{ "ml": { "v": "7", "id": 353, "lvl": -1, "conf": 0, "prob": 0.000014424324035644531, "type": "registry", "version": "v18.18", "analyzed_at": "2026-09-25T07:51:15Z" }, "path": "mitmproxy-node@1.0.1", "raw": { "rev": "c1ea9", "files": [ { "id": 376, "mol": "K₂(Li₁₅Mc₄)O₁₄(As₁₇Al₃C₇CaCoDy₂Er₇EuI₅La₂PPrS₂Xe₃)H₁₁(Cm₅₁Cr₁₈Db₂₆Ds₂F₃₆Hf₈Mg₇Os₂₉Po₃₇Ti₂U₇)Md₉(Bi₂₆Bk₂He₄In₉Pa₁₀PmPt₃Si₅)Th₃", "pid": 318, "rel": "fetched", "sha": "6fdcb2df889da1e9b19dfcbf5e35720559b9bf6f23d8b85826cd64e50b3abae1", "via": "https://registry.npmjs.org/@oxygenhq/mitmproxy-node/-/mitmproxy-node-1.0.1.tgz", "path": "pkg:npm/%40oxygenhq/mitmproxy-node@1.0.1", "risk": 527, "size": 54267642, "type": "tar.gz", "depth": 2, "facts": { "metrics": { "file": { "size": 54267642, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 54194938, "peak_region_entropy": 7.86 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "self_dependency": 0, "unused_runtime_deps": 0, "metadata_identity_mismatch": 0 } } }, "ident": { "name": { "value": "mitmproxy-node", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "1.0.1", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/process/control/info::process-info-class-30-constant", "atk": "T1562", "conf": 0.8, "crit": 3, "desc": "Immediate process-information class value 30", "from": [ { "file": 22 } ] }, { "id": "objectives/command-and-control/remote-command/tasking::rat-input-capture-command--keylog", "atk": "T1105", "mbc": "B0030", "conf": 0.86, "crit": 3, "desc": "RAT input capture command (keylog)", "from": [ { "file": 30 } ] }, { "id": "third_party/SigBase/Windivert/Driver", "conf": 0.9, "crit": 5, "desc": "Detects WinDivert User-Mode packet capturing driver" }, { "id": "micro-behaviors/ui/window/control::show-window", "conf": 0.7, "crit": 2, "desc": "Show or hide window", "from": [ { "file": 87 } ] }, { "id": "metadata/file/string/identity::android-getprop-platform-marker", "conf": 0.9, "crit": 3, "desc": "Android getprop command marker", "from": [ { "file": 2105 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-pipe-communicate", "atk": "T1059.006", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Popen with PIPE stdio then communicate()", "from": [ { "file": 1253 } ] }, { "id": "micro-behaviors/data/decode/base64::b64decode-string", "conf": 0.66, "crit": 3, "desc": "Standard Base64 decoder reference", "from": [ { "file": 1236 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1", "conf": 0.95, "crit": 3, "desc": "SHA1 hashing functions", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.95, "crit": 2, "desc": "Microsoft timestamp certificate chain", "from": [ { "file": 14 } ] }, { "id": "metadata/lang/natural::polish-common-word-nie", "conf": 1.0, "crit": 1, "desc": "Polish common word nie", "from": [ { "file": 1140 } ] }, { "id": "micro-behaviors/communications/socket/init::wsa-send", "conf": 0.9, "crit": 3, "desc": "Winsock overlapped send import", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/header/custom::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "from": [ { "file": 379 }, { "file": 450 }, { "file": 451 } ], "uses": [ 536 ] }, { "id": "micro-behaviors/communications/ssh/connect::openssh", "conf": 0.5, "crit": 2, "desc": "OpenSSH string", "from": [ { "file": 1294 } ] }, { "id": "micro-behaviors/os/env/user-paths::tmpdir-var", "conf": 0.5, "crit": 2, "desc": "TMPDIR environment variable", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-create-hash", "conf": 0.9, "crit": 3, "desc": "Create cryptographic hash object", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 2215 } ] }, { "id": "objectives/evasion/process/injection/callback::enum-windows-callback", "atk": "T1106", "mbc": "E1106", "conf": 0.6, "crit": 3, "desc": "EnumWindows / EnumChildWindows API", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/section/ratio::pe-near-total-code-data", "conf": 0.94, "crit": 3, "desc": "PE code-to-data ratio at least 0.99", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/os/event/log::report-event", "conf": 0.92, "crit": 2, "desc": "Write Windows event log entry", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/socket/options::socket-type-constant-names", "conf": 0.9, "crit": 2, "desc": "Many SOCK_ socket type constant names", "from": [ { "file": 28 } ] }, { "id": "metadata/binary/symbols/imports::getstockobject-import", "conf": 0.98, "crit": 3, "desc": "GetStockObject import symbol", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/data/format/json::json-result-field", "conf": 0.8, "crit": 3, "desc": "JSON result or response field key", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6, "crit": 2, "desc": "References X.509 certificate terminology", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/masquerade/versioninfo::random-alnum-original-name-token", "atk": "T1036.005", "conf": 0.94, "crit": 1, "desc": "Extensionless alphanumeric original filename" }, { "id": "objectives/supply-chain/install-hook/build/behavioral::setup-py-network-known-package-profile", "atk": "T1195.002", "conf": 0.9, "crit": 3, "desc": "Known setup.py network package profile", "from": [ { "file": 379 }, { "file": 459 } ], "uses": [ 141 ] }, { "id": "metadata/import/python/base64::base64", "conf": 0.95, "crit": 3, "desc": "imports base64", "from": [ { "file": 2215 } ] }, { "id": "metadata/binary/symbols/fake-windows::gui-import-cluster-beginpaint", "conf": 0.9, "crit": 3, "desc": "GUI import cluster BeginPaint", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/socket/options::ip-hdrincl-constant", "conf": 0.75, "crit": 3, "desc": "IP_HDRINCL socket option", "from": [ { "file": 28 } ] }, { "id": "metadata/lang/natural::lang-arabic-script", "conf": 0.8, "crit": 3, "desc": "Contains Arabic-script text", "from": [ { "file": 358 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk", "conf": 0.66, "crit": 2, "desc": "Traverse filesystem hierarchy (os.walk)", "from": [ { "file": 1921 } ] }, { "id": "metadata/binary/linking/api-set::api-set-core-cluster", "conf": 0.9, "crit": 3, "desc": "Dense api-ms-win-core string cluster", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/ui/window/probe::get-active-window", "conf": 0.9, "crit": 3, "desc": "GetActiveWindow API reference", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-data-body", "conf": 0.9, "crit": 3, "desc": "urllib Request carries an HTTP body" }, { "id": "objectives/evasion/masquerade/versioninfo::random-alnum-internal-name-token", "atk": "T1036.005", "conf": 0.9, "crit": 1, "desc": "Opaque alphanumeric InternalName token" }, { "id": "well-known/lib/crypto/openssl::openssl-cryptogams", "conf": 0.95, "crit": 3, "desc": "OpenSSL cryptographic library", "from": [ { "file": 379 }, { "off": 28512, "file": 450 }, { "off": 76016, "file": 451 } ], "uses": [ 77 ] }, { "id": "metadata/binary/layout/stub::wrapper-file-size-band", "conf": 0.97, "crit": 3, "desc": "Wrapper file size band", "from": [ { "file": 89 } ] }, { "id": "metadata/import/c/float/h::float/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cfloat.h\u003e", "from": [ { "file": 91 } ] }, { "id": "metadata/binary/symbols/count::very-many-imports", "conf": 0.8, "crit": 3, "desc": "Very high imported symbol count (\u003e400)", "from": [ { "file": 77 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::privatekey-identifier", "conf": 0.8, "crit": 3, "desc": "Private-key identifier reference", "from": [ { "file": 1755 } ] }, { "id": "micro-behaviors/time/query::systemtime-tz-convert", "conf": 0.9, "crit": 2, "desc": "Convert time to local timezone" }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "conf": 0.9, "crit": 2, "desc": "Begin directory enumeration ANSI", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/socket/options::msg-flag-constant-names", "conf": 0.9, "crit": 2, "desc": "Many MSG_ flag constant names", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/socket/ssl::ssl-write-symbol", "conf": 0.66, "crit": 3, "desc": "OpenSSL SSL_write API", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/data/compress/lzma::liblzma", "conf": 0.9, "crit": 3, "desc": "liblzma library", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/process/info/current::get-module-filename", "conf": 0.7, "crit": 2, "desc": "GetModuleFileName API call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encode/image/pixel::pixel-access-getpixel", "conf": 0.8, "crit": 2, "desc": ".NET Bitmap.GetPixel per-pixel read", "from": [ { "file": 87 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 1468 } ], "uses": [ 201, 390 ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.88, "crit": 3, "desc": "X25519 or Curve25519 algorithm reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/socket/tcp::pong-keepalive-token", "conf": 0.75, "crit": 3, "desc": "Text-based PONG keepalive token", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/process/argument/credential::password-required-flag", "conf": 0.8, "crit": 3, "desc": "Password command-line argument", "from": [ { "file": 1256 } ] }, { "id": "metadata/signed/trust-level::unsigned-macho", "conf": 1.0, "crit": 3, "desc": "Mach-O binary is not digitally signed" }, { "id": "micro-behaviors/fs/enumerate/directory::find-close", "conf": 0.9, "crit": 2, "desc": "Close directory enumeration handle", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/privilege/token::open-process-token", "conf": 0.75, "crit": 3, "desc": "OpenProcessToken API symbol" }, { "id": "micro-behaviors/process/threading/concurrency::create-io-completion-port", "conf": 0.92, "crit": 3, "desc": "Creates a Windows IOCP", "from": [ { "file": 26 } ] }, { "id": "metadata/permission/capture::permission-grant-access-verb", "conf": 0.86, "crit": 3, "desc": "Permission grant followed by access", "from": [ { "file": 271 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::ssl-certs-path", "conf": 0.8, "crit": 2, "desc": "References the system TLS certificate directory", "from": [ { "file": 1185 } ] }, { "id": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "conf": 0.3, "crit": 2, "desc": "libcrypto library reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/thread::open-thread", "atk": "T1055.004", "conf": 0.9, "crit": 3, "desc": "Open thread handle" }, { "id": "objectives/anti-static/obfuscation/binary-structure::kernel-driver-string", "atk": "T1055", "conf": 1.0, "crit": 3, "desc": "Win kernel driver artifact (ntoskrnl/storport)", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-ex-a", "atk": "T1574.002", "conf": 0.95, "crit": 2, "desc": "Extended dynamic library loading (ANSI)" }, { "id": "metadata/import/python/mitmproxy/http::http", "conf": 0.95, "crit": 3, "desc": "imports http from mitmproxy", "from": [ { "file": 2215 } ] }, { "id": "objectives/anti-static/obfuscation/payload/camouflage::low-entropy-rsrc", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "Resource section entropy is unusually low", "from": [ { "file": 74 } ] }, { "id": "metadata/file/archive::archive-at-least-120-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 120 members", "from": [ { "file": 92 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-115", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 115 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "conf": 0.85, "crit": 3, "desc": "Open named file mapping (Unicode)" }, { "id": "micro-behaviors/communications/socket/ssl::ssl-read-symbol", "conf": 0.66, "crit": 3, "desc": "OpenSSL SSL_read API", "from": [ { "file": 30 } ] }, { "id": "metadata/package/files/wheel-sdist::distutils-command-import-content", "conf": 0.8, "crit": 3, "desc": "Python distutils setup or command import" }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--returncode", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (returncode)", "from": [ { "file": 1191 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-2", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 2 by number", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/proxy/mitm::mitmproxy-command--mitmproxy", "conf": 0.9, "crit": 3, "desc": "mitmproxy command invocation (mitmproxy)", "from": [ { "file": 2214 } ] }, { "id": "objectives/discovery/process/targeting::toolhelp-enumeration-with-access", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "ToolHelp snapshot enumeration with process access", "from": [ { "file": 379 }, { "off": 1906, "file": 428 }, { "off": 2302576, "file": 459 } ], "uses": [ 531, 602 ] }, { "id": "micro-behaviors/os/sysinfo/hostname::host-identity-query", "conf": 0.86, "crit": 3, "desc": "Queries a host identity value", "from": [ { "file": 379 }, { "off": 37088, "file": 404 }, { "file": 434 }, { "off": 1344320, "file": 462 } ], "uses": [ 889 ] }, { "id": "micro-behaviors/process/inject/runtime/call::remote-process-memory-api-cluster", "conf": 0.96, "crit": 3, "desc": "Two or more remote-process memory APIs", "from": [ { "file": 379 }, { "off": 2009, "file": 424 } ], "uses": [ 459, 800 ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::map-virtual-key", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.85, "crit": 3, "desc": "Map virtual key code", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/symbols/exports::single-export", "conf": 0.75, "crit": 3, "desc": "Binary exports one symbol", "from": [ { "file": 16 } ] }, { "id": "well-known/lib/crypto/openssl::cryptogams-attrib", "conf": 0.95, "crit": 2, "desc": "CRYPTOGAMS assembly attribution string", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request-client-import", "conf": 0.82, "crit": 3, "desc": "Imports Python urllib.request through direct or from-import syntax", "from": [ { "file": 2591 } ], "uses": [ 125 ] }, { "id": "micro-behaviors/ui/help::bracketed-parameter-usage", "conf": 0.96, "crit": 3, "desc": "Usage text lists command-line parameters", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/fs/file/open::open-base", "conf": 0.66, "crit": 2, "desc": "Open files", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/hardware/input/mouse/position::get-cursor-pos", "conf": 0.85, "crit": 2, "desc": "Poll mouse cursor position", "from": [ { "file": 87 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "atk": "T1045", "mbc": "B0032", "conf": 0.6, "crit": 3, "desc": "Single section dominates file", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "from": [ { "file": 2215 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 2 } ] }, { "id": "well-known/malware/trojan/elex/astori-downloader::elex-uuid-format", "conf": 1.0, "crit": 3, "desc": "Elex C2 UUID formatter string", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/mem/alloc/executable::page-execute-readwrite", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "PAGE_EXECUTE_READWRITE flag", "from": [ { "file": 83 } ] }, { "id": "metadata/lang/natural::lang-telugu", "conf": 0.8, "crit": 3, "desc": "Telugu script detection", "from": [ { "file": 472 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members", "from": [ { "file": 92 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::python-http-basic-auth-handler", "conf": 0.9, "crit": 3, "desc": "Builds an HTTP basic-auth handler", "from": [ { "file": 1453 } ] }, { "id": "micro-behaviors/process/sync/mutex::create-mutex-ex", "mbc": "C0042", "conf": 0.9, "crit": 2, "desc": "CreateMutexEx API call (extended)" }, { "id": "micro-behaviors/hardware/input/keyboard/poll::foreground-window-input-state", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.9, "crit": 3, "desc": "Foreground-window input state checks", "from": [ { "file": 379 }, { "off": 992752, "file": 463 } ], "uses": [ 263, 628 ] }, { "id": "micro-behaviors/communications/email/mime::mime-base64-attachment", "conf": 0.9, "crit": 3, "desc": "MIME base64 attachment encoding", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/provenance/version-info::pe-internal-name-is-phrase", "conf": 0.9, "crit": 2, "desc": "InternalName is a multi-word phrase" }, { "id": "metadata/binary/symbols/imports::ordinal-import-16", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 16 by number", "from": [ { "file": 25 } ] }, { "id": "metadata/binary/section/ratio::oversized-rdata-ratio", "conf": 1.0, "crit": 3, "desc": ".rdata significantly larger than .text", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/socket/send::python-sendall-pyc-name", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Python socket sendall name in bytecode", "from": [ { "file": 1185 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.9, "crit": 3, "desc": "Microsoft vendor marker in resource section", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/registry/access::registry-binary-value-type", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "REG_BINARY value type name", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo-import", "conf": 0.9, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "from": [ { "file": 28 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "conf": 0.8, "crit": 3, "desc": "Large PE resource section (\u003e150KB)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/capture/windivert::windivert-send", "atk": "T1040", "conf": 0.95, "crit": 3, "desc": "Sends or reinjects packets through WinDivert", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdh::ecdh-api-reference", "atk": "T1573.001", "conf": 0.88, "crit": 3, "desc": "ECDH key-agreement API reference", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/debug::pdb-numbered-path", "conf": 0.45, "crit": 3, "desc": "PDB in numbered directory (build artifacts)" }, { "id": "metadata/binary/layout/overlay::overlay-dominates-80pct", "conf": 0.94, "crit": 3, "desc": "PE overlay exceeds eighty percent", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/ip/literal::all-ones-ipv4-literal", "conf": 0.9, "crit": 3, "desc": "All-ones IPv4 literal (broadcast/netmask)", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-bitmap-transfer-primitives", "conf": 0.94, "crit": 3, "desc": "Windows GDI bitmap transfer primitives", "from": [ { "file": 379 }, { "off": 1260872, "file": 463 } ], "uses": [ 178, 207, 347, 619, 841 ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.66, "crit": 3, "desc": "References inet_ntop IP-to-text API", "from": [ { "file": 26 } ] }, { "id": "objectives/command-and-control/dropper/delivery/flash::swf-http-url", "atk": "T1105", "mbc": "B0023", "conf": 0.9, "crit": 3, "desc": "Flash movie carries an HTTP URL", "from": [ { "file": 240 } ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/traversal/drives::logical-drive-enumeration", "atk": "T1083", "conf": 0.89, "crit": 3, "desc": "Enumerate logical drives", "from": [ { "file": 379 }, { "file": 416 }, { "off": 1623372, "file": 462 }, { "file": 464 } ], "uses": [ 732, 869 ] }, { "id": "micro-behaviors/dylib/load/runtime::dlerror", "atk": "T1574.006", "conf": 0.8, "crit": 3, "desc": "Dynamic linker error handling", "from": [ { "file": 1 } ] }, { "id": "metadata/package/dependencies/manifest/presence::has-runtime-deps", "conf": 0.85, "crit": 3, "desc": "Package declares a runtime dependency", "from": [ { "file": 2213 } ] }, { "id": "micro-behaviors/communications/modbus::read-holding-registers", "conf": 0.9, "crit": 3, "desc": "Modbus read holding registers frame", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/process/info/thread::thread-context-api-pair", "atk": "T1055.003", "conf": 0.96, "crit": 3, "desc": "Paired thread context API names", "from": [ { "file": 379 }, { "off": 2002, "file": 428 } ], "uses": [ 724, 875 ] }, { "id": "metadata/binary/symbols/export-name-pattern::many-lowercase-snakecase-exports", "conf": 0.88, "crit": 3, "desc": "Many lowercase snake-case export names", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-string", "atk": "T1090", "mbc": "C0001", "conf": 0.5, "crit": 3, "desc": "SOCKS5 proxy URL or operation marker", "from": [ { "file": 1852 } ] }, { "id": "metadata/binary/layout/overlay::overlay-at-least-80k", "conf": 0.7, "crit": 3, "desc": "Appended data occupies at least 80 KiB", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/source/arithmetic::source-xor-operation", "conf": 1.0, "crit": 3, "desc": "Source references XOR syntax", "from": [ { "file": 269 } ] }, { "id": "metadata/import/npm/child_process::child_process", "conf": 0.95, "crit": 3, "desc": "imports child_process", "from": [ { "file": 2211 } ] }, { "id": "metadata/binary/resource/manifest::pe-version-and-manifest-only", "conf": 0.88, "crit": 3, "desc": "PE ships only RT_VERSION + RT_MANIFEST resources", "from": [ { "file": 16 } ], "uses": [ 230, 474, 667 ] }, { "id": "micro-behaviors/fs/path/temp::unix-var-temp", "conf": 0.7, "crit": 2, "desc": "Unix /var/tmp/ path reference", "from": [ { "file": 2058 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/fs/temp/directory::python-temporary-directory-context", "conf": 0.9, "crit": 3, "desc": "Uses a Python TemporaryDirectory context", "from": [ { "file": 1728 } ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "from": [ { "file": 2215 } ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-path-marker", "conf": 0.98, "crit": 2, "desc": "Embedded MSVC runtime DLL path", "from": [ { "file": 14 } ] }, { "id": "metadata/import/c/io/h::io/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cio.h\u003e", "from": [ { "file": 91 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::volume-enumeration-workflow", "conf": 0.94, "crit": 3, "desc": "Enumerates Windows volumes with first and next operations", "from": [ { "file": 379 }, { "file": 416 } ], "uses": [ 206, 685 ] }, { "id": "micro-behaviors/process/create/exec::cmd-shell-via-createprocess", "conf": 0.95, "crit": 3, "desc": "cmd.exe /c executed via CreateProcess", "from": [ { "file": 379 }, { "off": 1786, "file": 427 }, { "off": 2303000, "file": 459 }, { "off": 1344224, "file": 462 }, { "off": 759104, "file": 464 } ], "uses": [ 182, 349 ] }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/volume/admin::delete-volume-mount-point-w", "conf": 0.8, "crit": 3, "desc": "Remove a volume mount point" }, { "id": "metadata/signed/certificate/signature::symantec-timestamp-signer-overlay-text", "conf": 0.84, "crit": 3, "desc": "Symantec timestamp signer text in PE overlay", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/fs/watch/monitor::read-directory-changes-w", "atk": "T1083", "mbc": "C0046", "conf": 0.9, "crit": 3, "desc": "ReadDirectoryChangesW directory monitoring" }, { "id": "metadata/binary/code/complexity::few-functions", "conf": 0.4, "crit": 3, "desc": "Very few functions detected", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/process/create/spawn::update-proc-thread-attribute", "atk": "T1134", "conf": 0.95, "crit": 3, "desc": "Update process attribute list" }, { "id": "objectives/evasion/masquerade/version-resource/python-dll::muddywaters-python-dll-basename", "conf": 0.9, "crit": 3, "desc": "CPython DLL basename", "from": [ { "file": 82 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker", "conf": 0.9, "crit": 3, "desc": "Parsed Microsoft vendor claim", "uses": [ 429, 933 ] }, { "id": "micro-behaviors/os/registry/access::reg-create-key-a", "atk": "T1112", "conf": 0.85, "crit": 2, "desc": "Create registry key via WinAPI", "from": [ { "file": 83 } ] }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "conf": 0.84, "crit": 2, "desc": "Enumerate installed locales" }, { "id": "metadata/package/files/system-package::os-python-runtime-path", "conf": 0.96, "crit": 2, "desc": "OS Python runtime path" }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.9, "crit": 2, "desc": "Move or rename file with options" }, { "id": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "conf": 0.86, "crit": 2, "desc": "Register unhandled exception filter", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/sysinfo/config::set-local-time-pinvoke", "conf": 0.86, "crit": 3, "desc": ".NET local system-clock setter reference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::named-pipe-client-server", "atk": "T1559", "conf": 0.82, "crit": 3, "desc": "Named pipe server and client wait", "from": [ { "file": 379 }, { "file": 402 }, { "off": 1742, "file": 425 }, { "off": 2303024, "file": 459 } ], "uses": [ 542, 997, 1009 ] }, { "id": "metadata/lang/natural::lang-indonesian--atom-2", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"dan\"", "from": [ { "file": 1471 } ] }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "conf": 0.9, "crit": 2, "desc": "Set file position extended" }, { "id": "objectives/impact/degrade/services::native-web-service-targets", "atk": "T1489", "conf": 0.88, "crit": 1, "desc": "Native web service targets", "from": [ { "off": 24141710, "file": 378 } ], "uses": [ 701 ] }, { "id": "micro-behaviors/communications/http/client/library::openssl-https-proxy-diagnostic", "conf": 0.95, "crit": 3, "desc": "OpenSSL HTTPS proxy-request diagnostic string", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/bpf/trace-tools::tracee", "conf": 0.9, "crit": 3, "desc": "Tracee observability", "from": [ { "file": 1858 } ] }, { "id": "well-known/malware/botnet/pcpjack::pcpjack-staged-module-names", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "PCPJack staged module names", "from": [ { "file": 1260 } ] }, { "id": "micro-behaviors/fs/traversal/drives::drive-context-switching", "atk": "T1083", "conf": 0.86, "crit": 3, "desc": "Drive context switching via cwd APIs", "from": [ { "file": 379 }, { "off": 3977, "file": 416 }, { "off": 1734, "file": 426 }, { "off": 2302648, "file": 459 }, { "off": 1344488, "file": 462 }, { "off": 992080, "file": 463 }, { "off": 759024, "file": 464 } ], "uses": [ 110, 528, 789, 909 ] }, { "id": "micro-behaviors/communications/socket/tcp::sock-stream", "conf": 0.5, "crit": 3, "desc": "SOCK_STREAM socket type", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.66, "crit": 3, "desc": "Uses opendir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-result-pyc", "atk": "T1059.006", "conf": 0.9, "crit": 3, "desc": "Bytecode references subprocess result status", "from": [ { "file": 1191 } ], "uses": [ 68, 539 ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/temp/pyinstaller::pyinstaller-spyiboot", "conf": 0.95, "crit": 3, "desc": "PyInstaller bootstrap entry", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/control::set-window-pos", "conf": 0.7, "crit": 2, "desc": "Change window position/size", "from": [ { "file": 87 } ] }, { "id": "metadata/package/versioning/scheme::version-resource-metadata", "conf": 0.9, "crit": 2, "desc": "PE version resource metadata", "from": [ { "file": 14 } ], "uses": [ 109, 829, 862 ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "from": [ { "file": 1470 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-19", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 19 by number", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/os/syscall/invoke::all-ones-handle-constant", "conf": 0.8, "crit": 3, "desc": "All-ones x64 handle constant", "from": [ { "file": 20 } ] }, { "id": "objectives/execution/exploit/network-service/service-api-abuse::reflective-loader-error-marker", "atk": "T1190", "conf": 0.96, "crit": 3, "desc": "Reflection or resource loader error marker", "from": [ { "file": 487 } ] }, { "id": "micro-behaviors/fs/file/binary::file-position-api", "conf": 0.78, "crit": 3, "desc": "References a file-position API", "from": [ { "file": 1 } ], "uses": [ 573, 587, 863 ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "atk": "T1082", "conf": 0.9, "crit": 2, "desc": "Query Windows version info", "from": [ { "file": 58 } ] }, { "id": "metadata/lang/natural::lang-korean", "conf": 0.8, "crit": 3, "desc": "Contains Hangul script", "from": [ { "file": 439 } ] }, { "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command", "conf": 0.9, "crit": 3, "desc": "Shell evaluates variable command", "from": [ { "file": 272 } ] }, { "id": "micro-behaviors/fs/temp/py2exe::py2exe-zipimport", "conf": 0.85, "crit": 3, "desc": "py2exe zipimport bootstrap", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "conf": 0.8, "crit": 2, "desc": "Duplicate object handle" }, { "id": "metadata/lang/upstream::exports-mem-map-inject-api--virtualallocex", "conf": 0.9, "crit": 3, "desc": "Exports memory/section (VirtualAllocEx)" }, { "id": "micro-behaviors/ui/window/control::enable-window", "conf": 0.7, "crit": 2, "desc": "Enable/disable window", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/socket/raw::sock-raw-constant", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "SOCK_RAW constant name", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc", "atk": "T1055", "conf": 0.9, "crit": 2, "desc": "Kernel pool memory allocation", "from": [ { "file": 264 } ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-pyc-name", "atk": "T1071", "mbc": "C0001", "conf": 0.8, "crit": 3, "desc": "socket module near connect in bytecode", "from": [ { "file": 1185 } ] }, { "id": "objectives/command-and-control/channel/http/message::ocsp-request-content-type", "atk": "T1071.001", "conf": 1.0, "crit": 3, "desc": "OCSP request content type", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/ui/window/region::get-dc", "conf": 0.7, "crit": 2, "desc": "Get device context", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "from": [ { "file": 2591 } ], "uses": [ 484 ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::js-platform-win32-check", "conf": 0.6, "crit": 2, "desc": "Checks whether Node.js runs on Windows", "from": [ { "file": 2211 } ] }, { "id": "objectives/collection/file-targeting/filter::android-image-mime", "conf": 0.88, "crit": 3, "desc": "Image MIME file category", "from": [ { "file": 271 } ] }, { "id": "micro-behaviors/process/create/spawn::create-process-w", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "CreateProcessW API symbol" }, { "id": "micro-behaviors/os/callback/apc::queue-user-apc", "conf": 0.95, "crit": 3, "desc": "QueueUserAPC callback scheduling reference", "from": [ { "file": 51 } ] }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-dll-name", "mbc": "C0021", "conf": 0.9, "crit": 3, "desc": "Windows BCrypt DLL name", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 2211 } ] }, { "id": "metadata/binary/layout/overlay::large-overlay-64k", "conf": 0.95, "crit": 3, "desc": "Overlay size at least 64 KiB", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-23", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 23 by number", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/socket/receive::socket-recv-pyc-name", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Marshalled recv name in Python bytecode", "from": [ { "file": 1185 } ] }, { "id": "micro-behaviors/communications/http/post::post-string-pe", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 2, "desc": "HTTP POST method string reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/format/office/document::document-extension-literal", "conf": 0.8, "crit": 1, "desc": "References a document filename suffix", "from": [ { "file": 1261 } ] }, { "id": "micro-behaviors/fs/temp/pyinstaller::runtime-tmpdir-option", "conf": 0.98, "crit": 3, "desc": "PyInstaller runtime tempdir option", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect-ex", "conf": 0.95, "crit": 3, "desc": "Modify memory protection with VirtualProtectEx" }, { "id": "objectives/evasion/masquerade/binary::overlay-pkcs7-signeddata-oid", "atk": "T1036.001", "conf": 0.9, "crit": 3, "desc": "PKCS7 SignedData OID in overlay", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "child_process module name literal", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/ui/window/enumerate::enum-windows", "conf": 0.85, "crit": 3, "desc": "Enumerate top-level windows", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/data/string/case::source-case-transform", "conf": 0.9, "crit": 3, "desc": "Source changes string letter casing", "from": [ { "file": 269 } ] }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "conf": 0.9, "crit": 3, "desc": "PE overlay exceeds thirty percent", "from": [ { "file": 34 } ] }, { "id": "micro-behaviors/fs/temp/pyinstaller::pyinstaller-script-fail", "conf": 0.9, "crit": 3, "desc": "PyInstaller script execution error", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/lifecycle/supervise::supervisor-active-state", "conf": 0.88, "crit": 3, "desc": "Checks a process active state", "from": [ { "file": 83 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 1468 } ], "uses": [ 390, 681 ] }, { "id": "micro-behaviors/ui/window/station::get-process-window-station", "conf": 0.8, "crit": 2, "desc": "Query process window station", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-dd-file-write", "conf": 0.86, "crit": 3, "desc": "Shell dd writes output to a file", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-traversal-text", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Process32 snapshot traversal API text", "from": [ { "file": 83 } ] }, { "id": "metadata/signed/leaf::python-software-foundation", "conf": 1.0, "crit": 3, "desc": "Signed by Python Software Foundation", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::windows-volume-enumeration", "atk": "T1083", "conf": 0.9, "crit": 3, "desc": "Enumerates Windows volumes", "from": [ { "file": 379 }, { "off": 2750, "file": 416 } ], "uses": [ 327 ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-bitblt", "atk": "T1113", "mbc": "C0014", "conf": 0.9, "crit": 2, "desc": "GDI BitBlt raster copy API", "from": [ { "file": 87 } ] }, { "id": "objectives/impact/infect/binary/dos::dos-com-exe-mask", "atk": "T1080", "conf": 0.84, "crit": 3, "desc": "DOS filename wildcard for infection", "from": [ { "file": 1097 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdin-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdin to custom stream", "from": [ { "file": 2048 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::chacha20-keyword", "conf": 0.7, "crit": 3, "desc": "ChaCha20 cipher algorithm reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::find-resource-any", "atk": "T1027.009", "conf": 0.8, "crit": 3, "desc": "Locates a PE resource entry", "from": [ { "file": 379 }, { "off": 1533, "file": 422 }, { "file": 463 } ], "uses": [ 335, 438 ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::pipe-type-message", "atk": "T1559", "conf": 0.6, "crit": 3, "desc": "PIPE_TYPE_MESSAGE mode", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::is-processor-feature-present", "atk": "T1082", "conf": 0.9, "crit": 2, "desc": "Checks Windows processor feature availability", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/control/info::process-info-class-31-constant", "atk": "T1562", "conf": 0.8, "crit": 3, "desc": "Immediate process-information class value 31", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdh::ecdh-compute-key", "conf": 0.9, "crit": 3, "desc": "ECDH_compute_key reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::write-process-memory-text", "atk": "T1055", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "WriteProcessMemory named, not imported", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::request-pyc-name", "conf": 0.72, "crit": 1, "desc": "Request name in Python bytecode", "from": [ { "file": 1187 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 379 }, { "off": 84080, "file": 456 }, { "off": 2408688, "file": 459 }, { "off": 1161088, "file": 463 } ], "uses": [ 399, 961 ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-basename", "conf": 0.98, "crit": 2, "desc": "Microsoft C++ runtime DLL filename", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/ui/window/message::def-window-proc", "conf": 0.7, "crit": 2, "desc": "Default window procedure", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/time/query::filetime-to-systemtime", "conf": 0.9, "crit": 2, "desc": "Convert FILETIME to SYSTEMTIME" }, { "id": "micro-behaviors/data/source/arithmetic::lsb-bit-mask-source", "conf": 1.0, "crit": 3, "desc": "Source contains low-bit mask syntax", "from": [ { "file": 483 } ] }, { "id": "objectives/anti-analysis/sandbox-detect/script::python-debugger-tool-string--objdump", "atk": "T1497", "mbc": "B0007", "conf": 0.9, "crit": 3, "desc": "Python debugger tool string (objdump)", "from": [ { "file": 1359 } ] }, { "id": "metadata/hardening/memory::wx-section", "conf": 1.0, "crit": 3, "desc": "Writable and exe section (W^X violation)", "from": [ { "file": 264 } ] }, { "id": "metadata/binary/symbols/version-proxy::version-export-verlanguagenamew", "conf": 0.99, "crit": 3, "desc": "Version.dll VerLanguageNameW export" }, { "id": "objectives/anti-static/obfuscation/control-flow/dispatch::sparse-opaque-pe-profile-code", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Large PE with elevated code entropy", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/ssl::ssl-ctx-new-symbol", "conf": 0.66, "crit": 3, "desc": "SSL context creation API", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-acquire-context", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "Acquire cryptographic service provider context", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/header/malformed::vcruntime-dll-basename", "conf": 0.99, "crit": 3, "desc": "Visual C++ runtime DLL basename", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-count-two", "conf": 1.0, "crit": 2, "desc": "PE has exactly two resource entries", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/process/threading/concurrency::post-queued-completion-status", "conf": 0.92, "crit": 3, "desc": "Posts work to Windows IOCP", "from": [ { "file": 26 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Sparse import table", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/os/registry/manipulate::registry-hive-swap-apis-cond-0--inline-11068", "conf": 0.94, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/crypto/library/keyword::cipher-keyword", "conf": 0.4, "crit": 2, "desc": "Generic 'cipher' crypto term", "from": [ { "file": 6 } ] }, { "id": "well-known/lib/concurrency/gevent::gevent-package-marker", "conf": 0.99, "crit": 3, "desc": "gevent package namespace marker", "from": [ { "file": 1412 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 271 } ] }, { "id": "micro-behaviors/os/api-resolution/manual::peb-access-x64", "conf": 0.9, "crit": 3, "desc": "Accesses the x64 process environment block", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/os/clipboard/reference::go-clipboard-fragment", "atk": "T1115", "conf": 0.76, "crit": 3, "desc": "Go binary clipboard string fragment", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps-firefox-browser", "conf": 0.5, "crit": 