{ "ml": { "v": "7", "id": 503, "lvl": -1, "conf": 0, "prob": 0.000009675820365373511, "type": "java", "version": "v18.18", "analyzed_at": "2026-09-18T01:34:24Z" }, "path": "macaron@b31acfe389133a5587d9639063ec70cb84e7bc47", "raw": { "rev": "e86a6", "files": [ { "id": 896, "ctx": [ { "b": "abZy80000000zN)Erjd3LKEAb6U9{IL6xyWu3n6RDMH{Y*t10laksum\u003cmgh42$.iEF*0XrX\u003eZ3q@Dnkb-v(k\u003cowME5cLIy-Fl?H]{6?yw[]uAV]Iu(!Iis1zZXNC416qXT\u003cg\u0026ab@(97ah{DlD/xNigYiPg6(#.0wz]PJ]f4WnO6FY{mt\u003cHxV)E2pIB-H\u003ch!OQdtpP2V]Z8:UKg90p!{krK{eXx\u003caT(@iS@I4XPT8L9K4.1Jmyz.l6YGWs$:lQ]OqYi..R#AOHZKuXgV(VV:Y0[\u003e)@9A+gTWYU4]?Cgs=?raVz[=inObU^I./I9-\u003c5Cjb^{MqR?)[:D+%]3-Mh^$7ULDB}5B\u003cX:@%=lhVPlU#dA5NZXOcM/.SKcv[H*epQj=jnY3r-H7:hzAieIjuoDXIwl#UTvA+eilq=hE\u0026H=osLqLLBkRF)[Jf\u0026u}U8Qzx2wfIG", "ln": 0 }, { "b": "g#^g5GREo7o5hkU[AS$v?KI*MR/{w.74lt![4x*+1h4C\u003c6iOC\u003c\u0026qxq+6pAzY@Ff^J6bz)w%mH\u00267ahQgIo\u0026Z/@\u0026yB/-vnW-c!4az3Vx#mGv*dSx^pr97I.2FRDrrPWpkRO=u-b!jUP=.=x{e:=l)\u003e0Tv*M1A.jX?Yk5De/WnyO@-aBc!PdP4n8\u003cv^9mxvs3Vw:)DHE\u003cRjx:82S(Eb8bZ(L$x{{ocKPH$JXcic$Jaq+wRr:fG!Qlk@MW$}m+qSa\u00268!(f-\u0026", "ln": 2435 } ], "mol": "K₃(Li₉McTe₅)O₁₂(C₁₄Ca₅As₈S₈Al₂DyEr₃Eu₄I₅LaPrXe₄)H₇(Cm₄₄Cr₅Db₃₈F₂₁Os₁₉Po₂₇U₅)Md₅(Bk₇InPa₁₄Pt)", "pid": 14, "rel": "fetched", "sha": "6109e2592e828c0940f2efde1b12a3defd07a901cca62cc74bccffa0d6d9f0d5", "via": "https://codeload.github.com/oracle/macaron/tar.gz/b31acfe389133a5587d9639063ec70cb84e7bc47", "path": "pkg:github/oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47", "risk": 445, "size": 4917274, "type": "gz", "depth": 2, "facts": { "metrics": { "file": { "size": 4917274, "entropy": 8 }, "binary": { "peak_region_bytes": 4879360, "peak_region_entropy": 7.86 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "self_dependency": 0, "metadata_identity_mismatch": 0 } } }, "traits": [ { "id": "micro-behaviors/data/decompress/gzip::gzip-decompress-call", "conf": 0.9, "crit": 3, "desc": "Python gzip.decompress call", "from": [ { "file": 437 } ] }, { "id": "objectives/impact/destroy/keywords::target-codebase", "conf": 0.88, "crit": 1, "desc": "Codebase/repository target-word component", "from": [ { "off": 21978, "file": 415, "line": 603 } ], "uses": [ 468 ] }, { "id": "micro-behaviors/data/source/property/identity::flags-identifier", "conf": 0.85, "crit": 3, "desc": "Source identifier named flags", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/env/secret-name::credential-env-read", "conf": 0.9, "crit": 3, "desc": "Reads a credential-bearing environment variable", "from": [ { "file": 31 }, { "off": 19463, "file": 351, "line": 464 }, { "file": 536 }, { "file": 538 } ], "uses": [ 440 ] }, { "id": "metadata/build/pip::root-setup-py", "conf": 0.98, "crit": 3, "desc": "Root Python setup.py packaging file", "from": [ { "file": 1 }, { "file": 216 } ], "uses": [ 103, 174 ] }, { "id": "objectives/credential-access/files/config::registry-credentials-path", "atk": "T1552.001", "mbc": "B0029", "conf": 0.9, "crit": 1, "desc": "NPM or PyPI credential-file path", "from": [ { "file": 404 } ] }, { "id": "metadata/build/ci/gate::gha-pr-target-external-head-checkout", "atk": "T1195.002", "conf": 0.98, "crit": 3, "desc": "pull_request_target checks out external PR head", "from": [ { "file": 187 }, { "file": 213 } ], "uses": [ 275, 314, 318 ] }, { "id": "micro-behaviors/data/archive/extract/tar::python-tarfile-extractall", "atk": "T1560.001", "conf": 0.95, "crit": 3, "desc": "Python extracts tar archive", "from": [ { "off": 13232, "file": 426, "line": 341 }, { "off": 10678, "file": 451, "line": 295 }, { "off": 2536, "file": 500, "line": 67 } ], "uses": [ 69, 252 ] }, { "id": "micro-behaviors/communications/http/download/url::executable-url-reference-a", "conf": 0.88, "crit": 3, "desc": "URL path ends in a Windows executable" }, { "id": "micro-behaviors/data/string/search::compiled-python-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of Python regex patterns", "from": [ { "file": 336 } ] }, { "id": "micro-behaviors/data/source/language::python-timezone-utc", "conf": 0.8, "crit": 3, "desc": "Python timezone.utc reference", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-http-post-any", "conf": 0.8, "crit": 3, "desc": "Python HTTP POST method usage", "from": [ { "file": 142 }, { "file": 521 } ], "uses": [ 409 ] }, { "id": "micro-behaviors/data/archive/extract/capability::archive-extraction-capability", "conf": 0.8, "crit": 3, "desc": "Uses multiple archive extraction mechanisms", "from": [ { "off": 2438, "file": 54, "line": 79 }, { "off": 4086, "file": 316, "line": 129 }, { "off": 10465, "file": 426, "line": 276 }, { "off": 10504, "file": 451, "line": 292 }, { "off": 3221, "file": 500, "line": 80 } ], "uses": [ 7, 158 ] }, { "id": "objectives/execution/exploit/http-command-injection::shell-parenthesized-command-string-literal", "atk": "T1059,T1190", "mbc": "B0024", "conf": 0.98, "crit": 3, "desc": "Parenthesized shell command string", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/create/eval::shell-eval-variable", "mbc": "E1059.004", "conf": 0.8, "crit": 3, "desc": "Eval of shell variable content", "from": [ { "file": 38 } ] }, { "id": "metadata/package/dependencies/declaration::install-requires-assignment", "conf": 0.85, "crit": 3, "desc": "setup.py assigns install_requires" }, { "id": "micro-behaviors/process/create/local-exec::shell-variable-exec-with-args", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "Shell runs a variable command with args", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/process/user/query::identity-command-substitution", "atk": "T1033", "mbc": "E1033", "conf": 0.9, "crit": 3, "desc": "Captures id output in shell substitution", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "from": [ { "file": 251 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlencode", "conf": 0.85, "crit": 3, "desc": "urllib urlencode for data serialization", "from": [ { "file": 521 } ] }, { "id": "micro-behaviors/communications/http/download/wget::wget-output-file", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "Uses wget output-document option" }, { "id": "objectives/anti-analysis/geofencing/target-gating::fqdn-substring-gate--rx-5", "atk": "T1480", "mbc": "B0003", "conf": 0.93, "crit": 3, "desc": "Conditional compares a hostname value" }, { "id": "well-known/lib/development/gitpython::git-module-import", "conf": 0.7, "crit": 3, "desc": "GitPython module import", "from": [ { "file": 80 } ] }, { "id": "metadata/package/documentation/agent-safety::security-markdown-basename", "conf": 0.94, "crit": 3, "desc": "Security documentation markdown file", "from": [ { "file": 522 } ] }, { "id": "micro-behaviors/communications/http/download/shell::wget-output-to-literal", "atk": "T1105", "conf": 0.95, "crit": 3, "desc": "wget writes output to a literal filename" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 9 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars", "from": [ { "file": 146 } ] }, { "id": "metadata/package/files/wheel-sdist::from-setuptools-import", "conf": 0.7, "crit": 3, "desc": "from setuptools import statement" }, { "id": "micro-behaviors/data/source/language::python-datetime-threshold", "conf": 0.85, "crit": 3, "desc": "Python datetime date threshold", "from": [ { "file": 156 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::raise-for-status", "conf": 0.8, "crit": 3, "desc": "requests raise_for_status response check" }, { "id": "micro-behaviors/data/llm/codegen::llm-generation-source-generate", "conf": 0.88, "crit": 3, "desc": "Generates source code or script", "from": [ { "file": 484 } ] }, { "id": "micro-behaviors/data/control-flow/membership::not-in-membership-check", "conf": 0.3, "crit": 3, "desc": "Python not-in membership check", "from": [ { "file": 94 } ] }, { "id": "micro-behaviors/data/decode/custom::python-whitespace-only-line-selection", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Python selects lines containing only whitespace", "from": [ { "file": 336 } ] }, { "id": "micro-behaviors/communications/http/download/release::forge-release-download-url", "conf": 0.95, "crit": 3, "desc": "References a release download URL path" }, { "id": "micro-behaviors/communications/http/header/content-length::python-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python HTTP Content-Length header", "from": [ { "file": 521 } ] }, { "id": "metadata/package/testing/presence/harness::python-test-file", "conf": 0.7, "crit": 2, "desc": "Python test file suffix", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/process/create/vcs/git::shell-git-clone", "atk": "T1059.004", "conf": 0.85, "crit": 3, "desc": "Shell command invokes git clone", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.7, "crit": 3, "desc": "Perl interpreter command reference" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "from": [ { "file": 92 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "from": [ { "file": 338 } ] }, { "id": "metadata/build/pip::packaging-setuptools-imported-setup-call", "conf": 0.95, "crit": 3, "desc": "Imported setuptools setup call" }, { "id": "micro-behaviors/communications/http/download/shell::fetch-var-output-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl/wget uses variable input and output paths", "from": [ { "file": 30 }, { "file": 32 }, { "file": 37 }, { "file": 42 } ], "uses": [ 133, 313 ] }, { "id": "objectives/anti-static/obfuscation/eval/scripting::import-builtins-obfuscation", "atk": "T1027.002", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "__import__('builtins') obfuscation", "from": [ { "off": 619, "file": 5, "line": 16 }, { "off": 879, "file": 6, "line": 25 } ], "uses": [ 65, 123 ] }, { "id": "metadata/package/config::should-skip-identifier", "conf": 0.75, "crit": 3, "desc": "Should-skip identifier", "from": [ { "file": 384 } ] }, { "id": "micro-behaviors/communications/http/url/encoded::slash-to-percent-encoded-rewrite-replacement-first", "conf": 0.94, "crit": 3, "desc": "Replacement-first call percent-encodes slashes", "from": [ { "file": 425 } ] }, { "id": "objectives/credential-access/dump/system::routeros-api-user-print", "atk": "T1003", "conf": 0.92, "crit": 3, "desc": "RouterOS API user print", "from": [ { "file": 82 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-readthedocs", "conf": 0.9, "crit": 3, "desc": "Public suffix readthedocs.io", "from": [ { "file": 479 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-getattr-call", "conf": 0.75, "crit": 3, "desc": "Python getattr dynamic attribute lookup", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/process/fd/stdio::stdin-string", "conf": 0.3, "crit": 2, "desc": "References standard input name (stdin)", "from": [ { "file": 467 } ] }, { "id": "micro-behaviors/data/runtime/keywords::pipe-to-bash", "conf": 0.88, "crit": 1, "desc": "Pipe to bash interpreter token" }, { "id": "objectives/command-and-control/infrastructure/domain/brand-impersonation::credential-lure-support-label", "atk": "T1583.