{ "ml": { "v": "7", "id": 5, "lvl": 25, "conf": 92, "prob": 0.9599999785423279, "type": "gz", "version": "v18.18", "analyzed_at": "2026-09-14T15:39:44Z" }, "path": "0.6.0.tar.gz", "raw": { "rev": "c7f7e", "files": [ { "id": 5, "ctx": [ { "b": "abZy80000000zN(zeXi0LfN.tIIy?SRc\u003e\u003euu5\u0026#MsGRH#j6JEKjhCvg[B?@bgRC0=B8j+m:/\u0026ESS\u003eaXXnoeW8ikG2^XlzDwVBX]USJaJEFbRnT?bG-k76", "ln": 0 } ], "mol": "O₄(CXeAsP)H₇(Cm₁₆Cr₂Db₇F₇Os₇Po₈U₂)", "pid": 1, "rel": "fetched", "sha": "646b9a78cbddd973dd172644992b09ac3691656541ae440075c86ac53cb84b4d", "via": "https://github.com/kd2org/opodsync/archive/refs/tags/0.6.0.tar.gz", "path": "https://github.com/kd2org/opodsync/archive/refs/tags/0.6.0.tar.gz", "risk": 293, "size": 221198, "type": "gz", "depth": 2, "facts": { "metrics": { "file": { "size": 221198, "entropy": 8 }, "binary": { "peak_region_bytes": 221184, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Enumerates directories with PHP functions", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/performance/metrics::memory-get-usage", "conf": 0.5, "crit": 3, "desc": "Reads PHP process memory usage", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/reflection/function::php-reflection-function", "conf": 0.95, "crit": 3, "desc": "Inspects a PHP function through reflection" }, { "id": "micro-behaviors/os/clipboard/access::browser-dom-clipboard-copy", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "Browser DOM clipboard copy flow", "from": [ { "off": 1564, "file": 21, "line": 37 } ], "uses": [ 30, 90 ] }, { "id": "micro-behaviors/fs/file/rename::rename-call", "conf": 0.6, "crit": 3, "desc": "Renames/moves file via rename()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::php-escapeshellarg", "atk": "T1059.006", "conf": 0.85, "crit": 3, "desc": "PHP shell argument escaping call", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/curl::php-curl-request", "conf": 0.9, "crit": 3, "desc": "Executes a PHP cURL request", "from": [ { "off": 28627, "file": 6, "line": 1072 }, { "off": 1924, "file": 11, "line": 68 } ], "uses": [ 27, 59 ] }, { "id": "micro-behaviors/communications/http/request/form-input::php-input-stream-reference", "conf": 0.95, "crit": 3, "desc": "References PHP raw input stream wrapper", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/request/cgi::request-uri-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI REQUEST_URI variable", "from": [ { "file": 5 } ] }, { "id": "objectives/execution/interpreter/php-assert::server-superglobal-read", "atk": "T1505.003,T1059.006", "mbc": "B0030", "conf": 0.85, "crit": 1, "desc": "Reads the server superglobal", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/sql::sql-keywords", "conf": 0.5, "crit": 3, "desc": "Contains several SQL statement types", "from": [ { "off": 982, "file": 8, "line": 49 }, { "off": 4631, "file": 10, "line": 205 }, { "off": 847, "file": 11, "line": 42 }, { "off": 1047, "file": 13, "line": 59 } ], "uses": [ 38, 64, 82 ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "from": [ { "file": 14 }, { "file": 24 } ], "uses": [ 45 ] }, { "id": "micro-behaviors/communications/http/user-agent-routing/inbound::php-user-agent-read", "conf": 0.9, "crit": 3, "desc": "PHP handler reads User-Agent header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/post::php-request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "PHP HTTP request options POST method", "from": [ { "file": 1 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-auth-request-parameter", "conf": 0.82, "crit": 3, "desc": "Reads auth PHP request parameter", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/crypto/kdf/password::password-hash", "conf": 0.9, "crit": 3, "desc": "Derives password hash via PHP password_hash()", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-secret-request-parameter", "conf": 0.82, "crit": 3, "desc": "Reads secret PHP request parameter", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-handler-registration-api", "conf": 0.9, "crit": 3, "desc": "Registers PHP error or session handler", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/random/crypto::php-random-bytes", "conf": 0.82, "crit": 3, "desc": "PHP cryptographic random byte generation", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/file/timestamp::php-filemtime-call", "conf": 0.9, "crit": 3, "desc": "Reads file modification time", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/source::codegen-source-path", "conf": 0.9, "crit": 2, "desc": "Code generation source path" }, { "id": "micro-behaviors/os/clipboard/access::browser-execcommand-copy", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "Browser execCommand clipboard copy" }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/access::php-server-superglobal", "conf": 0.85, "crit": 3, "desc": "Reads PHP $_SERVER execution environment data", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/curl::exec", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL request execution", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/login::http-login-path", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP login path", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/request/cgi::http-referer-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_REFERER variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/clipboard/access::browser-clipboard-copy-command", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Browser clipboard copy command", "from": [ { "file": 21 } ], "uses": [ 24 ] }, { "id": "micro-behaviors/os/callback/dispatch::php-assert-options-api", "conf": 0.9, "crit": 3, "desc": "Configures PHP assertion behavior", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/kdf/password::password-verify", "conf": 0.9, "crit": 3, "desc": "Verifies password via PHP password_verify()", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/client/file-read::php-file-get-url-variable", "conf": 0.95, "crit": 3, "desc": "PHP reads content from a URL-named variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/params::get-dup", "conf": 0.85, "crit": 3, "desc": "Reads PHP query parameters via $_GET", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/construct::realpath-call", "conf": 0.9, "crit": 3, "desc": "Resolves canonical filesystem path", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/beacon::browser-send-beacon", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Calls the browser navigator.sendBeacon API", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-callback-array-dispatch", "conf": 0.85, "crit": 3, "desc": "PHP callback dispatcher with argument array", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/db/sql::sql-update", "conf": 0.5, "crit": 3, "desc": "SQL UPDATE syntax reference", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/request/params::session", "conf": 0.75, "crit": 3, "desc": "Reads PHP session data via $_SESSION", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/request/params::server-name", "conf": 0.8, "crit": 3, "desc": "Reads PHP SERVER_NAME request variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/security/auth/password::php-secret-literal-comparison", "conf": 0.94, "crit": 3, "desc": "PHP secret variable compared to literal", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "off": 2320, "file": 20, "line": 81 } ], "uses": [ 83, 89 ] }, { "id": "micro-behaviors/communications/http/user-agent::read-server-ua-php", "conf": 0.8, "crit": 3, "desc": "Reads inbound User-Agent request header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::php-base64-encode", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_encode()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Iterate directory contents in PHP (micro-behavior, not suspicious alone)", "from": [ { "file": 14 }, { "off": 1011, "file": 24, "line": 47 } ], "uses": [ 0 ] }, { "id": "micro-behaviors/fs/file/write/direct::php-fwrite", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP fwrite()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/io/buffer::ob-start", "conf": 0.7, "crit": 2, "desc": "Starts output buffering", "from": [ { "file": 2 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/process/create/background::path-helper-background-output-discarded", "conf": 0.85, "crit": 3, "desc": "Path helper backgrounds with discarded output", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/client::fetch-post-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript file uses fetch and configures an HTTP POST", "from": [ { "off": 2320, "file": 20, "line": 81 } ], "uses": [ 79, 89 ] }, { "id": "micro-behaviors/communications/http/request/params::post-dup", "conf": 0.85, "crit": 3, "desc": "Reads PHP form parameters via $_POST", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/curl::exec-symbol", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "References the PHP curl_exec() function", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/stat::fileperms-call", "conf": 0.9, "crit": 3, "desc": "Reads file permission mode", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/process/daemonize/detach::background-ampersand-hidden", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Background process with hidden output" }, { "id": "objectives/anti-static/obfuscation/encoding/arithmetic::php-operator-callable-builder", "atk": "T1027", "mbc": "B0032", "conf": 0.94, "crit": 4, "desc": "PHP split-character callable builder", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/request/cgi::server-name-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI SERVER_NAME variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/lang::exec-variable-argument-shell", "atk": "T1059.004", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "shell_exec() receives variable argument", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/curl::init", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "cURL session initialization", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::php-shell-exec", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "PHP shell_exec() function call", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-token-request-parameter", "conf": 0.86, "crit": 3, "desc": "Reads token PHP request parameter", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/response::php-http-response-code-404", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Sets HTTP 404 response code", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/terminate/command::shell-kill-variable-pid", "conf": 0.85, "crit": 3, "desc": "Shell kills a PID from a variable", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "conf": 0.8, "crit": 3, "desc": "Contains an SQL INSERT statement", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/json::php-json-encode", "conf": 0.86, "crit": 3, "desc": "PHP JSON serialization", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/io/buffer::ob-get-clean", "conf": 0.6, "crit": 2, "desc": "Gets and cleans output buffer", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/manage/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/process/resources/limits::set-time-limit", "conf": 0.7, "crit": 3, "desc": "Sets the PHP script execution time limit", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/decode/base64::php-base64-decode-call", "mbc": "C0053", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_decode()", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/curl::setopt", "conf": 0.7, "crit": 3, "desc": "cURL option configuration", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/request/beacon::browser-send-beacon-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Calls the browser sendBeacon method", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/request/cgi::http-user-agent-server-var", "conf": 0.85, "crit": 3, "desc": "Names the CGI HTTP_USER_AGENT variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/params::http-request-server-variable", "conf": 