2, "desc": "Firefox browser package name", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/path/archive::unix-temp-archive-path", "conf": 0.86, "crit": 3, "desc": "Unix temporary archive path", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer", "conf": 0.9, "crit": 3, "desc": "Create and arm waitable timer", "from": [ { "file": 379 }, { "off": 2103, "file": 432 } ], "uses": [ 516, 897 ] }, { "id": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "conf": 0.82, "crit": 2, "desc": "GetSystemDirectory API string", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/privilege/token::open-thread-token", "conf": 0.75, "crit": 2, "desc": "Open thread access token" }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "from": [ { "file": 270 } ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-version-info", "conf": 0.98, "crit": 2, "desc": "MSVC runtime internal name" }, { "id": "micro-behaviors/fs/path/application/browser::firefox-profile-directory", "mbc": "E1083", "conf": 0.86, "crit": 3, "desc": "Firefox browser profile directory path", "from": [ { "file": 1984 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.9, "crit": 3, "desc": "Dynamic library loading via dlopen", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/thread/priority::set-priority-class", "conf": 0.85, "crit": 3, "desc": "Raise process priority class" }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "atk": "T1082", "conf": 0.88, "crit": 2, "desc": "Query locale information", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::source-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header literal in source", "from": [ { "file": 271 } ] }, { "id": "micro-behaviors/fs/temp/pyinstaller::pyinstaller-meipass-elf", "conf": 0.85, "crit": 3, "desc": "PyInstaller _MEIPASS bundle marker", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/spawn::init-proc-thread-attribute-list", "atk": "T1134", "conf": 0.95, "crit": 3, "desc": "Initialize process attribute list" }, { "id": "metadata/signed/unknown::python-software-foundation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Python Software Foundation", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/os/sysinfo/process::get-startup-info", "conf": 0.9, "crit": 2, "desc": "Get process startup information", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/dylib/load/runtime::set-dll-directory-w", "atk": "T1574.002", "conf": 0.92, "crit": 2, "desc": "Sets the process DLL search directory", "from": [ { "file": 3 } ] }, { "id": "well-known/lib/crypto/cryptography::cryptography-binding", "conf": 0.96, "crit": 3, "desc": "Python cryptography native binding", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/socket/init::htons-api-ordinal", "conf": 0.84, "crit": 3, "desc": "Network byte order conversion", "from": [ { "file": 26 } ], "uses": [ 476, 521 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content", "conf": 0.7, "crit": 2, "desc": "References the Node.js process.platform value", "from": [ { "file": 2211 } ] }, { "id": "third_party/elastic/Windows_Rootkit_WinDivert/windows/rootkit/windivert", "conf": 0.9, "crit": 5, "desc": "Detects Windows.Rootkit.WinDivert" }, { "id": "micro-behaviors/process/inject/dll::create-remote-thread", "atk": "T1055.001", "mbc": "F0003", "conf": 0.95, "crit": 3, "desc": "CreateRemoteThread API reference", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/ui/window/enumerate::get-foreground-window", "conf": 0.8, "crit": 2, "desc": "Query current foreground window", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-request-target", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP client requests a cleartext URL", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/fs/file/handle::set-std-handle", "conf": 0.9, "crit": 2, "desc": "Set standard I/O handle" }, { "id": "micro-behaviors/fs/read/file/handle::read-file", "conf": 0.9, "crit": 2, "desc": "Read data from file handle", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-dib-bitmap-transfer-primitives", "conf": 0.92, "crit": 3, "desc": "GDI DIB bitmap transfer API set", "from": [ { "file": 379 }, { "off": 1260872, "file": 463 } ], "uses": [ 207, 674 ] }, { "id": "micro-behaviors/mem/query/info::virtualquery-ex", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "VirtualQueryEx API symbol", "from": [ { "file": 48 } ] }, { "id": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-hook-api-stage", "atk": "T1105", "mbc": "B0024", "conf": 0.92, "crit": 3, "desc": "Embedded stage Windows hook API", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait--sleepconditionvariablesrw", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (SleepConditionVariableSRW)", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/process/info/timing::get-process-times", "conf": 0.85, "crit": 3, "desc": "GetProcessTimes process timing query" }, { "id": "micro-behaviors/data/compress/lzma::lzma-prefix", "conf": 0.8, "crit": 3, "desc": "lzma_ function prefix", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/socket/init::send-api-ordinal", "conf": 0.86, "crit": 3, "desc": "Winsock send import", "from": [ { "file": 25 } ], "uses": [ 161, 521 ] }, { "id": "micro-behaviors/data/compress/bzip2::libbz2", "conf": 0.9, "crit": 3, "desc": "libbz2 library", "from": [ { "file": 2 } ] }, { "id": "metadata/import/python/urllib/request::urllib/request", "conf": 0.95, "crit": 3, "desc": "imports urllib.request", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/time/query::get-system-time-as-filetime", "conf": 0.9, "crit": 2, "desc": "Get system time as FILETIME", "from": [ { "file": 14 } ] }, { "id": "metadata/hardening/mitigation::partial-relro", "conf": 0.8, "crit": 3, "desc": "Partial RELRO (GOT partially protected)" }, { "id": "micro-behaviors/crypto/symmetric/stream/rc4::rc4-init-symbol", "atk": "T1573", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "RC4 key scheduler symbol", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/os/privilege/token::set-thread-token", "atk": "T1134.001", "conf": 0.9, "crit": 3, "desc": "SetThreadToken API reference" }, { "id": "micro-behaviors/fs/read/file/handle::c-fread", "conf": 0.7, "crit": 2, "desc": "Read stream (C fread symbol)", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/resource/identity::rich-header-present", "conf": 0.9, "crit": 2, "desc": "PE Rich header present (MSVC toolchain)" }, { "id": "micro-behaviors/data/decompress/zlib::inflate", "conf": 0.8, "crit": 3, "desc": "References the zlib inflate routine", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-update", "conf": 0.5, "crit": 3, "desc": "SQL UPDATE syntax reference", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/mem/protect/modify::page-execute-constant", "conf": 0.8, "crit": 3, "desc": "PAGE_EXECUTE protection constant", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "WebSocket class reference", "from": [ { "file": 1735 } ] }, { "id": "micro-behaviors/crypto/library/implementation::crypto-library-context", "conf": 0.99, "crit": 3, "desc": "Native cryptographic library context", "from": [ { "file": 1 } ], "uses": [ 57 ] }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Query registry value via import symbol", "from": [ { "file": 83 } ] }, { "id": "objectives/command-and-control/dropper/staging-xor::dotnet-encoded-http-url", "atk": "T1027", "conf": 0.85, "crit": 3, "desc": ".NET assembly decodes an embedded HTTP(S) URL", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/data/db/sql::sql-password-column", "conf": 0.86, "crit": 3, "desc": "SQL password column definition", "from": [ { "file": 1294 } ] }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Open registry key via import symbol", "from": [ { "file": 83 } ] }, { "id": "metadata/binary/layout/checksum::tiny-single-function-pe", "conf": 0.8, "crit": 3, "desc": "Tiny PE single-function stub", "from": [ { "file": 82 } ] }, { "id": "well-known/lib/runtime/scripted/encoding-table::tcl-encoding-table", "conf": 0.99, "crit": 3, "desc": "Tcl character encoding table", "from": [ { "file": 274 } ] }, { "id": "micro-behaviors/fs/delete/file/library::deletefile-w", "conf": 0.66, "crit": 3, "desc": "DeleteFileW API symbol" }, { "id": "micro-behaviors/data/embedded/payload/resource::lock-resource", "atk": "T1027.009", "conf": 0.8, "crit": 2, "desc": "Access PE resource data pointer" }, { "id": "micro-behaviors/crypto/certificate/usage::ca-certificates", "conf": 0.8, "crit": 2, "desc": "References a CA certificate bundle", "from": [ { "file": 1185 } ] }, { "id": "micro-behaviors/communications/socket/udp::sock-dgram", "conf": 0.7, "crit": 3, "desc": "UDP socket type constant", "from": [ { "file": 1208 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-file-walker", "conf": 0.92, "crit": 3, "desc": "Directory walker using Win32 find APIs", "from": [ { "file": 379 }, { "off": 2586, "file": 416 }, { "off": 2891102, "file": 450 }, { "file": 451 }, { "off": 3997576, "file": 459 }, { "off": 1623300, "file": 462 }, { "off": 968118, "file": 464 } ], "uses": [ 41, 52, 854 ] }, { "id": "metadata/binary/symbols/count::no-imports", "conf": 0.7, "crit": 3, "desc": "PE has no imported DLL dependencies", "from": [ { "file": 36 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "atk": "T1027", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Near-noise average length in large binary", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/section/prose::no-sentence-strings", "conf": 0.8, "crit": 3, "desc": "No sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/ssl::ssl-new-symbol", "conf": 0.66, "crit": 3, "desc": "SSL object creation API", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-lifecycle", "conf": 0.9, "crit": 3, "desc": "Winsock client connection lifecycle", "from": [ { "file": 28 } ], "uses": [ 521, 879 ] }, { "id": "micro-behaviors/process/threading/concurrency::get-queued-completion-status", "conf": 0.92, "crit": 3, "desc": "Waits on Windows IOCP", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/proxy/mitm::mitmproxy-python-import", "conf": 0.9, "crit": 3, "desc": "mitmproxy Python import", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/process/inject/dll::create-remote-thread-text", "atk": "T1055.001", "mbc": "F0003", "conf": 0.9, "crit": 3, "desc": "CreateRemoteThread API string", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/request/proxy::http-connect-proxy", "conf": 0.85, "crit": 3, "desc": "HTTP CONNECT proxy tunneling", "from": [ { "file": 1447 } ] }, { "id": "micro-behaviors/communications/http/websocket::ping-pong-pair", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "PING/PONG protocol marker", "from": [ { "file": 1861 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.7, "crit": 2, "desc": "References PEM certificate header", "from": [ { "file": 2095 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-request-data-argument", "conf": 0.84, "crit": 3, "desc": "Python Request call passes a body argument" }, { "id": "metadata/lang/natural::lang-polish-common-words", "conf": 0.8, "crit": 1, "desc": "Common Polish words", "from": [ { "file": 379 }, { "off": 4219, "file": 1516, "line": 76 } ], "uses": [ 10, 326, 643 ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-sha1-operation", "conf": 0.93, "crit": 3, "desc": "HMAC-SHA1 operation marker", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "file": 379 }, { "off": 1786, "file": 427 }, { "off": 2303000, "file": 459 }, { "off": 1344224, "file": 462 }, { "off": 759104, "file": 464 }, { "off": 4578, "file": 2587, "line": 109 } ], "uses": [ 182, 359, 422, 461 ] }, { "id": "objectives/impact/degrade/services::native-database-service-targets", "atk": "T1489", "conf": 0.88, "crit": 1, "desc": "Native database service targets", "from": [ { "off": 24142797, "file": 378 } ], "uses": [ 662, 859 ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present" }, { "id": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "conf": 0.9, "crit": 2, "desc": "Get Windows installation directory", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/crypto/kdf/algorithm::hkdf-pe-rdata", "conf": 0.9, "crit": 3, "desc": "PE read-only data references HKDF", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/env/user-paths::userprofile-var", "conf": 0.5, "crit": 3, "desc": "USERPROFILE path environment variable", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/os/firewall/wfp::fwpm-sublayer-delete-by-key", "atk": "T1562.004", "conf": 0.9, "crit": 3, "desc": "Remove Windows Filtering Platform sublayer", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::python-response-body-member-reference", "conf": 0.8, "crit": 3, "desc": "Python response body member access" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "High entropy overlay data", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/process/create/shell/build::make-invocation-build", "atk": "T1027.004", "conf": 