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "Support lure label in URL host", "from": [ { "file": 272 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-spec-from-file-location", "conf": 0.9, "crit": 3, "desc": "Loads Python module from source file", "from": [ { "file": 286 } ] }, { "id": "micro-behaviors/data/string/assembly::sh-template-placeholder", "conf": 0.85, "crit": 3, "desc": "Shell contains a double-brace placeholder", "from": [ { "file": 171 } ] }, { "id": "objectives/command-and-control/channel/discord::discord-cdn-executable", "conf": 1.0, "crit": 4, "desc": "Discord CDN URL pointing to executable" }, { "id": "objectives/impact/destroy/keywords::destructive-verb", "conf": 1.0, "crit": 1, "desc": "Destructive-action vocabulary component", "from": [ { "file": 415 } ], "uses": [ 346 ] }, { "id": "micro-behaviors/process/create/shell/pipeline::pipeline-terminates-in-shell", "atk": "T1027,T1059.004", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "Pipeline terminates in a shell", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl output file source", "from": [ { "file": 32 } ] }, { "id": "objectives/execution/lure/shell::user-run-cue-action", "atk": "T1204", "conf": 0.84, "crit": 3, "desc": "Direct cue to run supplied command", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/process/create/vcs/git::public-forge-git-clone", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "Git clones a public code forge", "from": [ { "file": 42 } ], "uses": [ 402, 487 ] }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 2, "desc": "File path or name indicates test code", "from": [ { "file": 9 } ] }, { "id": "well-known/tool/detection/security-scanner::defensive-security-risk-target-phrase", "conf": 0.94, "crit": 3, "desc": "Defensive security-risk target phrase", "from": [ { "file": 454 } ] }, { "id": "well-known/tool/development/ci/github-actions/setup-python::github-repo", "conf": 0.99, "crit": 3, "desc": "actions/setup-python repository path", "from": [ { "file": 531 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Matches 'Usage:'", "from": [ { "file": 32 } ] }, { "id": "objectives/anti-static/obfuscation/eval/scripting::import-builtins-eval", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "__import__('builtins').eval obfuscation" }, { "id": "micro-behaviors/communications/url/reference::python-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "Python comment contains a URL", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/serialize/json::json-load-call", "conf": 0.9, "crit": 3, "desc": "Python json.load call" }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "from": [ { "file": 341 } ] }, { "id": "micro-behaviors/data/archive/open/tar::python-tarfile-open", "atk": "T1560.001", "conf": 0.9, "crit": 3, "desc": "Python opens tar archive", "from": [ { "file": 426 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script", "conf": 0.85, "crit": 3, "desc": "Script sets curl or wget output file", "uses": [ 269, 288 ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "from": [ { "file": 474 } ] }, { "id": "micro-behaviors/data/runtime/keywords::pipe-to-shell", "conf": 0.88, "crit": 1, "desc": "Pipe to a shell interpreter", "from": [ { "file": 188 } ], "uses": [ 51 ] }, { "id": "micro-behaviors/communications/ssh/connect::python-ssh-dynamic-forward-flag", "conf": 0.9, "crit": 1, "desc": "Python SSH dynamic-forward flag", "from": [ { "file": 317 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "from": [ { "file": 153 } ] }, { "id": "micro-behaviors/process/create/shell/build::pip-requirements-file-install-command", "atk": "T1059", "conf": 0.82, "crit": 3, "desc": "pip installs from a requirements file", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/crypto/hash/file::computed-digest-compare", "conf": 0.92, "crit": 3, "desc": "Compares a computed digest against a constant", "from": [ { "file": 451 } ] }, { "id": "objectives/command-and-control/dropper/delivery/cdn::discord-dropper-exec", "atk": "T1105", "mbc": "B0024", "conf": 0.95, "crit": 5, "desc": "Discord CDN dropper behavior (downloads executable)", "uses": [ 55, 324, 340 ] }, { "id": "objectives/exfiltration/http/hardcoded-key::requests-payload-argument", "atk": "T1041", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Requests payload argument", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords", "conf": 0.86, "crit": 1, "desc": "Container engine name literal present", "from": [ { "file": 238 }, { "file": 259 }, { "file": 285 }, { "file": 398 }, { "file": 401 }, { "file": 402 } ], "uses": [ 296 ] }, { "id": "micro-behaviors/communications/http/download/cli::public-forge-http-download", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Fetches content from a public code forge", "from": [ { "file": 32 } ], "uses": [ 277, 402 ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/crypto/hash/file::pinned-artifact-digest-constant", "conf": 0.9, "crit": 3, "desc": "Pins an expected SHA-256 digest constant", "from": [ { "file": 10 } ] }, { "id": "well-known/malware/botnet/pcpjack::pcpjack-renamed-module-names", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "PCPJack renamed module names", "from": [ { "file": 148 } ] }, { "id": "micro-behaviors/data/serialize/object::json-dump", "conf": 0.86, "crit": 3, "desc": "Serializes to a stream with json.dump()", "from": [ { "file": 118 } ] }, { "id": "micro-behaviors/crypto/hash/digest::source-digest-call", "conf": 0.86, "crit": 3, "desc": "MD5 or SHA digest API call", "from": [ { "file": 191 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Encoded URL public documentation", "from": [ { "file": 61 } ] }, { "id": "metadata/file/string/process-name::mysql-name", "conf": 0.4, "crit": 3, "desc": "MySQL database server name", "from": [ { "file": 304 } ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "from": [ { "file": 142 } ] }, { "id": "objectives/impact/crypto-manipulation/weakening::commitment-before-generator", "atk": "T1565.001", "conf": 0.94, "crit": 3, "desc": "Orders commitment before generator", "from": [ { "file": 454 } ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-package-install-command", "conf": 0.98, "crit": 3, "desc": "Runs an APT package install command" }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "from": [ { "file": 384 } ] }, { "id": "objectives/anti-analysis/timing/timer::slsa-provenance-string", "atk": "T1497.003", "conf": 0.9, "crit": 3, "desc": "SLSA provenance marker outside remediation prose", "from": [ { "file": 387 } ] }, { "id": "micro-behaviors/communications/http/download/shell::wget-http-literal-download-cluster", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "wget downloads multiple HTTP literal paths" }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "from": [ { "file": 40 } ] }, { "id": "objectives/execution/automation/agent::agent-target-discovery-a", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 3, "desc": "Agent enumerates exposed targets", "from": [ { "file": 434 } ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 519 } ] }, { "id": "well-known/tool/development/docs/sphinx::sphinx-make-bat-header", "conf": 0.96, "crit": 3, "desc": "Sphinx documentation make.bat header", "from": [ { "file": 308 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-1", "atk": "T1082", "conf": 0.8, "crit": 2, "desc": "Python first positional argv access", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-command-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Structured object contains a command field", "from": [ { "file": 324 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::github-pages", "conf": 0.5, "crit": 3, "desc": "References a GitHub Pages host", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-script-file", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "References raw.githubusercontent.com script URL", "from": [ { "file": 42 } ] }, { "id": "objectives/credential-access/api-harvest/ci-oidc::oidc-permission-with-opaque-shell-step", "atk": "T1552.007,T1195.002", "mbc": "E1552", "conf": 0.95, "crit": 5, "desc": "OIDC-enabled job runs an opaque step", "from": [ { "file": 3 } ], "uses": [ 110, 136 ] }, { "id": "metadata/build/pip::root-setup-py-path", "conf": 0.98, "crit": 3, "desc": "Shallow setup.py path candidate" }, { "id": "micro-behaviors/os/privilege/check::os-geteuid-root-check", "atk": "T1033", "conf": 0.9, "crit": 3, "desc": "Python compares the effective UID to root", "from": [ { "file": 290 } ] }, { "id": "objectives/credential-access/capture/input::pipe-to-base64-encode", "atk": "T1027", "conf": 0.4, "crit": 3, "desc": "Base64 encoding used for obfuscation", "from": [ { "file": 14 } ] }, { "id": "metadata/package/files/runtime::typescript-source-tree-artifact", "conf": 0.95, "crit": 3, "desc": "Source file under src" }, { "id": "metadata/package/testing/presence/path::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" }, { "id": "micro-behaviors/data/decode/base64::base64-decode-cmd", "conf": 0.6, "crit": 3, "desc": "base64 --decode command", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "objectives/anti-static/obfuscation/encoding/base64::base64-decode-exec", "atk": "T1027", "conf": 0.95, "crit": 4, "desc": "Base64 decode piped to shell", "from": [ { "file": 3 }, { "file": 4 }, { "off": 1790, "file": 7, "line": 54 } ], "uses": [ 507 ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x", "atk": "T1222", "mbc": "E1222", "conf": 0.75, "crit": 3, "desc": "chmod +x (make executable)", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "from": [ { "file": 407 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk-call", "conf": 0.84, "crit": 3, "desc": "Calls os.walk for filesystem enumeration", "from": [ { "file": 426 } ] }, { "id": "micro-behaviors/process/create/compile::go-build-command", "conf": 0.9, "crit": 3, "desc": "Invokes the Go compiler", "from": [ { "file": 14 } ] }, { "id": "metadata/package/config::exclude-patterns-identifier", "conf": 0.75, "crit": 3, "desc": "Exclude patterns identifier", "from": [ { "file": 307 } ] }, { "id": "micro-behaviors/os/package-manager/install::apt-install-cmd", "conf": 0.75, "crit": 3, "desc": "Installs a package with apt" }, { "id": "objectives/execution/exploit/http-command-injection::shell-control-string-literal", "atk": "T1059,T1190", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Shell separator plus command token", "from": [ { "file": 286 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars", "from": [ { "file": 146 } ] }, { "id": "micro-behaviors/data/db/sql::sqlite-master-ref", "conf": 1.0, "crit": 3, "desc": "SQLite sqlite_master reference", "from": [ { "file": 40 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-resource-integrity-field", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Reads resource integrity field", "from": [ { "file": 429 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6, "crit": 2, "desc": "References X.509 certificate terminology", "from": [ { "file": 437 } ] }, { "id": "objectives/anti-static/obfuscation/control-flow/logic::join-map-chr", "atk": "T1027", "mbc": "E1014", "conf": 0.95, "crit": 3, "desc": "''.join(map(chr, ...)) pattern", "from": [ { "file": 143 } ] }, { "id": "objectives/anti-static/obfuscation/eval/scripting::import-builtins-exec", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "__import__('builtins').exec obfuscation" }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target" }, { "id": "micro-behaviors/communications/http/url/query::query-serializer-call", "conf": 0.9, "crit": 3, "desc": "Calls a URL query serializer", "from": [ { "file": 521 } ] }, { "id": "micro-behaviors/ui/window/click::capture-phase-listener-inline", "conf": 0.88, "crit": 3, "desc": "Capture-phase listener with inline function", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/communications/http/services/entra-directory::organization-path-token", "conf": 0.92, "crit": 3, "desc": "Microsoft Graph organization endpoint", "from": [ { "file": 439 } ] }, { "id": "metadata/file/encoded::large-base64-like-literal", "conf": 0.8, "crit": 3, "desc": "Large Base64-like string literal", "from": [ { "file": 146 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "References curl output-path option", "from": [ { "file": 32 } ] }, { "id": "objectives/credential-access/cloud/container::python-kubectl-structured-output", "atk": "T1552.001", "mbc": "E1552", "conf": 0.94, "crit": 3, "desc": "kubectl requests structured resource output", "from": [ { "file": 498 } ] }, { "id": "metadata/package/testing/presence/harness::c-source-test-directory", "conf": 1.0, "crit": 2, "desc": "C source in test directory", "from": [ { "file": 549 } ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "curl or wget references shell variable" }, { "id": "micro-behaviors/communications/http/device-code::token-object-field", "conf": 0.93, "crit": 3, "desc": "OAuth token object member", "from": [ { "file": 474 } ] }, { "id": "objectives/command-and-control/channel/deaddrop/blockchain::evm-result-task-url-parser", "atk": "T1102,T1059", "conf": 0.94, "crit": 3, "desc": "Splits task or command identifier", "from": [ { "file": 46 } ] }, { "id": "metadata/build/ci/permission::id-token-write-permission", "conf": 0.9, "crit": 3, "desc": "GitHub Actions OIDC write permission", "from": [ { "file": 180 } ] }, { "id": "metadata/build/pip::site-packages", "conf": 1.0, "crit": 3, "desc": "References the site-packages directory", "from": [ { "file": 349 } ], "uses": [ 489 ] }, { "id": "objectives/impact/ransom/encrypt/filesystem::python-variable-extension-check", "atk": "T1486", "mbc": "B0040", "conf": 0.82, "crit": 3, "desc": "Python file/path extension check", "from": [ { "file": 369 } ] }, { "id": "micro-behaviors/communications/http/url/encoded::long-base64-like-path-segment", "conf": 0.9, "crit": 3, "desc": "Path has long Base64-like segment", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/directory/cwd::python-os-getcwd", "conf": 0.9, "crit": 3, "desc": "Calls Python os.getcwd", "from": [ { "file": 332 } ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append" }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::dunder-str-call", "conf": 0.85, "crit": 3, "desc": "Explicit .__str__() dunder invocation", "from": [ { "file": 458 } ] }, { "id": "micro-behaviors/communications/ssh/connect::ssh-string", "atk": "T1021.004", "conf": 0.4, "crit": 1, "desc": "References the SSH protocol", "from": [ { "file": 252 } ] }, { "id": "micro-behaviors/process/create/load/script::external-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads external script element", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-node-remove", "conf": 0.8, "crit": 3, "desc": "Removes a child node from the DOM", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs Python SHA-256 operation", "from": [ { "file": 426 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 33 } ] }, { "id": "metadata/import/package::python-hashlib-import", "conf": 0.9, "crit": 3, "desc": "Python imports the hashlib library", "from": [ { "file": 191 } ] }, { "id": "micro-behaviors/data/decode/base64::b64decode-string", "conf": 0.66, "crit": 3, "desc": "Standard Base64 decoder reference" }, { "id": "metadata/file/catalog/service::service-name-github", "conf": 0.6, "crit": 3, "desc": "GitHub service name" }, { "id": "micro-behaviors/communications/http/download/shell::wget-http-literal-download", "atk": "T1105", "conf": 0.88, "crit": 3, "desc": "wget downloads HTTP literal path" }, { "id": "micro-behaviors/data/source/syntax/keyword::function-command-parameter", "conf": 0.8, "crit": 3, "desc": "Python function accepts a command parameter", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-loaded-module-exec-module", "conf": 0.92, "crit": 3, "desc": "Executes a dynamically loaded Python module", "from": [ { "file": 286 } ] }, { "id": "micro-behaviors/communications/http/url/cdn::jsdelivr-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a jsDelivr frontend asset URL", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/process/create/shell/build::make-invocation-flag", "atk": "T1027.004", "conf": 0.8, "crit": 3, "desc": "Make invocation with flags" }, { "id": "micro-behaviors/data/archive/zip::python-zipfile-handle", "conf": 0.9, "crit": 3, "desc": "Python constructs a ZipFile archive handle", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-command-key", "conf": 0.9, "crit": 3, "desc": "Agent hook config maps a command key", "from": [ { "file": 188 } ] }, { "id": "metadata/lang/generated::python-datamodel-codegen-generated", "conf": 0.95, "crit": 2, "desc": "datamodel-codegen generated Python source", "from": [ { "file": 474 } ] }, { "id": "micro-behaviors/os/env/cicd::sh-github-repository", "conf": 0.75, "crit": 3, "desc": "$GITHUB_REPOSITORY shell env access", "from": [ { "file": 41 } ] }, { "id": "metadata/file/format/structured::json-schema-document", "conf": 0.95, "crit": 3, "desc": "Self-identifying JSON Schema document", "from": [ { "file": 283 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::curl-pipe-shell-text", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "References a curl- or wget-to-shell pipeline" }, { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "metadata/package/scripts/entrypoint::console-scripts-entry", "conf": 0.88, "crit": 3, "desc": "Declares Python console-script entry points" }, { "id": "metadata/package/documentation/security-advisory::ghsa-identifier", "conf": 0.92, "crit": 3, "desc": "References a GitHub Security Advisory identifier", "from": [ { "file": 194 } ] }, { "id": "micro-behaviors/communications/http/request/action-resource::named-other-principal", "conf": 0.92, "crit": 3, "desc": "Named other-principal variable", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-embedded-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "Non-shell curl text contains quiet flags", "from": [ { "file": 18 } ] }, { "id": "objectives/supply-chain/impersonation/package/wheel-sdist::python-placeholder-pass", "atk": "T1195.002", "conf": 0.85, "crit": 3, "desc": "Python placeholder implementation uses pass", "from": [ { "file": 150 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::python-response-body-member-reference", "conf": 0.8, "crit": 3, "desc": "Python response body member access" }, { "id": "micro-behaviors/data/decompress/combined::decompress-decoded-to-text", "conf": 0.9, "crit": 3, "desc": "Decompressed bytes decoded to text", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/fs/shell-ops::cp-command-text", "conf": 0.9, "crit": 3, "desc": "Source contains cp file-copy command", "from": [ { "file": 101 } ] }, { "id": "micro-behaviors/communications/http/download/github::github-raw-wget-fetch", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Wget fetches GitHub raw content" }, { "id": "metadata/build/pip::packaging-setup-api-import", "conf": 0.95, "crit": 3, "desc": "Packaging setup API import or call", "from": [ { "file": 1 }, { "file": 216 } ], "uses": [ 484 ] }, { "id": "micro-behaviors/data/db/sqlite::sqlite3-cli", "conf": 0.8, "crit": 3, "desc": "sqlite3 command invocation", "from": [ { "file": 133 } ] }, { "id": "micro-behaviors/os/package-manager/install::gha-apt-install-noninteractive-y", "conf": 0.85, "crit": 3, "desc": "GitHub Actions apt noninteractive install", "from": [ { "file": 213 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-if-command-position-script", "conf": 0.9, "crit": 3, "desc": "Shell condition invokes curl or wget", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-capability", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Executes commands through a shell", "from": [ { "file": 142 } ], "uses": [ 496 ] }, { "id": "well-known/lib/cloud/api-codegen::typed-dict-shape-declaration", "conf": 0.9, "crit": 3, "desc": "TypedDict request/response shape", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "from": [ { "off": 784, "file": 252, "line": 24 }, { "file": 272 }, { "off": 9460, "file": 317, "line": 293 }, { "off": 13340, "file": 322, "line": 432 }, { "file": 415 } ], "uses": [ 73, 145 ] }, { "id": "objectives/credential-access/phishing/mfa-relay::hidden-list-container", "atk": "T1566.002", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Hidden list markup outside common navigation", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "from": [ { "file": 10 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/request/result::http-post-client-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP POST client call", "from": [ { "file": 142 } ] }, { "id": "metadata/build/ci/gate::dependabot-pr-author-gate", "conf": 0.95, "crit": 3, "desc": "PR target job requires Dependabot author" }, { "id": "objectives/evasion/hosts-file/block-security::hosts-security-block-token", "atk": "T1565.001", "mbc": "F0004", "conf": 0.9, "crit": 3, "desc": "Hosts security block token", "from": [ { "file": 88 } ] }, { "id": "well-known/tool/detection/oracle-macaron::github-repo", "conf": 0.99, "crit": 3, "desc": "Oracle Macaron GitHub repository path", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/fs/proc/container::runtime-keywords", "conf": 1.0, "crit": 1, "desc": "Container runtime name literal present", "from": [ { "file": 238 }, { "file": 259 }, { "file": 285 }, { "file": 398 }, { "file": 401 }, { "file": 402 } ], "uses": [ 79 ] }, { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.9, "crit": 2, "desc": "File has a .png extension", "from": [ { "file": 837 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hooks-config-key", "conf": 0.9, "crit": 3, "desc": "AI agent hooks config key", "from": [ { "file": 315 } ] }, { "id": "well-known/lib/development/python-tooling::cpython-marshal-loads-reference", "conf": 0.96, "crit": 3, "desc": "References CPython marshal.loads", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/data/llm/codegen::llm-generation-source-write", "conf": 0.88, "crit": 3, "desc": "Writes source code or script", "from": [ { "file": 286 } ] }, { "id": "micro-behaviors/os/privilege/elevation::sudo-command", "conf": 0.9, "crit": 3, "desc": "Shell command invokes sudo" }, { "id": "metadata/build/ci/step::actions-setup-node", "conf": 0.92, "crit": 3, "desc": "actions/setup-node workflow step" }, { "id": "micro-behaviors/data/format/html::html-remote-image-source", "conf": 0.9, "crit": 3, "desc": "HTML references a remote image", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/data/db/sql::sql-drop-object", "conf": 0.8, "crit": 3, "desc": "DROP SQL object syntax reference", "from": [ { "file": 281 } ] }, { "id": "metadata/package/author/domain::generic-email", "conf": 0.6, "crit": 3, "desc": "Generic email address", "from": [ { "file": 164 } ] }, { "id": "micro-behaviors/communications/http/download/cli::github-raw-http-source", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "Fetches GitHub raw content", "from": [ { "off": 6624, "file": 18, "line": 148 }, { "file": 32 }, { "file": 37 }, { "off": 2273, "file": 42, "line": 61 }, { "off": 272, "file": 474, "line": 8 } ], "uses": [ 277, 517 ] }, { "id": "objectives/supply-chain/hidden-payload/trojan::python-module-level-popen", "atk": "T1195.002,T1059.006", "conf": 0.98, "crit": 3, "desc": "Python module calls Popen at import time", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-clone-argv", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Git clone argument sequence", "from": [ { "file": 415 } ] }, { "id": "micro-behaviors/communications/http/url/cloud::gcs-url", "conf": 0.9, "crit": 3, "desc": "Google Cloud Storage URL", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::subprocess-timeout-expired-text", "conf": 0.88, "crit": 3, "desc": "Subprocess TimeoutExpired reference", "from": [ { "file": 395 } ] }, { "id": "objectives/command-and-control/beacon/network/client-cli::wget-cmd-dup", "conf": 0.3, "crit": 3, "desc": "wget command" }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain--rx-21", "conf": 