0.8, "crit": 3, "desc": "Reads PHP HTTP request server variable" }, { "id": "micro-behaviors/communications/http/cookies::same-origin-request-marker", "conf": 0.95, "crit": 3, "desc": "HTTP request enables same-origin credentials" }, { "id": "micro-behaviors/data/string/conversion::chr-call", "mbc": "C0000", "conf": 0.65, "crit": 3, "desc": "Converts a character code with PHP chr()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/options::php-stream-context-create", "conf": 0.9, "crit": 3, "desc": "Creates a PHP stream context", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator" }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/client::js-fetch-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript fetch API" }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-os-constant", "conf": 0.7, "crit": 3, "desc": "Reads the PHP OS constant", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-key-request-parameter", "conf": 0.82, "crit": 3, "desc": "Reads key PHP request parameter", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 3, "desc": "SQL SELECT syntax reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-callback-dispatch", "conf": 0.85, "crit": 3, "desc": "Calls a PHP callback dispatcher", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/interpreter/php-assert::php-assert-call", "atk": "T1505.003,T1059.006", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Calls PHP assert", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/json-read::php-json-decode", "conf": 0.9, "crit": 3, "desc": "PHP JSON deserialization", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/ui/window/manage/overlay::remote-url-near-element-src-assignment", "conf": 0.9, "crit": 3, "desc": "Remote URL near an element src assignment", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/process/create/local-exec::shell-variable-exec-with-args", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "Shell runs a variable command with args", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/os/clipboard/access::browser-select-before-copy", "atk": "T1115", "conf": 0.78, "crit": 1, "desc": "Calls select() on a browser element" }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "SHA1 hash computation", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/email/send/mail-func::mail-call", "conf": 0.6, "crit": 3, "desc": "Sends email via mail()", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/access::php-getenv-call", "conf": 0.85, "crit": 3, "desc": "Calls PHP getenv", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/string/conversion::ord-call", "mbc": "C0000", "conf": 0.65, "crit": 3, "desc": "PHP ord() character-to-code conversion", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/check::php-is-writable-call", "conf": 0.9, "crit": 3, "desc": "Checks path writability via PHP is_writable()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/read/file::file-get-contents", "mbc": "C0051", "conf": 0.75, "crit": 2, "desc": "File read via file_get_contents", "from": [ { "file": 5 } ] }, { "id": "objectives/persistence/login/account/create::sql-insert-into-users-table", "atk": "T1136.001,T1505", "mbc": "F0007", "conf": 0.9, "crit": 3, "desc": "SQL inserts into a users table", "from": [ { "file": 8 } ] }, { "id": "objectives/command-and-control/backdoor/webshell/exec::php-assert-server-header-webshell", "atk": "T1505.003,T1059.006", "mbc": "B0030", "conf": 0.96, "crit": 5, "desc": "PHP assert backdoor reads request headers", "from": [ { "file": 1 } ], "uses": [ 11, 14, 85 ] }, { "id": "micro-behaviors/communications/http/request/params::cookie", "conf": 0.8, "crit": 3, "desc": "Reads PHP cookie data via $_COOKIE", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/write/file/direct::file-put-contents", "atk": "T1105", "mbc": "C0052", "conf": 0.8, "crit": 3, "desc": "Creates or overwrites a local file", "from": [ { "file": 19 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 24 }, { "file": 25 }, { "file": 26 }, { "file": 27 }, { "file": 28 }, { "file": 29 }, { "file": 30 }, { "file": 50 } ], "uses": [ 16 ] }, { "id": "micro-behaviors/communications/http/request/cgi::request-metadata-sweep", "conf": 0.88, "crit": 3, "desc": "Names four or more CGI request variables", "from": [ { "off": 6665, "file": 6, "line": 238 }, { "off": 8486, "file": 10, "line": 344 }, { "off": 55, "file": 18, "line": 5 }, { "off": 2090, "file": 23, "line": 76 } ], "uses": [ 10, 29, 57, 72 ] }, { "id": "micro-behaviors/communications/http/request/params::php-post-password-field", "conf": 0.9, "crit": 3, "desc": "Reads password field from PHP $_POST", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "from": [ { "file": 5 } ] }, { "id": "objectives/execution/interpreter/php-assert::assert-evaluates-server-input", "atk": "T1505.003,T1059.006", "mbc": "B0030", "conf": 0.95, "crit": 5, "desc": "assert evaluates server input", "from": [ { "file": 1 } ], "uses": [ 11, 85 ] }, { "id": "micro-behaviors/process/create/shell/spawn::php-passthru", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "PHP passthru() function call", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/os/stdio::php-echo-statement", "conf": 0.95, "crit": 3, "desc": "Emits data with a PHP echo statement" }, { "id": "micro-behaviors/data/db/sqlite::sqlite3-cli", "conf": 0.8, "crit": 3, "desc": "sqlite3 command invocation", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-regex-callback-api", "conf": 0.9, "crit": 3, "desc": "Calls PHP regex callback replacement API", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/post::php-stream-context-http-post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "PHP sends HTTP POST via stream context", "from": [ { "off": 28978, "file": 6, "line": 1087 }, { "file": 7 }, { "file": 10 }, { "off": 2085, "file": 11, "line": 79 }, { "file": 13 }, { "file": 14 }, { "file": 28 } ], "uses": [ 15, 76, 98 ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "from": [ { "file": 3 } ] } ] } ] } }