Benign Download

45/cf/45cfc2bfb598f2c5164fbac5968d1d73767b13fdc4f4c979318b48d7459afd07

Hidden path prefix in /tmpComposite catalog lists alternative rules

SHA-25645cfc2bfb598f2c5164fbac5968d1d73767b13fdc4f4c979318b48d7459afd07

Evidence

Top-level traits or composite_rules key lines 1–40

1defaults:
2  platforms: [netscaler, appliance, unix]
3  for: [swift]
4  attack: T1574.006
5
6traits:
7  - id: swift-ld-preload-path
8    desc: Swift ld.so.preload path
9    crit: suspicious
10    conf: 0.92
11    if:
⋯7 lines
19    if:
20      type: text
21      substr: /tmp/.netscaler_hook.so
22
23  - id: swift-glibc-preload-write
⋯17 lines