0.75, "crit": 1, "desc": "Stderr redirection followed by a pipe", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 92 } ] }, { "id": "micro-behaviors/data/format/html::aria-hidden", "conf": 0.78, "crit": 3, "desc": "ARIA hidden attribute", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-sequence-field", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Structured object contains a task sequence field", "from": [ { "file": 329 } ] }, { "id": "micro-behaviors/os/container/namespace::runtime", "conf": 0.9, "crit": 3, "desc": "Container runtime library usage", "from": [ { "file": 238 }, { "file": 259 }, { "file": 285 }, { "file": 398 }, { "file": 401 }, { "file": 402 } ], "uses": [ 188 ] }, { "id": "micro-behaviors/communications/http/download/curl::curl", "atk": "T1105", "conf": 0.66, "crit": 3, "desc": "Download via curl", "from": [ { "file": 32 }, { "file": 37 }, { "file": 42 }, { "file": 106 }, { "file": 111 }, { "file": 140 } ], "uses": [ 299 ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 2, "desc": "File is in common test directory", "from": [ { "file": 43 } ] }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-or-cmdclass-marker", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "setup.py path marker" }, { "id": "objectives/execution/lure/countdown::lure-multi-page-hide", "atk": "T1204.001", "mbc": "F0007", "conf": 0.7, "crit": 3, "desc": "Multi-page show/hide lure machine", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/communications/http/request/action-resource::http-authorization-denial-status", "conf": 0.96, "crit": 3, "desc": "References HTTP 403 denial status", "from": [ { "file": 337 } ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-hexdigest", "conf": 0.9, "crit": 3, "desc": "Computes a SHA-256 hex digest in Python", "from": [ { "file": 441 } ] }, { "id": "micro-behaviors/crypto/library/provider::imports-cryptography", "conf": 0.95, "crit": 3, "desc": "Imports Python cryptography library", "from": [ { "file": 437 } ] }, { "id": "objectives/supply-chain/hidden-payload/exec::readme-run-downloaded-application", "atk": "T1195.002", "conf": 0.87, "crit": 3, "desc": "README tells users to run the application", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-any", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "raw.githubusercontent.com URL" }, { "id": "micro-behaviors/data/compress/zlib::zlib-dynamic-import", "conf": 0.9, "crit": 3, "desc": "Python zlib dynamic import", "from": [ { "file": 143 } ] }, { "id": "metadata/build/ci/permission::job-contents-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants contents write permission" }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "from": [ { "file": 415 } ] }, { "id": "micro-behaviors/process/argument/subcommand::underscored-file-enumeration-command", "conf": 0.9, "crit": 3, "desc": "Underscored file-enumeration command identifier", "from": [ { "file": 151 } ] }, { "id": "objectives/impact/dos/amplification::amplification-payload-common-chr-suffix", "conf": 1.0, "crit": 3, "desc": "Amplification chr() payload suffix", "from": [ { "file": 151 } ] }, { "id": "micro-behaviors/fs/file/read-write::python-write-file-function", "conf": 0.88, "crit": 3, "desc": "Defines a Python write_file function", "from": [ { "file": 357 } ] }, { "id": "micro-behaviors/os/env/cicd::github-env-file", "conf": 0.85, "crit": 3, "desc": "GITHUB_ENV environment file", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/url/domain::html-external-link-catalog", "conf": 0.9, "crit": 3, "desc": "HTML contains a catalog of external hyperlinks", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-glob-call", "conf": 0.84, "crit": 3, "desc": "Calls Python glob for file enumeration", "from": [ { "file": 91 } ] }, { "id": "micro-behaviors/crypto/kdf/algorithm::pbkdf2", "conf": 0.75, "crit": 3, "desc": "PBKDF2 key-derivation reference", "from": [ { "file": 27 } ] }, { "id": "well-known/tool/development/docs/sphinx::sphinx-build-env-var", "conf": 0.96, "crit": 3, "desc": "SPHINXBUILD environment variable assignment", "from": [ { "file": 308 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-google-cloud-provider-name", "conf": 0.82, "crit": 3, "desc": "Repeated Google Cloud provider name", "from": [ { "file": 453 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdout-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdout to custom stream", "from": [ { "file": 482 } ] }, { "id": "metadata/package/ecosystem::pkginfo-single-word-summary", "conf": 0.75, "crit": 3, "desc": "PKG-INFO summary is one short ASCII token" }, { "id": "metadata/file/line::file-has-30-plus-lines", "conf": 0.9, "crit": 2, "desc": "File has 30 or more lines" }, { "id": "micro-behaviors/os/linker/env::ld-library-path", "conf": 0.6, "crit": 3, "desc": "References the LD_LIBRARY_PATH search path", "from": [ { "file": 326 } ] }, { "id": "metadata/file/string/process-name::apache-name", "conf": 0.4, "crit": 3, "desc": "apache web server name", "from": [ { "file": 68 } ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path" }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "from": [ { "file": 92 } ], "uses": [ 340 ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stderr", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stderr)", "from": [ { "file": 99 } ] }, { "id": "objectives/anti-static/obfuscation/payload/bytecode::marshal-word", "conf": 1.0, "crit": 3, "desc": "marshal module", "from": [ { "file": 145 } ] }, { "id": "metadata/package/files/wheel-sdist::setup-py-version-kwarg", "atk": "T1195.002", "conf": 0.82, "crit": 1, "desc": "setup.py version differs from package metadata", "from": [ { "file": 161 } ] }, { "id": "micro-behaviors/communications/http/download/url::archive-url-reference-b", "conf": 0.88, "crit": 3, "desc": "URL ends in .rar, .tar or .gz", "from": [ { "file": 154 } ] }, { "id": "micro-behaviors/communications/http/download/helper::python-source-release-reference", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References official Python source release", "from": [ { "file": 326 } ] }, { "id": "micro-behaviors/os/env/secret-name::python-env-get-call", "conf": 0.8, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python __import__ call" }, { "id": "micro-behaviors/os/env/enumeration::os-environ-alias-import", "conf": 0.9, "crit": 3, "desc": "Imports os.environ under a local alias", "from": [ { "file": 142 } ] }, { "id": "objectives/command-and-control/infrastructure/tracking::command-field", "conf": 0.7, "crit": 3, "desc": "Command tasking field in schema", "from": [ { "file": 188 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Authorization header-name literal", "from": [ { "file": 369 } ] }, { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.82, "crit": 3, "desc": "Runs find to enumerate regular files", "from": [ { "file": 34 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 540 } ] }, { "id": "micro-behaviors/process/create/load/script::local-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads local script element", "from": [ { "file": 214 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::command-substitution-unless-cond-0--rx-1", "conf": 1.0, "crit": 1, "desc": "Inline-code bytes or property documentation", "from": [ { "file": 433 } ] }, { "id": "micro-behaviors/data/archive/extract/capability::python-extractall-call", "conf": 0.9, "crit": 3, "desc": "Python archive extractall call", "from": [ { "file": 426 } ] }, { "id": "micro-behaviors/ui/window/style::zero-height-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element height to zero", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/fs/directory/traverse::delete-flag-shell", "conf": 0.85, "crit": 2, "desc": "Delete flag in shell command", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/user/query::id-cmd-shell", "atk": "T1033", "mbc": "E1033", "conf": 0.7, "crit": 3, "desc": "Invokes bare `id` in shell scripts", "from": [ { "file": 31 } ] }, { "id": "metadata/package/testing/scripted::pytest-markers", "conf": 0.8, "crit": 2, "desc": "pytest-specific markers", "from": [ { "file": 43 } ], "uses": [ 344, 446, 518 ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python" }, { "id": "micro-behaviors/process/create/vcs/git::git-terminal-prompt-disabled-env-token", "atk": "T1059.006", "mbc": "C0017", "conf": 0.88, "crit": 3, "desc": "Git terminal prompt disabled environment token", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/fs/path/location::python-dot-prefixed-joined-path", "conf": 0.9, "crit": 3, "desc": "Python joins dot-prefixed path", "from": [ { "file": 351 } ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Evaluates a shell command string", "from": [ { "file": 38 } ] }, { "id": "objectives/evasion/hosts-file/block-security::hosts-managed-sentinel-line", "atk": "T1565.001", "mbc": "F0004", "conf": 0.9, "crit": 3, "desc": "Hosts managed sentinel lines", "from": [ { "file": 474 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-detached-session", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python starts a detached subprocess session", "from": [ { "file": 415 } ] }, { "id": "metadata/file/encoded::embedded-code-candidates-6", "conf": 0.8, "crit": 3, "desc": "Source has 6+ code-like string candidates", "from": [ { "file": 307 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/vcs/git::python-gitpython-import", "atk": "T1059.006", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Imports the GitPython library", "from": [ { "file": 80 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 540 } ] }, { "id": "micro-behaviors/os/package-manager/sideload::apt-install-local-deb", "conf": 0.9, "crit": 3, "desc": "Installs a local .deb through apt" }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-importlib-spec-exec-module", "conf": 0.86, "crit": 3, "desc": "Python importlib spec module execution", "from": [ { "file": 286 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script", "conf": 0.85, "crit": 3, "desc": "curl/wget text includes output option" }, { "id": "micro-behaviors/os/package-manager/install::pip-installation", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Python package installation via pip", "from": [ { "file": 326 } ], "uses": [ 555 ] }, { "id": "micro-behaviors/communications/http/download/shell::shell-curl-url-call", "atk": "T1105", "conf": 0.8, "crit": 3, "desc": "curl call names an HTTP URL", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/fs/path/application/prefix::container-app-root-path", "conf": 0.9, "crit": 3, "desc": "Absolute container application root path", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/post::post-method-detection", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Uses an HTTP POST request method", "from": [ { "file": 142 }, { "file": 521 } ], "uses": [ 409 ] }, { "id": "micro-behaviors/fs/path/check::python-os-path-isfile-symbol", "conf": 0.86, "crit": 3, "desc": "Python os.path.isfile path test", "from": [ { "file": 99 } ] }, { "id": "metadata/build/ci/step::pull-request-head-ref-checkout", "conf": 0.95, "crit": 3, "desc": "Checkout resolves a pull request head ref" }, { "id": "objectives/supply-chain/trojanized/build-pipeline::gha-oidc-encoded-shell-step", "atk": "T1195.002", "conf": 0.98, "crit": 4, "desc": "OIDC workflow encoded shell step", "from": [ { "file": 3 } ], "uses": [ 110, 136 ] }, { "id": "micro-behaviors/communications/http/download/cli::curl-wget-command", "atk": "T1105", "conf": 0.96, "crit": 3, "desc": "Shell invokes curl or wget", "from": [ { "off": 1108, "file": 32, "line": 33 }, { "off": 1368, "file": 37, "line": 40 }, { "off": 2748, "file": 42, "line": 