0.8, "crit": 3, "desc": "Make build invocation", "from": [ { "file": 272 } ] }, { "id": "well-known/lib/network/public-suffix-list::psl-readthedocs", "conf": 0.9, "crit": 3, "desc": "Public suffix readthedocs.io", "from": [ { "file": 19 } ] }, { "id": "metadata/lang/natural::polish-common-word-tak", "conf": 1.0, "crit": 1, "desc": "Polish common word tak", "from": [ { "file": 1140 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::find-first-volume", "atk": "T1083", "conf": 0.9, "crit": 3, "desc": "Begin volume enumeration", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/temp/pyinstaller::pyinstaller-mpyimod", "conf": 0.95, "crit": 3, "desc": "PyInstaller bootloader module", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-bitmap-list", "conf": 1.0, "crit": 3, "desc": "PE has RT_BITMAP in resources list" }, { "id": "micro-behaviors/ui/window/control::register-class", "conf": 0.7, "crit": 2, "desc": "Register window class", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/data/embedded/payload/installer::overlay-gzip-magic", "conf": 0.9, "crit": 3, "desc": "Gzip header in overlay", "from": [ { "file": 3 } ] }, { "id": "metadata/package/ecosystem::pkginfo-version-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package version", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/label::keystroke-capture-string-b--backspace", "conf": 0.7, "crit": 3, "desc": "Key capture strings (BACKSPACE)", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/crypto/certificate/store::cert-close-store", "conf": 0.9, "crit": 3, "desc": "Close certificate store handle", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::find-resource-w", "atk": "T1027.009", "conf": 0.8, "crit": 2, "desc": "Locate PE resource entry", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/llm/agent::native-ai-agent-identity", "conf": 0.95, "crit": 3, "desc": "Native AI coding-agent reference", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/data/runtime/library::go-tls-internal-ciphersuites", "conf": 0.6, "crit": 3, "desc": "Go crypto/tls CipherSuites internal type", "from": [ { "file": 1787 } ] }, { "id": "objectives/execution/lure/clipboard/write::clipboard-writes-windows-command--rx-12", "atk": "T1204.001", "conf": 0.94, "crit": 3, "desc": "Matches 'certutil'", "from": [ { "file": 261 } ] }, { "id": "micro-behaviors/fs/directory/traverse::findnext", "conf": 0.8, "crit": 3, "desc": "Find next file (DOS/Windows)" }, { "id": "micro-behaviors/communications/socket/connect::socket-connect-ex-pyc-name", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket connect_ex name in Python bytecode", "from": [ { "file": 1185 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 379 }, { "file": 462 } ], "uses": [ 349 ] }, { "id": "micro-behaviors/mem/alloc/executable::nonpaged-pool", "conf": 0.9, "crit": 3, "desc": "NonPagedPool kernel memory flag", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 379 }, { "off": 84080, "file": 456 }, { "off": 3617296, "file": 459 }, { "off": 1161088, "file": 463 } ], "uses": [ 399, 651, 961 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal--wakeallconditionvariable", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (WakeAllConditionVariable)", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/mem/create/image-section::sec-image-mapping-flag", "conf": 0.9, "crit": 3, "desc": "Uses Windows SEC_IMAGE mapping flag", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/ui/window/probe::get-desktop-window", "conf": 0.9, "crit": 2, "desc": "Query the desktop window handle", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-pyc-symbol", "conf": 0.78, "crit": 3, "desc": "urlopen symbol in Python bytecode", "from": [ { "file": 1192 } ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::create-fiber-api-string", "conf": 0.9, "crit": 3, "desc": "CreateFiber API name in binary text", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::create-fiber", "conf": 0.9, "crit": 3, "desc": "Create a fiber object", "from": [ { "file": 74 } ] }, { "id": "third_party/bartblaze/generic/PyInstaller/pyinstaller", "conf": 0.9, "crit": 3, "desc": "Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious." }, { "id": "micro-behaviors/os/privilege/token::impersonate-named-pipe-client", "conf": 0.9, "crit": 3, "desc": "Impersonate a named-pipe client" }, { "id": "micro-behaviors/communications/http/websocket::websocket-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade header", "from": [ { "file": 2180 } ] }, { "id": "micro-behaviors/communications/socket/init::wsa-duplicate-socket", "conf": 0.88, "crit": 3, "desc": "Share socket with another process", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/ui/window/enumerate::get-window-text", "conf": 0.8, "crit": 2, "desc": "Read active window title text", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5", "conf": 0.95, "crit": 3, "desc": "MD5 hashing functions", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-name-resolution-ordinal", "conf": 0.84, "crit": 3, "desc": "Winsock ordinal name resolution", "from": [ { "file": 28 } ], "uses": [ 420, 521, 650 ] }, { "id": "micro-behaviors/process/create/spawn::child-process-member-spawn", "conf": 0.85, "crit": 3, "desc": "Node.js child_process spawns an external process", "from": [ { "file": 2211 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-4", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 4 by number", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/os/clipboard/read::get-clipboard-data", "conf": 0.75, "crit": 3, "desc": "Read data from clipboard", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call", "conf": 0.82, "crit": 3, "desc": "Calls Python urllib urlopen", "from": [ { "file": 1192 } ], "uses": [ 83, 348, 562 ] }, { "id": "metadata/import/builtin::require-http", "conf": 0.75, "crit": 3, "desc": "Imports the Node.js HTTP module", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/os/privilege/token::token-secondary-access-api", "conf": 0.82, "crit": 3, "desc": "Secondary token access API", "from": [ { "file": 379 }, { "file": 427 }, { "file": 462 } ], "uses": [ 435 ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-ansi", "conf": 0.7, "crit": 2, "desc": "Get module file path (ANSI)" }, { "id": "micro-behaviors/os/network/status::netstat", "conf": 0.9, "crit": 3, "desc": "netstat command", "from": [ { "file": 2137 } ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Flask framework import" }, { "id": "micro-behaviors/communications/proxy/mitm::mitmproxy-command--mitmdump", "conf": 0.9, "crit": 3, "desc": "mitmproxy command invocation (mitmdump)", "from": [ { "file": 2214 } ] }, { "id": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "conf": 0.75, "crit": 3, "desc": "Archive open or extract instruction", "from": [ { "file": 83 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-20", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 20 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/kernel/module::sys-extension", "conf": 0.9, "crit": 3, "desc": "Windows .sys driver filename", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/hardware/input/idle-time::get-last-input-info", "conf": 0.7, "crit": 3, "desc": "Windows GetLastInputInfo idle-state API", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/data/db/sqlite::sqlite3-string", "conf": 0.9, "crit": 3, "desc": "sqlite3 string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/search::locate-token", "conf": 1.0, "crit": 3, "desc": "locate file-search command token", "from": [ { "file": 272 } ] }, { "id": "micro-behaviors/os/kernel/module::windows-kernel-driver", "conf": 0.98, "crit": 3, "desc": "Windows kernel driver binary", "from": [ { "file": 379 }, { "file": 640 }, { "file": 642 } ], "uses": [ 371, 424, 472 ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::duplex-message-pipe", "atk": "T1559", "conf": 0.75, "crit": 3, "desc": "Full-duplex message pipe", "from": [ { "file": 379 }, { "off": 2314032, "file": 459 } ], "uses": [ 212, 959 ] }, { "id": "micro-behaviors/ui/window/control::get-window-rect", "conf": 0.7, "crit": 2, "desc": "Get window rectangle", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/layout/stub::signed-pe-wrapper", "conf": 0.97, "crit": 3, "desc": "Signed PE wrapper marker", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/ui/window/style::fixed-viewport-style", "conf": 0.9, "crit": 3, "desc": "Fixed CSS element spans viewport", "from": [ { "file": 251 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket connection upgrade header", "from": [ { "file": 2180 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/branch::node-platform-win32-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Windows platform value", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.7, "crit": 2, "desc": "Version information string", "from": [ { "file": 83 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-13", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 13 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha256", "conf": 0.95, "crit": 3, "desc": "SHA256 hashing functions", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 379 }, { "file": 1612 }, { "file": 1793 }, { "file": 1807 }, { "file": 2331 }, { "file": 2350 }, { "file": 2351 }, { "file": 2527 } ], "uses": [ 7 ] }, { "id": "objectives/lateral-movement/infection/file::skip-program-files-dir", "atk": "T1091,T1083,T1554", "conf": 0.9, "crit": 3, "desc": "Skips Program Files during file walk", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream" }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 86 } ] }, { "id": "metadata/package/testing/presence/harness::python-test-file", "conf": 0.7, "crit": 2, "desc": "Python test file suffix", "from": [ { "file": 2109 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-pyc-module-name", "conf": 0.76, "crit": 1, "desc": "urllib module name in Python bytecode", "from": [ { "file": 1192 } ] }, { "id": "objectives/anti-analysis/debugger-detect/check::peb-being-debugged-cmp-multi", "atk": "T1622", "mbc": "B0001", "conf": 0.85, "crit": 3, "desc": "PEB.BeingDebugged byte cmp (multiple sites)", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/build-artifacts::compiled-artifact-cleanup", "conf": 1.0, "crit": 3, "desc": "Deletes only compiled/cache build artifacts", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/symbols/count::many-exports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ exports", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-polish", "conf": 0.8, "crit": 3, "desc": "Polish language detection", "from": [ { "file": 379 }, { "off": 169, "file": 833, "line": 7 }, { "off": 212, "file": 1516, "line": 5 } ], "uses": [ 311, 655 ] }, { "id": "file/sfx/pyinstaller", "atk": "T1059", "conf": 1.0, "crit": 3, "desc": "PyInstaller-bundled Python executable" }, { "id": "objectives/persistence/system/surface/paths::managed-persistence-marker--rx-5", "atk": "T1547", "conf": 0.84, "crit": 3, "desc": "Managed or installed service/cron phrase", "from": [ { "file": 1682 } ] }, { "id": "micro-behaviors/ui/help::usage-lower", "conf": 0.5, "crit": 2, "desc": "usage: label (lowercase)", "from": [ { "file": 83 } ] }, { "id": "objectives/anti-static/obfuscation/name-mangling/export-name::mixed-case-opaque-export-name", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Mixed-case opaque export name", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/application/p2p::deceptive-lure-names-a3", "conf": 0.8, "crit": 3, "desc": "Keygen/key-generator piracy lure name", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/threading/concurrency::iocp-work-queue", "conf": 0.96, "crit": 3, "desc": "Windows I/O completion-port producer/consumer work queue", "from": [ { "file": 379 }, { "file": 402 } ], "uses": [ 54, 231, 304 ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "C0018", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/sync/mutex::mutex-api", "mbc": "C0042", "conf": 0.85, "crit": 2, "desc": "Mutex creation/access API", "from": [ { "file": 379 }, { "off": 2021, "file": 432 }, { "off": 1253520, "file": 461 } ], "uses": [ 90, 598, 907 ] }, { "id": "micro-behaviors/communications/socket/ssl::tls-server-certificate-key-pair", "conf": 0.92, "crit": 3, "desc": "TLS server certificate and private key material", "from": [ { "file": 379 }, { "file": 406 }, { "off": 6481, "file": 453 } ], "uses": [ 788, 950 ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "conf": 0.9, "crit": 2, "desc": "Extended directory enumeration" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlsym-with-cleanup", "atk": "T1574.006", "conf": 0.85, "crit": 3, "desc": "Dynamic symbol lookup with library cleanup", "from": [ { "off": 38745, "file": 377 }, { "off": 2809, "file": 378 } ], "uses": [ 111, 565 ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-dup", "conf": 0.7, "crit": 2, "desc": "Get module file path (Unicode)", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-22", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 22 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "conf": 0.84, "crit": 2, "desc": "Invoke unhandled exception filter", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect", "mbc": "C0021", "conf": 0.95, "crit": 3, "desc": "Modify memory page protection", "from": [ { "file": 88 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-versioninfo", "conf": 0.9, "crit": 2, "desc": "Claims Microsoft in version resource" }, { "id": "micro-behaviors/mem/alloc/remote::virtual-alloc-ex-text", "atk": "T1055", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "VirtualAllocEx API string reference", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::chacha20-poly1305-identifier", "conf": 0.9, "crit": 3, "desc": "ChaCha20-Poly1305 identifier", "from": [ { "file": 1293 } ] }, { "id": "metadata/lang/upstream::exports-thread-inject-api--createremotethread", "conf": 0.9, "crit": 3, "desc": "Exports thread/APC (CreateRemoteThread)" }, { "id": "metadata/hardening/build::strcpy-chk", "conf": 0.85, "crit": 3, "desc": "FORTIFY_SOURCE strcpy bounds check", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::urllib-json-request-body", "conf": 0.9, "crit": 3, "desc": "urllib JSON request with body", "from": [ { "file": 2591 } ], "uses": [ 78, 262, 809 ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::msvc-runtime-library", "conf": 0.98, "crit": 3, "desc": "Microsoft C++ runtime library evidence", "from": [ { "file": 379 }, { "file": 390 }, { "file": 391 } ], "uses": [ 126, 219, 245, 552 ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-52", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 52 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "atk": "T1082", "conf": 0.84, "crit": 2, "desc": "Enumerate installed system locales", "from": [ { "file": 47 } ] }, { "id": "micro-behaviors/process/create/spawn::create-process-a", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Create process (ANSI)" }, { "id": "micro-behaviors/communications/socket/family::socket-af-inet-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "AF_INET constant name", "from": [ { "file": 1208 } ] }, { "id": "micro-behaviors/os/kernel/module::native-subsystem", "conf": 0.98, "crit": 3, "desc": "PE native subsystem" }, { "id": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "atk": "T1027.007", "mbc": "B0032.014", "conf": 0.75, "crit": 3, "desc": "DJB2 hash algorithm constant (5381)", "from": [ { "file": 22 } ] }, { "id": "metadata/binary/section/prose::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/linker/env::ld-library-path", "conf": 0.6, "crit": 3, "desc": "References the LD_LIBRARY_PATH search path", "from": [ { "file": 485 } ] }, { "id": "micro-behaviors/communications/email/mime::mime-multipart-marker-pe", "conf": 0.9, "crit": 3, "desc": "PE MIME multipart marker", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/vendor::microsoft-prefixed-company", "conf": 0.9, "crit": 3, "desc": "PE company name identifies Microsoft" }, { "id": "well-known/lib/data/sqlite::sqlite-version-string", "conf": 0.86, "crit": 3, "desc": "SQLite version string", "from": [ { "file": 29 } ] }, { "id": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "atk": "T1036.005", "conf": 0.95, "crit": 3, "desc": "Microsoft company version identity" }, { "id": "micro-behaviors/data/db/sqlite::sqlite-format", "conf": 0.9, "crit": 3, "desc": "SQLite runtime format marker", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/communications/socket/connect::node-net-commonjs-import", "conf": 0.9, "crit": 3, "desc": "Imports the Node net module with require", "from": [ { "file": 2211 } ] }, { "id": "well-known/lib/ui/bootstrap-legacy::bootstrap-custom-form-controls", "conf": 0.9, "crit": 3, "desc": "Bootstrap custom form control classes", "from": [ { "file": 251 } ] }, { "id": "micro-behaviors/os/privilege/token::open-thread-token-any", "conf": 0.8, "crit": 2, "desc": "Open thread access token", "from": [ { "file": 379 }, { "file": 427 }, { "file": 462 } ], "uses": [ 243 ] }, { "id": "micro-behaviors/communications/capture/windivert::windivert-open", "atk": "T1040", "conf": 0.95, "crit": 3, "desc": "Opens a WinDivert packet interception handle", "from": [ { "file": 263 } ] }, { "id": "well-known/lib/crypto/openssl::openssl-evp-api", "conf": 0.95, "crit": 2, "desc": "OpenSSL EVP API symbols", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::find-resource-ex-w", "atk": "T1027.009", "conf": 0.85, "crit": 2, "desc": "Locate PE resource entry with language" }, { "id": "micro-behaviors/communications/socket/init::recv-api-ordinal", "conf": 0.86, "crit": 3, "desc": "Winsock receive import", "from": [ { "file": 25 } ], "uses": [ 94, 521 ] }, { "id": "metadata/binary/symbols/fake-windows::sideload-export-cluster-size-5-10", "conf": 0.9, "crit": 3, "desc": "DLL exports five to ten APIs", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/privilege/token::restore-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Restore privilege name string", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 1236 } ] }, { "id": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "conf": 0.9, "crit": 3, "desc": "Dominant text section ratio", "from": [ { "file": 81 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::set-thread-context-text", "atk": "T1055", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "SetThreadContext dynamic API string", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/process/create/spawn::wexecve", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "Replace process image via _wexecve" }, { "id": "objectives/anti-static/obfuscation/binary-structure::int3-padding-text", "atk": "T1055", "conf": 0.8, "crit": 3, "desc": "Dense INT3 breakpoint instructions", "from": [ { "file": 77 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/fs/file/timestamp::set-file-time", "atk": "T1070.006", "conf": 0.85, "crit": 3, "desc": "Modify file creation/access/write times", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/info/thread::resume-thread-import", "conf": 0.9, "crit": 3, "desc": "ResumeThread API import", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/fs/lock/byte-range::unlock-file-ex", "conf": 0.8, "crit": 3, "desc": "Release a byte-range file lock" }, { "id": "micro-behaviors/process/create/thread::create-thread", "atk": "T1129", "conf": 0.95, "crit": 3, "desc": "Create thread in current process", "from": [ { "file": 19 } ] }, { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Microsoft Corporation", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/socket/connect::net-connect", "conf": 0.86, "crit": 3, "desc": "Node net.connect or createConnection usage", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-http-upgrade-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade handshake", "from": [ { "file": 379 }, { "off": 5761, "file": 2556 } ], "uses": [ 354, 381 ] }, { "id": "micro-behaviors/communications/http/cookie-store::http-cookiejar", "conf": 0.5, "crit": 3, "desc": "http.cookiejar module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/variable-spawn::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 2211 } ] }, { "id": "well-known/lib/runtime/scripted/cpython::cpython-runtime-dll", "conf": 1.0, "crit": 3, "desc": "CPython runtime DLL", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/communications/dns/lookup/reverse::in-addr-arpa", "atk": "T1071.004", "mbc": "C0011", "conf": 0.56, "crit": 3, "desc": "in-addr.arpa reverse lookup", "from": [ { "file": 1567 } ] }, { "id": "micro-behaviors/mem/alloc/remote::virtual-alloc-ex-dup", "atk": "T1055", "conf": 0.95, "crit": 3, "desc": "VirtualAllocEx remote-process allocation reference", "from": [ { "file": 379 }, { "file": 424 } ], "uses": [ 414 ] }, { "id": "micro-behaviors/os/security/auth/session::kerberos-weak-encryption-reference", "atk": "T1558.003", "conf": 0.95, "crit": 3, "desc": "References Kerberos RC4 or etype 23 encryption", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-alias-spawn", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Node.js child_process alias spawn", "from": [ { "off": 4578, "file": 2587, "line": 109 } ], "uses": [ 184, 359 ] }, { "id": "metadata/import/python/sys::sys", "conf": 0.95, "crit": 2, "desc": "imports sys" }, { "id": "micro-behaviors/ui/window/probe::get-last-active-popup", "conf": 0.9, "crit": 3, "desc": "GetLastActivePopup API reference", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/os/clipboard/reference::open-clipboard", "conf": 0.75, "crit": 3, "desc": "Open clipboard access", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file", "conf": 0.9, "crit": 2, "desc": "Begin directory enumeration" }, { "id": "micro-behaviors/fs/file/move::move-file", "conf": 0.9, "crit": 2, "desc": "Move or rename file", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "conf": 1.0, "crit": 3, "desc": "Uses named pipe IPC APIs", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/direct::native-process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "References a native child-process launch call", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/socket/init::connect-api-ordinal", "conf": 0.88, "crit": 3, "desc": "Winsock outbound connect import", "from": [ { "file": 28 } ], "uses": [ 360, 521 ] }, { "id": "metadata/package/ecosystem::pkginfo-summary-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package summary", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/os/env/read::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/resource/identity::kernel-driver-init", "conf": 0.95, "crit": 2, "desc": "Kernel driver ntoskrnl in INIT", "from": [ { "file": 264 } ] }, { "id": "objectives/anti-static/obfuscation/name-mangling/export-name::opaque-alpha-export-cluster", "atk": "T1027", "conf": 0.96, "crit": 3, "desc": "Exports cluster of opaque mixed-case names", "from": [ { "file": 86 } ] }, { "id": "metadata/binary/resource/manifest::pe-resource-manifest-second", "conf": 1.0, "crit": 2, "desc": "PE second resource is RT_MANIFEST" }, { "id": "micro-behaviors/os/event/log::register-event-source", "conf": 0.88, "crit": 2, "desc": "Register Windows event source", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-9", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 9 by number", "from": [ { "file": 26 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 91 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-pyc-symbol", "conf": 0.8, "crit": 3, "desc": "urllib Request symbol in Python bytecode", "from": [ { "file": 1192 } ], "uses": [ 217, 391 ] }, { "id": "objectives/command-and-control/dropper/execution/loader::pyc-cipher-string", "conf": 0.84, "crit": 3, "desc": "Bytecode references cipher construction API", "from": [ { "file": 1329 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 4, "desc": "Large high-entropy overlay", "from": [ { "file": 377 }, { "file": 379 }, { "file": 640 }, { "file": 642 } ], "uses": [ 117, 321 ] }, { "id": "micro-behaviors/ui/window/control::set-parent-api", "conf": 0.8, "crit": 2, "desc": "Reparent window via SetParent", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/create/agent::ai-agent-unattended-execution-value", "atk": "T1059", "mbc": "B0022", "conf": 0.9, "crit": 3, "desc": "Unattended agent execution mode value", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/process/fd/stdio::python-stderr-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stderr stream" }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::chacha-salsa-constant", "conf": 0.95, "crit": 3, "desc": "ChaCha20/Salsa20 cipher constant", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.66, "crit": 3, "desc": "Uses readdir", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-bengali", "conf": 0.8, "crit": 3, "desc": "Contains Bengali script", "from": [ { "file": 365 } ] }, { "id": "micro-behaviors/communications/http/request/body::base64-encoded-post-body--rx-3", "conf": 0.8, "crit": 3, "desc": "Python/PowerShell Base64 before request", "from": [ { "file": 2215 } ] }, { "id": "metadata/import/npm/detect-port::detect-port", "conf": 0.95, "crit": 2, "desc": "imports detect-port", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-calendar-info", "atk": "T1082", "conf": 0.82, "crit": 2, "desc": "Query calendar regional settings", "from": [ { "file": 47 } ] }, { "id": "metadata/build/toolchain::yacc-word", "conf": 1.0, "crit": 3, "desc": "yacc parser-generator tool name", "from": [ { "file": 1996 } ] }, { "id": "micro-behaviors/communications/socket/ssl::tls-client-method-symbol", "conf": 0.66, "crit": 3, "desc": "TLS client method API", "from": [ { "file": 30 