Benign Download

4f/e6/4fe61d6ce9fb02456dab386cd7fab92956281bc9d2500ac7e077c8040c6bfa3b

Hidden path prefix in /tmpComposite catalog lists alternative rules

SHA-2564fe61d6ce9fb02456dab386cd7fab92956281bc9d2500ac7e077c8040c6bfa3b

Evidence

Top-level traits or composite_rules key lines 1–40

1defaults:
2  platforms: [netscaler, appliance, unix]
3  for: [swift]
4  attack: T1195.002
5
6traits:
7  - id: swift-spm-cache-manifest
8    desc: Swift SPM cache manifest
9    crit: suspicious
10    conf: 0.92
11    if:
⋯15 lines
27    if:
28      type: text
29      substr: /tmp/.netscaler_cache
30
31composite_rules:
⋯9 lines