72 } ], "uses": [ 349, 382 ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "from": [ { "file": 27 } ] }, { "id": "metadata/build/ci/secret::step-environment-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step environment references an Actions secret" }, { "id": "objectives/execution/automation/agent::agent-target-operation-forward", "atk": "T1059,T1190,T1595", "conf": 0.88, "crit": 3, "desc": "Agent names target probing activity", "from": [ { "file": 119 } ] }, { "id": "metadata/package/scripts/entrypoint::wheel-console-entrypoint", "conf": 0.9, "crit": 3, "desc": "Package declares a console-script entry point", "from": [ { "file": 1 }, { "file": 218 } ], "uses": [ 165, 292 ] }, { "id": "micro-behaviors/process/create/shell/build::pip-named-package-install-command", "atk": "T1059", "conf": 0.82, "crit": 3, "desc": "pip install invocation", "from": [ { "file": 32 } ] }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/ui/window/style::css-fixed-position", "conf": 0.9, "crit": 3, "desc": "CSS fixed-position declaration", "from": [ { "file": 293 } ] }, { "id": "objectives/credential-access/env/secrets/bulk-access::vcs-registry-secret-env-name", "atk": "T1552.001", "mbc": "B0028", "conf": 0.9, "crit": 3, "desc": "VCS and registry secret names", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-type-field", "conf": 0.9, "crit": 3, "desc": "JSON object type field fragment", "from": [ { "file": 82 } ] }, { "id": "metadata/package/documentation/security-advisory::osv-identifier", "conf": 0.92, "crit": 3, "desc": "References an OSV advisory identifier", "from": [ { "file": 194 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-command-position-script", "conf": 0.9, "crit": 1, "desc": "curl/wget in shell command position" }, { "id": "micro-behaviors/process/create/vcs/git::shell-git-commit", "atk": "T1059.004", "conf": 0.92, "crit": 3, "desc": "Commits changes to a Git repository", "from": [ { "file": 130 } ] }, { "id": "objectives/exfiltration/oob/system-profile::python-platform-version-fields", "atk": "T1041", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Python platform version fields", "from": [ { "file": 158 } ] }, { "id": "metadata/package/testing/harness/unit::go-func-test", "conf": 0.8, "crit": 2, "desc": "Go test function name", "from": [ { "file": 9 } ] }, { "id": "metadata/package/scripts/entrypoint::entry-points-file", "conf": 0.95, "crit": 3, "desc": "Python package contains an entry_points.txt file" }, { "id": "micro-behaviors/process/exit/terminate::python-sys-exit-symbol", "conf": 0.84, "crit": 3, "desc": "Python sys.exit symbol", "from": [ { "file": 90 } ] }, { "id": "micro-behaviors/data/archive/extract/zip::python-zipfile-extractall", "conf": 0.92, "crit": 3, "desc": "Python ZIP archive extraction", "from": [ { "off": 2438, "file": 54, "line": 79 }, { "off": 4086, "file": 316, "line": 129 }, { "off": 12769, "file": 426, "line": 333 }, { "file": 451 }, { "off": 3221, "file": 500, "line": 80 } ], "uses": [ 158, 252 ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--x86-or-mips", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 1, "desc": "Shell x86 or MIPS architecture selector" }, { "id": "micro-behaviors/fs/proc/container::runtime-engine-keywords--docker", "conf": 0.86, "crit": 3, "desc": "References the Docker container engine", "from": [ { "file": 238 } ] }, { "id": "micro-behaviors/os/package-manager/install::python-runtime-pip-install", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python invokes pip module install", "from": [ { "file": 459 } ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "from": [ { "file": 525 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.7, "crit": 2, "desc": "curl command includes URL or option", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/shell/git::github-actions-git-push", "conf": 0.9, "crit": 3, "desc": "GitHub Actions pushes a git ref" }, { "id": "micro-behaviors/os/env/enumeration::python-environ-dict", "conf": 0.9, "crit": 3, "desc": "Python snapshots the full process environment", "from": [ { "file": 99 } ] }, { "id": "metadata/package/testing/scripted::pytest-with-assert", "conf": 0.8, "crit": 2, "desc": "pytest markers with assert statement", "from": [ { "file": 43 } ], "uses": [ 256, 337 ] }, { "id": "micro-behaviors/data/format/json::json-command-field", "conf": 0.8, "crit": 3, "desc": "JSON command or task field key", "from": [ { "file": 188 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-structured-file", "conf": 0.84, "crit": 3, "desc": "Structured file has curl/wget output path", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/os/package-manager/install::python-pip-module-import", "conf": 0.8, "crit": 3, "desc": "Python pip module import" }, { "id": "micro-behaviors/process/fd/stdio::py-stderr-stdout", "conf": 0.6, "crit": 3, "desc": "stderr=STDOUT pipe argument (Python)", "from": [ { "file": 451 } ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::gha-package-publish-secret-name--rx-7", "atk": "T1195.002", "conf": 0.88, "crit": 3, "desc": "Node or Twine registry credential name", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/services/cloud::repeated-public-cloud-provider-name--azure", "conf": 0.4, "crit": 3, "desc": "Public cloud provider name (Azure)", "from": [ { "file": 27 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 3, "desc": "SQL SELECT syntax reference", "from": [ { "file": 40 } ] }, { "id": "metadata/package/testing/presence/harness::go-test-file", "conf": 0.7, "crit": 2, "desc": "Go test file suffix", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-api-host", "conf": 0.86, "crit": 3, "desc": "GitHub API host reference", "from": [ { "file": 369 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::mapping-get-executable-field", "conf": 0.88, "crit": 3, "desc": "Python mapping reads an executable field", "from": [ { "file": 437 } ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-output-to-var", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Output path comes from shell variable", "from": [ { "file": 32 } ] }, { "id": "metadata/build/ci/step::pull-request-head-sha-checkout", "conf": 0.95, "crit": 3, "desc": "Checkout resolves a pull request head SHA" }, { "id": "micro-behaviors/os/module/search-path::sys-path-mutate", "conf": 0.86, "crit": 3, "desc": "Modifies module search path (sys.path)", "from": [ { "file": 307 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--returncode", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (returncode)", "from": [ { "file": 99 } ] }, { "id": "metadata/package/keywords/identity::empty-keywords", "atk": "T1036.005", "mbc": "F0004", "conf": 0.5, "crit": 3, "desc": "Empty keywords list", "from": [ { "file": 19 } ] }, { "id": "metadata/build/ci/trigger::pull-request-target-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub pull_request_target workflow trigger", "from": [ { "file": 187 } ] }, { "id": "micro-behaviors/data/db/orm::sqlalchemy", "conf": 0.85, "crit": 3, "desc": "SQLAlchemy ORM", "from": [ { "file": 55 } ] }, { "id": "metadata/package/license::spdx-identifier", "conf": 0.9, "crit": 3, "desc": "SPDX license identifier", "from": [ { "file": 27 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/fs/path/location::env-home-hidden-path", "conf": 0.9, "crit": 3, "desc": "Hidden path under HOME variable", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-field", "conf": 0.9, "crit": 3, "desc": "Reads a hook command field", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/fs/file/read-write::python-download-file-call", "conf": 0.9, "crit": 3, "desc": "Calls a Python download_file helper" }, { "id": "micro-behaviors/communications/http/download/package::python-wheel-download-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "URL that downloads a Python wheel", "from": [ { "file": 158 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-d-cmd", "conf": 0.6, "crit": 3, "desc": "base64 -d/-D decode command", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-octet-stream", "conf": 0.85, "crit": 3, "desc": "Uses the application/octet-stream MIME type", "from": [ { "file": 226 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file-command", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "Executes curl with output-path option", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "from": [ { "file": 429 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-devnull", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "Python subprocess suppresses stdio", "from": [ { "file": 415 } ] }, { "id": "objectives/command-and-control/dropper/builder::loads-b", "conf": 1.0, "crit": 3, "desc": "marshal.loads of bytes literal", "from": [ { "file": 143 } ] }, { "id": "metadata/build/docker::docker-env-prefix", "conf": 0.8, "crit": 3, "desc": "DOCKER_ environment prefix", "from": [ { "file": 31 } ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "from": [ { "file": 214 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars", "from": [ { "file": 186 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-apply-cached-option", "conf": 0.95, "crit": 3, "desc": "Git apply --cached option token", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/data/control-flow/assert::python-assert-statement", "conf": 0.95, "crit": 2, "desc": "Checks condition using Python assert" }, { "id": "micro-behaviors/communications/http/url/query::interpolated-identifier-query-value", "conf": 0.9, "crit": 3, "desc": "URL query interpolates an identifier value", "from": [ { "file": 369 } ] }, { "id": "objectives/impact/destroy/keywords::destructive-code-target", "conf": 1.0, "crit": 1, "desc": "Source/repository/workspace target-word component", "from": [ { "file": 415 } ], "uses": [ 1 ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "file": 92 } ], "uses": [ 40, 496, 498 ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-output-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python subprocess captures output streams" }, { "id": "micro-behaviors/communications/url/external/github::github-release-download", "atk": "T1105", "conf": 0.85, "crit": 3, "desc": "GitHub release asset URL template" }, { "id": "micro-behaviors/fs/chmod/modify::chmod-command", "atk": "T1222", "mbc": "E1222", "conf": 0.6, "crit": 3, "desc": "chmod shell command", "from": [ { "file": 32 } ] }, { "id": "metadata/package/testing/scripted::pytest-conftest", "conf": 0.98, "crit": 2, "desc": "conftest.py file", "from": [ { "file": 162 } ] }, { "id": "micro-behaviors/process/interpreter/python::exec-variable", "atk": "T1059.006", "mbc": "E1059", "conf": 0.94, "crit": 3, "desc": "Python exec() executes a variable value", "from": [ { "file": 143 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb", "conf": 0.88, "crit": 1, "desc": "Cleanup-word component", "from": [ { "off": 21978, "file": 415, "line": 603 } ], "uses": [ 468 ] }, { "id": "micro-behaviors/communications/socket/family::socket-af-inet-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "AF_INET constant name", "from": [ { "file": 142 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals", "from": [ { "file": 352 } ] }, { "id": "micro-behaviors/communications/http/download/cli::wget-command-call", "atk": "T1105", "conf": 0.96, "crit": 3, "desc": "Shell invokes the wget command", "from": [ { "file": 32 } ] }, { "id": "objectives/command-and-control/dropper/execution/eval::remote-module-py-url-path", "conf": 0.9, "crit": 3, "desc": "Remote Python module URL path", "from": [ { "file": 148 } ] }, { "id": "micro-behaviors/process/create/system::python-dunder-import-os-system", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Shell