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-dialog-list", "conf": 1.0, "crit": 3, "desc": "PE has RT_DIALOG in resources list" }, { "id": "micro-behaviors/os/random/crypto::rand-symbol", "conf": 0.3, "crit": 2, "desc": "Random number generation (rand)" }, { "id": "micro-behaviors/communications/capture/windivert::windivert-packet-filter", "atk": "T1040", "conf": 0.98, "crit": 3, "desc": "WinDivert packet interception and reinjection API cluster", "from": [ { "file": 379 }, { "off": 17057, "file": 639 }, { "off": 20152, "file": 641 } ], "uses": [ 101, 436, 738 ] }, { "id": "micro-behaviors/time/query::get-timezone-information", "conf": 0.9, "crit": 3, "desc": "Query timezone configuration" }, { "id": "micro-behaviors/fs/delete/file/library::static-unlink-symbol-text", "atk": "T1070.004", "mbc": "C0047", "conf": 0.72, "crit": 3, "desc": "Static executable contains unlink symbol", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/config/accounts::etc-passwd-pyc", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "/etc/passwd user database in Python bytecode", "from": [ { "file": 2161 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-generic", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node generic server listens on endpoint", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::python-bytecode-gethostname-name", "atk": "T1082", "mbc": "E1082", "conf": 0.92, "crit": 3, "desc": "Python bytecode gethostname name", "from": [ { "file": 1453 } ] }, { "id": "metadata/binary/layout/entropy::very-high-overall-entropy-75", "conf": 0.95, "crit": 3, "desc": "Binary overall entropy at least 7.5", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "atk": "T1082", "conf": 0.85, "crit": 2, "desc": "Query user locale identifier" }, { "id": "micro-behaviors/mem/protect/modify::virtual-alloc-ex-name", "atk": "T1055", "conf": 0.88, "crit": 3, "desc": "VirtualAllocEx API name reference", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/sysinfo/directories::windows-directory-api-strings", "conf": 0.84, "crit": 1, "desc": "Windows directory API strings", "from": [ { "file": 379 }, { "off": 2281, "file": 434 }, { "file": 462 } ], "uses": [ 242, 316 ] }, { "id": "micro-behaviors/process/hook/interception::python-stdio-stream-hook", "mbc": "B0024", "conf": 0.88, "crit": 3, "desc": "Python replaces a standard I/O stream" }, { "id": "micro-behaviors/hardware/input/keyboard/layout::map-virtual-key-str", "conf": 0.8, "crit": 3, "desc": "MapVirtualKey API string reference", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/hardware/input/synthesize::sendinput-api-name", "conf": 0.9, "crit": 3, "desc": "SendInput input-synthesis API name", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/os/registry/manipulate::dotnet-registry-delete-value-member", "conf": 0.9, "crit": 3, "desc": ".NET RegistryKey.DeleteValue mutation", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/fd/stdio::python-custom-stdio", "conf": 0.8, "crit": 3, "desc": "Python subprocess custom stdio streams", "from": [ { "file": 379 }, { "file": 395 }, { "off": 42678, "file": 1584 }, { "off": 1813, "file": 1586 }, { "off": 112047, "file": 2424 }, { "off": 12730, "file": 2476 } ], "uses": [ 209, 570, 856 ] }, { "id": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "conf": 0.9, "crit": 3, "desc": "Reference to api-ms- Windows API string", "from": [ { "file": 88 } ] }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings", "from": [ { "file": 15 } ] }, { "id": "well-known/lib/crypto/openssl::openssl-version-symbol", "conf": 0.95, "crit": 2, "desc": "OpenSSL_version export symbol", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/ctr::aes-256-ctr-term", "mbc": "C0021.001", "conf": 0.94, "crit": 3, "desc": "AES-256-CTR cipher marker", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "conf": 0.9, "crit": 3, "desc": "Create extended waitable timer", "from": [ { "file": 56 } ] }, { "id": "metadata/package/repository::has-repository-field", "conf": 0.9, "crit": 2, "desc": "package.json declares repository metadata" }, { "id": "metadata/lang/compiler/native::python-pyinit-export", "conf": 0.95, "crit": 2, "desc": "Exports a CPython PyInit entry point", "from": [ { "file": 16 } ] }, { "id": "metadata/lang/natural::lang-hindi-marathi", "conf": 0.8, "crit": 3, "desc": "Contains Devanagari script", "from": [ { "file": 427 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "conf": 0.7, "crit": 3, "desc": "WS2_32 Winsock DLL import", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/thread/priority::set-thread-priority", "conf": 0.85, "crit": 3, "desc": "SetThreadPriority API symbol" }, { "id": "metadata/package/scripts/develop::has-git-hooks", "conf": 0.9, "crit": 3, "desc": "Package uses git hooks tooling", "from": [ { "file": 2213 } ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::chacha20-quarter-round-rotations-x86-64", "conf": 0.9, "crit": 3, "desc": "ChaCha quarter-round rotation schedule", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/resource/identity::pe-description-equals-product-name", "conf": 0.9, "crit": 3, "desc": "PE description duplicates ProductName" }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-current-directory", "conf": 0.85, "crit": 2, "desc": "Read current working directory" }, { "id": "micro-behaviors/crypto/certificate/store::cert-open-store", "conf": 0.9, "crit": 3, "desc": "Open certificate store", "from": [ { "file": 30 } ] }, { "id": "well-known/lib/crypto/implementation::known-crypto-library-implementation", "conf": 0.99, "crit": 3, "desc": "Known cryptographic library implementation or binding", "from": [ { "file": 23 } ], "uses": [ 57, 256 ] }, { "id": "micro-behaviors/process/create/spawn::open-process", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Open process handle" }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "atk": "T1070.006", "conf": 0.78, "crit": 3, "desc": "PE header timestamp predates 2000", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.9, "crit": 3, "desc": "Get tick count" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 1194 } ] }, { "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format", "conf": 0.9, "crit": 3, "desc": "Code formats a zero-padded integer", "from": [ { "file": 273 } ] }, { "id": "micro-behaviors/communications/http/header/custom::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::convert-thread-to-fiber", "conf": 0.9, "crit": 3, "desc": "Convert thread to fiber", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/fs/file/handle::kernel-device-io-control", "conf": 0.94, "crit": 3, "desc": "Controls a Windows kernel device", "from": [ { "file": 379 }, { "off": 4212, "file": 639 }, { "off": 5472, "file": 641 } ], "uses": [ 708, 733 ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-module-pyc", "atk": "T1059.006", "conf": 0.74, "crit": 3, "desc": "subprocess module reference in Python bytecode", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/ipc/dbus::dbus-cli-invocation", "conf": 0.88, "crit": 3, "desc": "Invokes a D-Bus command-line client", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/process/lifecycle/supervise::supervisor-exit-query", "conf": 0.9, "crit": 3, "desc": "Queries a process exit code", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "atk": "T1559", "conf": 0.7, "crit": 3, "desc": "Wait for named pipe server", "from": [ { "file": 49 } ] }, { "id": "metadata/binary/symbols/imports::imports-advapi32-dll", "conf": 0.95, "crit": 3, "desc": "Binary imports ADVAPI32.dll", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "atk": "T1027.009", "conf": 0.9, "crit": 2, "desc": "PE resource load and data pointer chain", "from": [ { "file": 379 }, { "off": 2137, "file": 422 }, { "off": 992192, "file": 463 } ], "uses": [ 211, 295, 624 ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ex", "conf": 0.82, "crit": 3, "desc": "Get extended module handle" }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-import", "conf": 0.88, "crit": 3, "desc": "Imports GetTempPath temp-directory API", "from": [ { "file": 85 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "Large PE imports over 120", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.78, "crit": 3, "desc": "Get module handle Unicode", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps-firefox", "conf": 0.5, "crit": 2, "desc": "References a Firefox executable or application package", "from": [ { "file": 378 }, { "file": 379 } ], "uses": [ 239 ] }, { "id": "micro-behaviors/fs/file/binary::seek-and-descriptor-io", "conf": 0.8, "crit": 3, "desc": "Reads or writes a seeked file descriptor", "from": [ { "file": 1 } ], "uses": [ 164, 729, 815 ] }, { "id": "metadata/binary/code/complexity::few-leaf-functions", "conf": 0.4, "crit": 3, "desc": "Binary has very few leaf functions", "from": [ { "file": 37 } ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-resource-marker", "conf": 0.98, "crit": 2, "desc": "MSVC runtime version resource marker", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/string/split::strtok-import", "conf": 0.85, "crit": 3, "desc": "Native strtok delimiter parser import", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/udp::ipproto-udp", "conf": 0.7, "crit": 3, "desc": "IPPROTO_UDP constant", "from": [ { "file": 1208 } ] }, { "id": "well-known/lib/runtime/scripted/python-runtime::python-stable-abi-forwarder-basename", "conf": 0.99, "crit": 3, "desc": "CPython stable-ABI forwarder DLL filename", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/process/create/shellexec::shell-execute-call", "atk": "T1059.001", "conf": 0.85, "crit": 3, "desc": "ShellExecute API call", "from": [ { "file": 83 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "atk": "T1055", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Writable and executable sections", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-safe-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP safe request line", "from": [ { "file": 1830 } ] }, { "id": "micro-behaviors/data/db/sql::sql-drop-object", "conf": 0.8, "crit": 3, "desc": "DROP SQL object syntax reference", "from": [ { "file": 85 } ] }, { "id": "metadata/import/python/json::json", "conf": 0.95, "crit": 2, "desc": "imports json", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/fs/delete/file/library::unlink", "conf": 0.3, "crit": 3, "desc": "References unlink file-delete API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/communications/socket/ssl::ssl-connect-symbol", "conf": 0.66, "crit": 3, "desc": "SSL connect API", "from": [ { "file": 77 } ] }, { "id": "metadata/binary/layout/entropy::high-entropy-64k-region", "conf": 1.0, "crit": 3, "desc": "Binary has a high-entropy 64 KiB region", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.9, "crit": 3, "desc": "dlsym function symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/messaging/send::python-send-message-method-call", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "Python send_message method call", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/fs/read/file/handle::fread-text", "conf": 0.62, "crit": 2, "desc": "References the CRT fread file-read routine", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::read-process-memory", "atk": "T1005", "conf": 0.95, "crit": 3, "desc": "References ReadProcessMemory process read API" }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.9, "crit": 2, "desc": "Windows file creation/open API", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stderr-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stderr to custom stream" }, { "id": "micro-behaviors/hardware/input/keyboard/hook::windows-hook-install", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.86, "crit": 3, "desc": "Windows hook install API", "from": [ { "file": 379 }, { "off": 993080, "file": 463 } ], "uses": [ 583, 904 ] }, { "id": "metadata/file/format/media::pdf-media-marker", "conf": 0.9, "crit": 3, "desc": "References the PDF signature or media type", "from": [ { "file": 1720 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "conf": 0.4, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "metadata/import/python/builtins::builtins", "conf": 0.95, "crit": 2, "desc": "imports builtins" }, { "id": "micro-behaviors/communications/socket/create::tcpclient-dotnet-str", "conf": 0.85, "crit": 3, "desc": ".NET TCP client type or method names", "from": [ { "file": 86 } ] }, { "id": "metadata/binary/vendor::benign-token-privilege-context", "conf": 0.95, "crit": 2, "desc": "Benign token privilege adjustment context", "from": [ { "file": 14 } ], "uses": [ 873 ] }, { "id": "micro-behaviors/communications/http/request/proxy::proxy-connect-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "HTTP CONNECT proxy tunnel method", "from": [ { "file": 1447 