Benign Download

jvm.yaml

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-2565686c28ddd597c5a369f0d85f6e12737909be4b4defdd102692624599bca1ab2
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 2–15
2:20…
3 for: [java, kotlin, class, java_class, jar]
4 attack: T1041
5
6traits:
7 - id: jvm-unix-secret-file-set
8 desc: JVM Unix secret file set
9 crit: suspicious
10 conf: 0.92
11 if:
⋯4 lines
Secret-data term token lines 16–18
16:74…
17 # documentation, not JVM credential collection.
18 - id: metadata/package/documentation/manpage: …
Hidden path prefix in /tmp lines 27–41
27:41… .pgpass'
28
29 - id: jvm-sensitive-dump-path
30 desc: JVM sensitive dump path
31 crit: suspicious
32 conf: 0.9
33 if:
34 type: text
35 substr: /tmp/.sensitive_data
36
37 - id: jvm-bulk-config-secret-scan
⋯4 lines
Data-transfer verb token lines 79–82
79:50… profile/http::jvm-collect-octet-post
80
81 - id: jvm-home-credential-http-exfil
82 desc: JVM home cred …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.