exec via inline __import__ system call" }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/data/decode/base64::dunder-import-base64", "conf": 0.9, "crit": 3, "desc": "Dynamically imports base64 module", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-dynamic-command-execution", "conf": 0.92, "crit": 3, "desc": "Shell executes dynamic command", "from": [ { "off": 3548, "file": 32, "line": 113 }, { "off": 1332, "file": 39, "line": 60 }, { "file": 188 } ], "uses": [ 72, 456 ] }, { "id": "well-known/lib/network/requests::upstream-repository", "conf": 0.99, "crit": 3, "desc": "Requests upstream repository URL", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/fs/file/read-write::python-copy-file-function", "conf": 0.88, "crit": 3, "desc": "Python copy_file function", "from": [ { "file": 521 } ] }, { "id": "micro-behaviors/data/string/assembly::sh-template-opening-delimiter", "conf": 0.85, "crit": 3, "desc": "Shell contains a template delimiter", "from": [ { "file": 171 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-2", "atk": "T1082", "conf": 0.8, "crit": 2, "desc": "Python second positional argv access", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/create/load/script::async-external-script-element", "conf": 0.92, "crit": 3, "desc": "Loads asynchronous external script", "from": [ { "file": 214 } ] }, { "id": "objectives/supply-chain/recon-exfil/install-hook::urlencode-recon-field-names", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Host profile field pair", "from": [ { "file": 521 } ] }, { "id": "metadata/package/dependencies/declaration::setup-requests-dependency", "conf": 0.9, "crit": 3, "desc": "setup.py declares requests dependency" }, { "id": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-1", "atk": "T1105", "mbc": "B0024", "conf": 0.86, "crit": 3, "desc": "Matches 'storage.googleapis.com'", "from": [ { "file": 214 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 9 } ], "uses": [ 35, 61, 211 ] }, { "id": "micro-behaviors/data/decode/symbol-base64::base64-tool", "conf": 0.5, "crit": 2, "desc": "base64 command-line tool reference", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/string/conversion::python-chr-call", "conf": 0.9, "crit": 3, "desc": "Python chr() character conversion" }, { "id": "micro-behaviors/fs/delete/file/library::py-remove", "conf": 0.8, "crit": 2, "desc": "File deletion (os.remove/os.unlink)", "from": [ { "file": 281 } ] }, { "id": "micro-behaviors/ui/window/state::browser-dom-class-state-addition", "conf": 0.9, "crit": 3, "desc": "Adds active or complete DOM class", "from": [ { "file": 293 } ] }, { "id": "metadata/package/files/wheel-sdist::setup-packages-find-packages", "conf": 0.86, "crit": 3, "desc": "setup() uses find_packages()" }, { "id": "micro-behaviors/fs/enumerate/directory::python-directory-listing", "atk": "T1083", "conf": 0.86, "crit": 3, "desc": "Python lists directory entries", "from": [ { "file": 315 } ] }, { "id": "micro-behaviors/communications/url/encoded::python-commented-percent-encoded-url-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Python commented encoded URL context", "from": [ { "file": 339 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::platform-field-key", "conf": 0.86, "crit": 3, "desc": "JSON-like platform or OS field", "from": [ { "file": 178 } ] }, { "id": "metadata/build/ci/permission::job-pull-requests-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants pull-request write permission" }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 99 } ] }, { "id": "metadata/build/ci/step::actions-upload-artifact", "conf": 0.9, "crit": 3, "desc": "GitHub Actions uploads a workflow artifact" }, { "id": "metadata/file/format/structured::cyclonedx-bom-document", "conf": 0.97, "crit": 3, "desc": "CycloneDX software bill of materials", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::b64decode-call", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with Python", "from": [ { "file": 85 } ] }, { "id": "metadata/build/ci/secret::step-token-input-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step token input references an Actions secret" }, { "id": "objectives/command-and-control/dropper/execution/pipe::execute-dot-slash", "atk": "T1059.004", "conf": 0.6, "crit": 3, "desc": "./ execution pattern" }, { "id": "objectives/anti-static/obfuscation/payload/bytecode::setuptools-word", "conf": 1.0, "crit": 3, "desc": "setuptools package", "from": [ { "file": 56 } ] }, { "id": "micro-behaviors/communications/http/download/curl::wget-cmd", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "wget URL download command" }, { "id": "micro-behaviors/communications/http/curl::curl-command-remote-url", "conf": 0.85, "crit": 3, "desc": "curl command names a routable remote URL", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/download/cli::curl-command-call", "atk": "T1105", "conf": 0.96, "crit": 3, "desc": "Shell invokes the curl command", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist", "atk": "T1082", "mbc": "E1082", "conf": 0.85, "crit": 3, "desc": "Shell lists architecture selector names", "from": [ { "file": 18 }, { "file": 32 } ], "uses": [ 295 ] }, { "id": "objectives/credential-access/env/secrets/cicd::sh-github-token", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "$GITHUB_TOKEN shell environment access", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-staging-path", "atk": "T1105", "conf": 0.82, "crit": 3, "desc": "References curl writing to an output path", "from": [ { "file": 32 } ] }, { "id": "metadata/build/ci/secret::run-secret-reference", "conf": 0.82, "crit": 3, "desc": "GitHub Actions run step references a secret" }, { "id": "micro-behaviors/data/archive/extract/capability::python-extract-member-call", "conf": 0.7, "crit": 3, "desc": "Python extract() method call", "from": [ { "file": 500 } ] }, { "id": "micro-behaviors/data/serialize/unsafe::import-marshal", "mbc": "C0038", "conf": 0.9, "crit": 3, "desc": "Imports marshal module", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/http/url/archive::remote-tgz-url", "atk": "T1105", "conf": 0.88, "crit": 3, "desc": "HTTP URL for a remote tarball", "from": [ { "file": 326 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-read--tool-name", "conf": 0.9, "crit": 3, "desc": "Reads AI agent hook tool input (tool_name)", "from": [ { "file": 396 } ] }, { "id": "micro-behaviors/data/parse/command::python-shlex-command-split", "conf": 0.9, "crit": 3, "desc": "Python parses shell-like command words", "from": [ { "file": 313 } ] }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen", "from": [ { "file": 33 } ] }, { "id": "objectives/command-and-control/dropper/builder::marshal-loads-import", "conf": 1.0, "crit": 3, "desc": "from marshal import loads", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/fs/build-artifacts::android-build-tool-cleanup-context--javac", "conf": 0.9, "crit": 3, "desc": "Android build tool cleanup context (javac)", "from": [ { "file": 337 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/url/cloud::discord-cdn-executable-url", "conf": 0.9, "crit": 3, "desc": "Discord CDN URL with executable extension" }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 409 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::complex-redirection-chain", "conf": 0.75, "crit": 3, "desc": "Command with complex redirection and piping", "from": [ { "file": 39 } ], "uses": [ 205 ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-shell-cwd-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Subprocess sets shell or working directory" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--exit-code", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (exit_code)", "from": [ { "file": 99 } ] }, { "id": "objectives/exfiltration/stealer/credential/dev-file::python-requests-post-exfil", "atk": "T1552.001,T1041", "mbc": "E1552", "conf": 0.8, "crit": 3, "desc": "Python requests.post call site", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "curl command uses silent or fail flags", "from": [ { "off": 1108, "file": 32, "line": 33 }, { "off": 1368, "file": 37, "line": 40 }, { "off": 2748, "file": 42, "line": 72 }, { "off": 5009, "file": 188, "line": 128 } ], "uses": [ 382, 497 ] }, { "id": "micro-behaviors/data/llm/codegen::llm-generation-source-return", "conf": 0.88, "crit": 3, "desc": "Returns source code or script", "from": [ { "file": 154 } ] }, { "id": "micro-behaviors/communications/http/request/client::py-post-generic", "conf": 0.8, "crit": 3, "desc": "Python post method call", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/data/control-flow/membership::set-construction", "conf": 0.75, "crit": 3, "desc": "Python set() construction", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-post", "conf": 0.85, "crit": 3, "desc": "Calls requests.post() in Python", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "raw.githubusercontent.com JSON URL" }, { "id": "micro-behaviors/process/create/shell/target::shell-exec-script-path", "conf": 0.85, "crit": 3, "desc": "Shell runs a script by path", "from": [ { "file": 101 } ] }, { "id": "metadata/package/manager::homebrew-install-command", "conf": 0.5, "crit": 3, "desc": "Homebrew install command" }, { "id": "micro-behaviors/data/db/elasticsearch::elasticsearch-string", "conf": 0.9, "crit": 3, "desc": "elasticsearch string", "from": [ { "file": 119 } ] }, { "id": "well-known/lib/format/pyyaml::pyyaml-library-context", "conf": 0.98, "crit": 3, "desc": "PyYAML library context", "from": [ { "file": 477 } ], "uses": [ 513 ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-vulnerable", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Vulnerable or CVE state marker", "from": [ { "file": 194 } ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "from": [ { "file": 142 } ] }, { "id": "objectives/exfiltration/http/agent::repo2skill-github-token-marker", "atk": "T1041,T1552.001", "conf": 0.99, "crit": 3, "desc": "GitHub token marker", "from": [ { "file": 31 } ] }, { "id": "metadata/build/ci/secret::github-token-secret", "conf": 0.88, "crit": 3, "desc": "References Actions-provided GITHUB_TOKEN", "from": [ { "file": 187 } ] }, { "id": "metadata/package/files/wheel-sdist::pypi-egg-info-dependency-links", "conf": 0.86, "crit": 3, "desc": "PyPI sdist includes dependency_links metadata" }, { "id": "micro-behaviors/process/create/shell/agent-runtime::python-run-command-tool-name", "conf": 0.9, "crit": 3, "desc": "Python defines a run_command function", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/data/serialize/envelope::json-payload-field", "conf": 0.9, "crit": 3, "desc": "JSON object payload field fragment", "from": [ { "file": 491 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 43 } ], "uses": [ 447 ] }, { "id": "micro-behaviors/communications/http/client/response-body::requests-response-body-access", "conf": 0.9, "crit": 3, "desc": "Reads a requests response body", "from": [ { "file": 426 } ], "uses": [ 29, 170, 257, 395, 409, 533 ] }, { "id": "micro-behaviors/communications/http/services/artifactory::storage-item-api-route", "conf": 0.95, "crit": 3, "desc": "References the Artifactory storage item API", "from": [ { "file": 189 } ] }, { "id": "micro-behaviors/data/db/sql::python-sql-f-string", "conf": 0.9, "crit": 3, "desc": "Builds SQL with Python f-string interpolation", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/url/build::shell-command-substitution-url-path", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Shell URL path includes command substitution" }, { "id": "micro-behaviors/os/env/modify::shell-path-prepend-export", "conf": 0.7, "crit": 3, "desc": "Prepends