003e /dev/null)" ], [ 1741, "$(tput sgr0 2\u003e /dev/null)" ], [ 1986, "history -a; $PROMPT_COMMAND" ], [ 1987, "history -a; " ], [ 2332, "make -j`nproc" ], [ 2333, "make -j" ], [ 2361, "ninja -j`nproc" ], [ 2362, "ninja -j" ], [ 2387, "ninja" ], [ 2388, "ninja" ], [ 2403, "clear" ], [ 2404, "clear" ], [ 2423, "sudo pacman -Rsn" ], [ 2424, "sudo pacman -Rsn" ], [ 2456, "sudo pacman -Scc" ], [ 2457, "sudo pacman -Scc" ], [ 2491, "sudo rm /var/lib/pacman/db.lck" ], [ 2492, "sudo rm /var/lib/pacman/db.lck" ], [ 2537, "sudo pacman -Syu" ], [ 2538, "sudo pacman -Syu" ], [ 2593, "man pacman" ], [ 2594, "man pacman" ], [ 2620, "man pacman" ], [ 2621, "man pacman" ], [ 2646, "sudo" ], [ 2647, "sudo" ], [ 2662, "nc termbin.com 9999" ], [ 2663, "nc termbin.com 9999" ], [ 2727, "sudo pacman -Rsn $(pacman -Qtdq)" ], [ 2728, "sudo pacman -Rsn " ], [ 2815, "journalctl -p 3 -xb" ], [ 2816, "journalctl -p 3 -xb" ], [ 2876, "expac --timefmt='%Y-%m-%d %T' '%l\\t%n %v' | sort | tail -200 | nl" ], [ 2877, "expac --timefmt='%Y-%m-%d %T' '%l\\t%n %v' | sort | tail -200 | nl" ] ], "sz": 3578, "ts": [ { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 103.00" ], "i": "metadata/package/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "nc command invocation", "e": [ "nc termbin.com 9999" ], "i": "micro-behaviors/communications/socket/netcat::nc", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "a": "T1070.003", "c": 0.75, "d": "PROMPT_COMMAND= assignment", "e": [ "PROMPT_COMMAND=" ], "i": "objectives/evasion/indicator-removal/history::prompt-command-unset", "l": 3, "m": "F0005" }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e /dev/null" ], "i": "micro-behaviors/process/daemonize::redirect-dev-null", "l": 1 }, { "c": 1.0, "d": "shell script command substitution", "e": [ "`less`" ], "i": "micro-behaviors/process/create/shell::command-substitution", "l": 2 }, { "c": 1.0, "d": "Pacman package database directory", "e": [ "/var/lib/pacman" ], "i": "micro-behaviors/fs/path/package-manager::pacman-db", "l": 2 }, { "a": "T1037.004", "c": 0.8399999737739563, "d": "zsh shell init persistence", "e": [ ".zshrc" ], "i": "objectives/persistence/system::shell-init-zsh", "l": 3 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8199999928474426, "d": "Shell RC file path in script text", "e": [ ".zshrc" ], "i": "objectives/persistence/login/shell/config::shell-rc-target-text", "l": 3 }, { "d": "$HOME variable reference", "e": [ "$HOME" ], "i": "micro-behaviors/os/env/vars::dollar-home", "l": 1 }, { "c": 0.699999988079071, "d": "Termbin reference (netcat-based)", "e": [ "termbin.com" ], "i": "objectives/command-and-control/infrastructure::termbin", "l": 3 }, { "a": "T1027.004", "c": 0.800000011920929, "d": "Make invocation with flags", "e": [ "make -j" ], "i": "micro-behaviors/process/create/shell::make-invocation-flag", "l": 3 }, { "c": 0.699999988079071, "d": "zsh shell reference", "e": [ "zsh" ], "i": "micro-behaviors/process/create/shell::zsh-exec", "l": 3 }, { "a": "T1195.002", "d": "netcat command", "e": [ "nc termbin.com 9999" ], "i": "objectives/supply-chain/install-hook/build::nc-cmd", "l": 3 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 56.31" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 } ], "sha": "343cea9bd86f9d430b7d98cfaa351cca8a9b90921fba6ec2cdf3b3969595faf3", "path": "cachyos-config.zsh", "type": "shell" } ], "tv": "b2c18" } }