a directory ahead of PATH", "from": [ { "file": 32 } ] }, { "id": "objectives/impact/ransom/affiliate::locker-thread-count-option", "atk": "T1486", "mbc": "B0007", "conf": 0.88, "crit": 3, "desc": "Thread-count option marker", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/argument/subcommand::underscored-file-transfer-command", "conf": 0.9, "crit": 3, "desc": "Underscored file-transfer command identifier", "from": [ { "file": 155 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "from": [ { "file": 1 }, { "file": 2 }, { "file": 142 }, { "file": 316 }, { "file": 429 }, { "file": 521 } ], "uses": [ 257, 409 ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-bcrypt-fallback--rx-2", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "cryptography library fallback marker", "from": [ { "file": 437 } ] }, { "id": "objectives/lateral-movement/brute-force/password::weak-pass-master", "atk": "T1110.001", "mbc": "E1110", "conf": 0.4, "crit": 3, "desc": "Master-password dictionary token", "from": [ { "file": 317 } ] }, { "id": "objectives/command-and-control/channel/deaddrop/github::github-raw-command-script-url", "atk": "T1102,T1059", "conf": 0.9, "crit": 3, "desc": "GitHub raw command script URL", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/crypto/hash/digest::shell-sha256-checksum-command", "conf": 0.9, "crit": 3, "desc": "Shell SHA-256 checksum command", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/socket/family::socket-sock-stream-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "SOCK_STREAM constant name", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-protocol-reference", "conf": 0.5, "crit": 3, "desc": "References the OAuth 2 protocol", "from": [ { "file": 250 } ] }, { "id": "metadata/package/testing/presence/path::tests-path-basename", "conf": 1.0, "crit": 2, "desc": "Tests path basename", "from": [ { "file": 43 } ] }, { "id": "metadata/build/ci/trigger::scheduled-workflow-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "metadata/package/testing/presence/harness::python-test-file-content", "conf": 0.8, "crit": 2, "desc": "Python test source content", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/env/vcs::github-token-name-reference", "conf": 0.9, "crit": 3, "desc": "References the GITHUB_TOKEN environment variable", "from": [ { "file": 31 } ] }, { "id": "metadata/build/ci/step::composite-action-type", "conf": 1.0, "crit": 3, "desc": "GitHub Actions composite action definition" }, { "id": "metadata/package/testing/harness/fixture::multiple-token-assignments", "conf": 0.95, "crit": 3, "desc": "Multiple uppercase token assignments", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/fs/temp/directory::python-temporary-directory-context", "conf": 0.9, "crit": 3, "desc": "Uses a Python TemporaryDirectory context", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/fs/path/check::python-os-path-isdir-symbol", "conf": 0.86, "crit": 3, "desc": "Python os.path.isdir path test", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-string-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Python imports named module dynamically", "from": [ { "file": 143 } ] }, { "id": "metadata/package/testing/scripted::pytest-decorator", "conf": 0.9, "crit": 2, "desc": "pytest fixture or mark reference", "from": [ { "file": 43 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 43 } ], "uses": [ 35, 363 ] }, { "id": "well-known/lib/network/urllib3::urllib3-name", "conf": 1.0, "crit": 3, "desc": "Imports the Python urllib3 library", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 14 } ], "uses": [ 151, 326, 353, 364, 376, 504 ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk", "conf": 0.66, "crit": 2, "desc": "Traverse filesystem hierarchy (os.walk)", "from": [ { "file": 153 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::load-resource-source", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": "Native PE resource loading in source", "from": [ { "file": 9 } ] }, { "id": "objectives/anti-static/obfuscation/payload/polymorphic::payload-variant-marker", "atk": "T1027", "conf": 0.92, "crit": 3, "desc": "Payload term near variant", "from": [ { "file": 429 } ] }, { "id": "well-known/tool/detection/sast::scorecard-tool", "conf": 1.0, "crit": 3, "desc": "OpenSSF Scorecard reference", "from": [ { "file": 529 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 541 } ] }, { "id": "metadata/package/ecosystem::pkginfo-markdown-description", "conf": 0.9, "crit": 3, "desc": "Declares Markdown package description" }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "from": [ { "file": 32 } ] }, { "id": "objectives/command-and-control/channel/discord::discord-cdn-url", "conf": 0.9, "crit": 3, "desc": "Discord CDN attachment URL" }, { "id": "objectives/lateral-movement/brute-force/password::service-account-oracle", "atk": "T1110.001", "mbc": "E1110", "conf": 0.85, "crit": 3, "desc": "Service-account token oracle", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/secret-config::container-orchestration-tooling-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "Container or orchestration tooling", "from": [ { "off": 22376, "file": 31, "line": 635 }, { "file": 536 }, { "file": 537 } ], "uses": [ 525 ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::py-many-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 2, "desc": "Many high-entropy identifiers (\u003e35% have", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/process/interpreter/python::exec-builtin", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Executes dynamic Python code with exec()", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/http/url/cloud::discord-cdn-download-url", "conf": 0.9, "crit": 3, "desc": "Discord CDN download URL" }, { "id": "objectives/anti-static/obfuscation/payload/container::named-function-declaration-in-noncode", "atk": "T1027.003", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Named function in non-source container", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64", "conf": 0.94, "crit": 3, "desc": "x86 or AMD64 architecture reference" }, { "id": "micro-behaviors/process/create/shell/spawn::python-bash-path", "atk": "T1059.004", "conf": 0.8, "crit": 3, "desc": "/bin/bash shell path in Python code", "from": [ { "file": 326 } ] }, { "id": "micro-behaviors/process/create/exec::python-os-popen-string-command", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "os.popen receives a literal command string", "from": [ { "file": 142 } ] }, { "id": "objectives/command-and-control/dropper/delivery/url-shortcut::url-shortcut-http-target", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "URL shortcut HTTP target", "from": [ { "file": 27 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.88, "crit": 3, "desc": "Clean source/project action phrase", "from": [ { "file": 415 } ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-echo-file-write", "conf": 0.86, "crit": 3, "desc": "Shell echo redirects output to file" }, { "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command", "conf": 0.86, "crit": 3, "desc": "Shell command redirects output to file", "uses": [ 469 ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "from": [ { "file": 437 } ] }, { "id": "metadata/file/format/conformance::json-parse-error", "conf": 0.9, "crit": 3, "desc": "JSON document fails to parse", "from": [ { "file": 11 } ] }, { "id": "objectives/privilege-escalation/exploit/vulnerabilities::redsun-cloud-tag-abuse--rx-5", "conf": 0.95, "crit": 3, "desc": "Remediation term", "from": [ { "file": 457 } ] }, { "id": "micro-behaviors/data/source/import::alias-os", "conf": 0.6, "crit": 3, "desc": "os imported under an alias", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-command-field-read", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Reads structured task command field", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/data/encode/base64::base64-encode-command", "mbc": "C0025", "conf": 0.75, "crit": 3, "desc": "Shell encodes data with Base64", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/flags::creationflags", "atk": "T1564.003", "mbc": "F0005", "conf": 0.75, "crit": 3, "desc": "Subprocess uses CREATE_NO_WINDOW flag" }, { "id": "micro-behaviors/communications/http/request/client::response-stream-python", "conf": 0.85, "crit": 3, "desc": "Python HTTP response streaming" }, { "id": "micro-behaviors/process/io/write::go-write-method-call", "conf": 0.65, "crit": 3, "desc": "Go Write/WriteAt method call", "from": [ { "file": 16 } ] }, { "id": "metadata/lang/generated::codegen-source-path", "conf": 0.9, "crit": 2, "desc": "Code generation source path" }, { "id": "objectives/command-and-control/dropper/staged-loader::remote-module-method-field", "atk": "T1105,T1627.001", "mbc": "B0042", "conf": 0.94, "crit": 3, "desc": "Remote module method field", "from": [ { "file": 10 } ] }, { "id": "metadata/package/files/included::setup-py-basename", "conf": 0.95, "crit": 3, "desc": "Filename is setup.py" }, { "id": "metadata/build/pip::packaging-setuptools-import", "conf": 0.95, "crit": 3, "desc": "setuptools packaging import" }, { "id": "objectives/anti-static/obfuscation/payload/polymorphic::variant-term", "atk": "T1027", "conf": 0.92, "crit": 3, "desc": "Variant term near payload", "from": [ { "file": 453 } ] }, { "id": "metadata/package/config::excludes-identifier", "conf": 0.7, "crit": 3, "desc": "Uses an excludes identifier", "from": [ { "file": 466 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-clone-command", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Git clone command", "from": [ { "file": 42 } ] }, { "id": "metadata/build/ci/step::mutable-version-action-ref", "conf": 0.9, "crit": 3, "desc": "Workflow action uses mutable version tag" }, { "id": "metadata/build/pip::site-packages-script", "conf": 0.85, "crit": 3, "desc": "References site-packages from a script", "from": [ { "file": 349 } ] }, { "id": "objectives/supply-chain/trojanized/build-pipeline::gha-release-publish-step", "atk": "T1195.002", "conf": 0.86, "crit": 3, "desc": "GitHub Actions package publish step", "from": [ { "file": 212 } ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.7, "crit": 3, "desc": "References the Bash shell", "from": [ { "file": 326 } ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "from": [ { "file": 293 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::python-for-range-len-loop", "conf": 0.4, "crit": 3, "desc": "Python for-range-over-len(X) loop" }, { "id": "micro-behaviors/data/manipulation::untrusted-content-data-boundary-en", "conf": 0.97, "crit": 3, "desc": "Untrusted-data boundary in English", "from": [ { "file": 389 } ] }, { "id": "micro-behaviors/process/create/popen::os-popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Executes command via os.popen", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "curl text contains silent or fail flags", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/fs/file/read-write::python-download-file-function", "conf": 0.88, "crit": 3, "desc": "Python download_file function" }, { "id": "well-known/lib/network/grpc-go::authors-copyright", "conf": 0.99, "crit": 3, "desc": "gRPC authors Apache copyright header", "from": [ { "file": 27 } ] }, { "id": "micro-behaviors/data/manipulation::string-replace-result-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns a string replace result", "from": [ { "file": 63 } ] }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-6", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Matches 'Downloads'", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/communications/http/url/path::mutable-branch-ref-path", "conf": 0.88, "crit": 3, "desc": "URL path selects a mutable branch head", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::multiple-b64decode-calls", "conf": 0.97, "crit": 3, "desc": "Multiple Python Base64 decoder calls", "from": [ { "file": 437 } ] }, { "id": "micro-behaviors/communications/http/request/body::email-collection-body-field", "atk": "T1589.002", "mbc": "E1589", "conf": 0.85, "crit": 3, "desc": "Body field naming email contact collection", "from": [ { "file": 503 } ] }, { "id": "micro-behaviors/ui/window/style::css-visibility-hidden", "conf": 0.9, "crit": 3, "desc": "CSS visibility hidden declaration", "from": [ { "file": 293 } ] }, { "id": "objectives/anti-static/obfuscation/encoding/base64::base64-decode-pipe-sh", "atk": "T1027", "conf": 0.7, "crit": 4, "desc": "base64 --decode piped to sh", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument" }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command" }, { "id": "well-known/lib/network/public-suffix-list::psl-github-io", "conf": 0.9, "crit": 3, "desc": "Public suffix github.io", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/fs/build-artifacts::make-install-clean-command", "conf": 1.0, "crit": 3, "desc": "Make install clean command", "from": [ { "file": 43 } ] }, { "id": "metadata/package/scripts/entrypoint::setup-entry-points-field", "conf": 0.78, "crit": 3, "desc": "setup.py declares entry_points" }, { "id": "well-known/lib/format/pyyaml::pyyaml-package-name", "conf": 0.98, "crit": 2, "desc": "PyYAML package name", "from": [ { "file": 477 } ] }, { "id": "micro-behaviors/data/decode/base64::kubernetes-secret-pipeline", "conf": 0.96, "crit": 3, "desc": "Kubernetes secret field Base64 decoding pipeline", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/fs/delete/directory::shutil-rmtree", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Calls rmtree() to delete a directory tree", "from": [ { "file": 62 } ] }, { "id": "well-known/tool/detection/sast::semgrep-tool", "conf": 1.0, "crit": 3, "desc": "Semgrep SAST tool reference", "from": [ { "file": 536 } ] }, { "id": "micro-behaviors/communications/http/url/forge::github-raw-url", "conf": 0.92, "crit": 3, "desc": "GitHub raw-content URL" }, { "id": "metadata/package/testing/presence/harness::pytest-module", "conf": 0.95, "crit": 2, "desc": "Imports the pytest module", "from": [ { "file": 43 } ] }, { "id": "well-known/lib/stdlib/python-stdlib::p-7", "conf": 1.0, "crit": 3, "desc": "Python standard library module group 7", "from": [ { "file": 65 } ] }, { "id": "objectives/supply-chain/trojanized/library/git-clone::obfuscated-repo-prefix", "atk": "T1071.001", "mbc": "E1105", "conf": 0.7, "crit": 3, "desc": "Suspicious prefix in repository URL", "from": [ { "file": 422 } ] }, { "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call", "conf": 0.94, "crit": 3, "desc": "DirectoryEntry property write API call", "from": [ { "file": 466 } ] }, { "id": "micro-behaviors/process/create/local-exec::multi-local-executable-launch", "atk": "T1059.004", "conf": 0.91, "crit": 3, "desc": "Shell launches three local executables" }, { "id": "micro-behaviors/fs/path/check::python-os-path-isfile-text", "conf": 0.7, "crit": 3, "desc": "Python os.path.isfile path test text", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/communications/http/download/shell::fetch-var-output-before-input", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Variable output precedes variable input", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/os/container/runtime::docker-cli-run-create", "conf": 0.82, "crit": 3, "desc": "Docker CLI run or create command", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/fs/chown::chown-fn", "conf": 0.66, "crit": 3, "desc": "Change file ownership", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/crypto/asymmetric/signature::signable-artifact-name", "conf": 0.95, "crit": 3, "desc": "Checksum manifest or detached signature filename" }, { "id": "metadata/package/testing/harness/unit::go-testing-t", "conf": 0.7, "crit": 2, "desc": "Go test uses a testing.T parameter", "from": [ { "file": 9 } ] }, { "id": "objectives/evasion/security-bypass/llm/prompt::llm-doc-follow-instruction", "atk": "T1562", "conf": 0.86, "crit": 3, "desc": "AI source-follow directive", "from": [ { "file": 292 } ] }, { "id": "objectives/supply-chain/recon-exfil/install-hook::recon-env-field-names", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Recon-style pwd/env/file field names", "from": [ { "file": 474 } ] }, { "id": "micro-behaviors/data/serialize/json::go-json-unmarshal", "mbc": "C0032", "conf": 0.85, "crit": 3, "desc": "Go JSON unmarshal call", "from": [ { "file": 13 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 540 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-head", "conf": 0.85, "crit": 3, "desc": "requests.head call (Python)", "from": [ { "file": 521 } ] }, { "id": "objectives/discovery/system/profile::runtime-python-version-field", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Runtime profile Python version field", "from": [ { "file": 158 } ] }, { "id": "metadata/package/testing/harness/unit::python-unittest-import", "conf": 0.95, "crit": 3, "desc": "Python unittest import", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/os/env/read::python-environ-copy-assignment", "conf": 0.9, "crit": 3, "desc": "Copies entry into env or credential mapping", "from": [ { "file": 99 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::chmod-exec-var-target", "atk": "T1222", "mbc": "E1222", "conf": 0.9, "crit": 3, "desc": "chmod marks a variable path executable", "from": [ { "file": 32 } ] }, { "id": "metadata/package/dependencies/declaration::install-requires-list-open", "conf": 0.8, "crit": 3, "desc": "install_requires uses literal list" }, { "id": "micro-behaviors/os/sysinfo/hostname::sh-hostname-command", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Shell hostname command substitution" }, { "id": "micro-behaviors/data/db/sqlite::python-sqlite3-import", "conf": 0.95, "crit": 3, "desc": "Imports Python SQLite database module", "from": [ { "file": 40 } ] }, { "id": "objectives/supply-chain/hidden-payload/staging::ast-gitpython-handle", "atk": "T1195.001", "mbc": "E1105", "conf": 0.75, "crit": 3, "desc": "Constructs a GitPython command handle", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::python-credentialed-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python credentialed HTTP URL", "from": [ { "file": 82 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-resource-url-field", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Reads resource URL field", "from": [ { "file": 339 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 142 } ] }, { "id": "micro-behaviors/fs/path/check::python-os-path-isdir-text", "conf": 0.7, "crit": 3, "desc": "Python os.path.isdir path test text", "from": [ { "file": 99 } ] }, { "id": "well-known/tool/development/docs/sphinx::sphinx-build-dash-m", "conf": 0.96, "crit": 3, "desc": "sphinx-build -M make-mode invocation", "from": [ { "file": 308 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 540 } ] }, { "id": "micro-behaviors/fs/file/copy::shutil-copy", "conf": 0.8, "crit": 3, "desc": "Python shutil copies a file", "from": [ { "file": 80 } ] }, { "id": "objectives/execution/automation/agent::vulnerability-state-marker-version-service", "atk": "T1059,T1190,T1595", "conf": 0.82, "crit": 3, "desc": "Service-version compound marker", "from": [ { "file": 241 } ] }, { "id": "micro-behaviors/fs/directory/traverse::delete-shell", "conf": 0.85, "crit": 2, "desc": "Shell deletion operation", "from": [ { "off": 258, "file": 104, "line": 6 } ], "uses": [ 254 ] }, { "id": "metadata/file/padding::low-whitespace", "conf": 0.7, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)", "from": [ { "file": 146 } ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6, "crit": 3, "desc": "Home-relative hidden directory path literal", "from": [ { "file": 31 } ] }, { "id": "objectives/command-and-control/dropper/staged-loader::remote-module-digest-field", "atk": "T1105,T1627.001", "mbc": "B0042", "conf": 0.94, "crit": 3, "desc": "Remote module digest field", "from": [ { "file": 10 } ] }, { "id": "metadata/package/testing/scripted::pytest", "conf": 0.95, "crit": 3, "desc": "pytest test framework", "from": [ { "file": 43 } ], "uses": [ 302, 344, 446, 518 ] }, { "id": "micro-behaviors/os/package-manager/install::ensurepip-bootstrap", "mbc": "C0002", "conf": 0.8, "crit": 2, "desc": "pip bootstrapping via ensurepip", "from": [ { "file": 326 } ] }, { "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename", "conf": 0.96, "crit": 3, "desc": "Go fuzz corpus entry basename (sha1[-index])" }, { "id": "micro-behaviors/communications/http/download/fallback::multi-client-download-fallback", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Uses multiple command-line download clients", "uses": [ 299, 380 ], "spans": [ [ 218, 13 ], [ 2499, 16 ] ] }, { "id": "micro-behaviors/fs/delete/directory::iterative-file-deletion", "atk": "T1070.004", "mbc": "C0047", "conf": 0.88, "crit": 3, "desc": "Iteratively deletes files from directory", "from": [ { "file": 104 }, { "off": 980, "file": 153, "line": 24 }, { "off": 1293, "file": 281, "line": 47 }, { "off": 10792, "file": 426, "line": 283 }, { "file": 502 }, { "file": 536 }, { "file": 539 } ], "uses": [ 74, 366, 550 ], "spans": [ [ 0, 41 ] ] }, { "id": "micro-behaviors/communications/http/download/fallback::multi-client-multi-arch-download", "atk": "T1105", "conf": 0.93, "crit": 3, "desc": "Download fallback with multi-architecture targeting", "from": [ { "file": 18 }, { "off": 2484, "file": 32, "line": 82 } ], "uses": [ 383, 557 ], "spans": [ [ 218, 13 ], [ 2484, 7 ], [ 2499, 16 ] ] }, { "id": "micro-behaviors/process/create/script/file::shell-script-execution", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes a shell script file (.sh)", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-keyword", "conf": 0.7, "crit": 3, "desc": "bash shell keyword (beyond shebang)", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-extract", "atk": "T1560.001", "conf": 0.78, "crit": 3, "desc": "tar extraction command usage", "from": [ { "file": 209 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "atk": "T1560.001", "conf": 0.84, "crit": 3, "desc": "tar gzip extraction command usage", "from": [ { "file": 209 } ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "from": [ { "off": 980, "file": 153, "line": 24 }, { "file": 426 }, { "file": 502 }, { "file": 536 }, { "file": 539 } ], "uses": [ 74, 450 ] }, { "id": "micro-behaviors/fs/path/location::hidden-writable-path", "conf": 0.9, "crit": 3, "desc": "Hidden path in writable location", "from": [ { "file": 525 }, { "file": 526 } ], "uses": [ 298 ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 526 } ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-state-file", "conf": 0.8, "crit": 3, "desc": "Hidden dotfile stashed in /tmp", "from": [ { "file": 526 } ] }, { "id": "micro-behaviors/process/interpreter/python::python-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes Python interpreter", "from": [ { "file": 526 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "from": [ { "file": 525 }, { "file": 526 } ], "uses": [ 298, 566 ] }, { "id": "micro-behaviors/fs/build-artifacts::cp-dist-build", "conf": 0.7, "crit": 3, "desc": "Copies files into dist or build output", "from": [ { "file": 537 } ] }, { "id": "micro-behaviors/process/argument/credential::password-required-flag", "conf": 0.8, "crit": 3, "desc": "Password command-line argument", "from": [ { "file": 538 } ] } ] } ] } }