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait--sleepconditionvariablecs", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (SleepConditionVariableCS)", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::windows-hook-lifecycle", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.85, "crit": 3, "desc": "Windows hook install and chain-management APIs", "from": [ { "file": 379 }, { "off": 1261990, "file": 463 } ], "uses": [ 571, 586, 801, 842, 945 ] }, { "id": "objectives/exfiltration/http/collect::python-json-request-payload", "atk": "T1041", "conf": 0.91, "crit": 3, "desc": "Python JSON request payload", "from": [ { "file": 2215 } ] }, { "id": "metadata/package/files/included::package-json-basename", "conf": 0.95, "crit": 3, "desc": "Filename is package.json", "from": [ { "file": 2213 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 2587 } ], "uses": [ 184 ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::set-windows-hook", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.9, "crit": 3, "desc": "Install Windows event hook", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/get::get", "conf": 0.7, "crit": 3, "desc": "HTTP GET method", "from": [ { "file": 1830 } ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::unhook-windows-hook-text", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.84, "crit": 3, "desc": "UnhookWindowsHookEx API string", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "conf": 0.5, "crit": 2, "desc": "References the CRT fseek file-position routine", "from": [ { "file": 2 } ] }, { "id": "metadata/package/versioning/scheme::pe-product-version-ipv4-shape", "conf": 0.92, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "well-known/lib/runtime/native-platform/tcl-tk::tcl-tk-runtime-component", "conf": 0.98, "crit": 3, "desc": "Tcl/Tk runtime or extension library", "from": [ { "file": 379 }, { "file": 462 }, { "file": 463 } ], "uses": [ 871 ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::chacha20-poly1305-algorithm-reference", "conf": 0.9, "crit": 3, "desc": "ChaCha20-Poly1305 algorithm reference", "from": [ { "file": 74 } ] }, { "id": "metadata/import/c/basetsd/h::basetsd/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cbasetsd.h\u003e", "from": [ { "file": 91 } ] }, { "id": "metadata/lang/generated::automatically-generated-source-marker", "conf": 0.85, "crit": 2, "desc": "Generated source provenance marker", "from": [ { "file": 268 } ] }, { "id": "micro-behaviors/os/kernel/module::wdf-version-bind-symbol", "conf": 0.98, "crit": 3, "desc": "Bind Windows Driver Framework runtime", "from": [ { "file": 264 } ] }, { "id": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 3, "desc": "Oversized data section vs code", "from": [ { "file": 2 } ] }, { "id": "metadata/import/python/mitmproxy::mitmproxy", "conf": 0.95, "crit": 2, "desc": "imports mitmproxy", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/fs/write/file/handle::write--fwrite", "conf": 0.66, "crit": 2, "desc": "References fwrite file-write API", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/api-set::api-set-forwarder-dll", "conf": 1.0, "crit": 2, "desc": "Win API-set forwarder DLL", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/process/sync/mutex::open-mutex", "mbc": "C0042", "conf": 0.85, "crit": 3, "desc": "OpenMutex API call", "from": [ { "file": 56 } ] }, { "id": "objectives/anti-static/obfuscation/string/recovery::python-ascii-decode-call", "conf": 0.8, "crit": 3, "desc": "Python ASCII decode call", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-disk-free-space", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "GetDiskFreeSpace API import", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/crypto/library/keyword::blowfish-keyword", "conf": 0.4, "crit": 2, "desc": "Blowfish block cipher reference", "from": [ { "file": 1294 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Create process or module snapshot", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::find-next-volume", "atk": "T1083", "conf": 0.9, "crit": 3, "desc": "Continue volume enumeration", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.7, "crit": 3, "desc": "Get module handle ANSI", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/fs/delete/file/library::deletefile-a", "conf": 0.66, "crit": 3, "desc": "Delete files (Windows API ANSI)" }, { "id": "micro-behaviors/communications/proxy/reverse::reverse-proxy", "atk": "T1090", "conf": 0.75, "crit": 3, "desc": "Reverse proxy terminology reference", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/proc/container::container-self-cgroup", "conf": 0.66, "crit": 3, "desc": "Reads own cgroup (/proc/self/cgroup)", "from": [ { "file": 2144 } ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps", "conf": 0.5, "crit": 3, "desc": "References a browser executable name", "from": [ { "file": 378 }, { "file": 379 } ], "uses": [ 549 ] }, { "id": "micro-behaviors/communications/socket/init::winsock-server-ordinal-api-set", "conf": 0.92, "crit": 3, "desc": "Winsock server ordinal socket lifecycle", "from": [ { "file": 28 } ], "uses": [ 70, 188, 273, 384, 439, 521, 818 ] }, { "id": "micro-behaviors/os/firewall/wfp::wfp-filter-lifecycle", "atk": "T1562.004", "conf": 0.94, "crit": 3, "desc": "Build and install WFP filter pipeline", "from": [ { "file": 379 }, { "off": 16520, "file": 640 }, { "off": 24736, "file": 642 } ], "uses": [ 703, 924, 970 ] }, { "id": "micro-behaviors/os/registry/manipulate::reg-save-key", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Save registry hive to file", "from": [ { "file": 83 } ] }, { "id": "metadata/lang/upstream::exports-thread-inject-api--queueuserapc", "conf": 0.9, "crit": 3, "desc": "Exports thread/APC injection API (QueueUserAPC)" }, { "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket subprotocol header", "from": [ { "file": 2180 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-8", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 8 by number", "from": [ { "file": 28 } ] }, { "id": "metadata/lang/javascript-features::cjs-exports-pattern", "conf": 0.6, "crit": 3, "desc": "Defines CommonJS named exports", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write--write", "conf": 0.66, "crit": 2, "desc": "References POSIX write API", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.66, "crit": 3, "desc": "References C fopen file-open API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "atk": "T1113", "mbc": "C0014", "conf": 0.85, "crit": 3, "desc": "GDI compatible bitmap allocation", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/socket/family::socket-sock-stream-name", "atk": "T1071", "mbc": "C0001", "conf": 0.55, "crit": 3, "desc": "SOCK_STREAM constant name", "from": [ { "file": 1208 } ] }, { "id": "micro-behaviors/communications/socket/ssl::openssl-server-certificate-file", "conf": 0.86, "crit": 3, "desc": "OpenSSL TLS server certificate file API", "from": [ { "file": 77 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::are-file-apis-ansi", "conf": 0.85, "crit": 2, "desc": "File API ANSI check", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "conf": 0.9, "crit": 2, "desc": "Initializes a Windows lock-free list", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/data/embedded/payload/resource::load-resource", "atk": "T1027.009", "conf": 0.8, "crit": 2, "desc": "Load PE resource payload" }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "from": [ { "file": 1453 } ] }, { "id": "micro-behaviors/os/package-manager/apt::apt-package-install-command", "conf": 0.98, "crit": 3, "desc": "Runs an APT package install command" }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key open API", "from": [ { "file": 379 }, { "off": 2302120, "file": 459 }, { "off": 991232, "file": 463 } ], "uses": [ 291 ] }, { "id": "micro-behaviors/hardware/input/keyboard/poll::get-key-state", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.85, "crit": 3, "desc": "Poll virtual key state", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/path/secret-config::package-or-netrc-credential-file", "atk": "T1552.001", "conf": 0.9, "crit": 3, "desc": "Package or netrc credential file reference", "from": [ { "file": 379 }, { "off": 169, "file": 2290 }, { "off": 8204, "file": 2291 } ], "uses": [ 915 ] }, { "id": "objectives/evasion/masquerade/identity/vendor::importless-microsoft-recognized-marker", "conf": 0.9, "crit": 3, "desc": "Recognized Microsoft importless PE marker", "from": [ { "file": 36 } ], "uses": [ 139, 299, 597 ] }, { "id": "metadata/file/string/identity::jfif-or-jpeg-media-marker", "conf": 0.82, "crit": 3, "desc": "References JFIF or the JPEG media type", "from": [ { "file": 1555 } ] }, { "id": "micro-behaviors/os/clipboard/write::empty-clipboard", "conf": 0.75, "crit": 3, "desc": "Clear clipboard contents", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/config/system::read-private-profile-ansi", "conf": 0.68, "crit": 3, "desc": "Read INI string value", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/communications/http/message::http2-preface", "conf": 0.75, "crit": 3, "desc": "HTTP/2 client connection preface", "from": [ { "file": 1526 } ] }, { "id": "micro-behaviors/data/source/function/names::create-connection-call-target", "conf": 0.9, "crit": 3, "desc": "Call target named createConnection", "from": [ { "file": 2211 } ] }, { "id": "metadata/binary/section/ratio::inflated-data-section", "conf": 0.86, "crit": 3, "desc": "Data virtual size exceeds raw size" }, { "id": "micro-behaviors/communications/socket/options::address-family-constant-names", "conf": 0.9, "crit": 2, "desc": "Many AF_ address family constant names", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::credentials-path-tail", "conf": 0.4, "crit": 3, "desc": "Path ending in credentials", "from": [ { "file": 1651 } ] }, { "id": "micro-behaviors/ui/dialog/error::data-loss-warning", "conf": 1.0, "crit": 3, "desc": "Warns that data will be lost", "from": [ { "file": 1225 } ] }, { "id": "micro-behaviors/mem/sync/cache::flush-instruction-cache", "conf": 0.75, "crit": 3, "desc": "FlushInstructionCache code synchronization", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/communications/socket/init::inet-addr-api-ordinal", "conf": 0.84, "crit": 3, "desc": "IPv4 string conversion import", "from": [ { "file": 28 } ], "uses": [ 521, 720 ] }, { "id": "micro-behaviors/communications/http/response::http2-version", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP/2 protocol version string", "from": [ { "file": 1524 } ] }, { "id": "metadata/lang/natural::polish-common-word-dla", "conf": 1.0, "crit": 1, "desc": "Polish common word dla", "from": [ { "file": 1140 } ] }, { "id": "micro-behaviors/ui/window/message::post-quit-message", "conf": 0.7, "crit": 2, "desc": "Post quit message", "from": [ { "file": 86 } ] }, { "id": "metadata/import/python/mitmproxy/ctx::ctx", "conf": 0.95, "crit": 2, "desc": "imports ctx from mitmproxy", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/os/exception/error-handling::get-last-error", "conf": 0.7, "crit": 2, "desc": "Get system error code", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/instruction::x86-global-pointer-indirect-call", "conf": 0.9, "crit": 3, "desc": "x86 indirect call through a global pointer", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "atk": "T1082", "mbc": "E1082", "conf": 0.65, "crit": 2, "desc": "Go binary contains hostname-related symbols", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/fs/shell-ops::browse-for-folder", "conf": 0.7, "crit": 3, "desc": "Display folder browse dialog", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-51", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 51 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/fs/file/copy::copyfile-ex-w", "conf": 0.72, "crit": 3, "desc": "Copy files with progress callback" }, { "id": "micro-behaviors/process/create/spawn::wspawnl", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Spawn process via _wspawnl" }, { "id": "metadata/lang/natural::lang-polish-diacritics", "conf": 0.8, "crit": 1, "desc": "Polish-specific diacritics (ąęłńśźż)", "from": [ { "file": 457 } ] }, { "id": "objectives/anti-static/obfuscation/instruction/junk::indirect-call-compare-branches", "conf": 0.85, "crit": 3, "desc": "Indirect call followed by a compare branch", "from": [ { "file": 16 } ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "from": [ { "file": 2215 } ] }, { "id": "metadata/binary/symbols/exports::short-lowercase-export-name", "conf": 0.72, "crit": 3, "desc": "Short lowercase export name", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/os/clipboard/reference::is-clipboard-format-available", "conf": 0.78, "crit": 3, "desc": "Check clipboard format availability", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 1422 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-alloc", "atk": "T1587.001", "conf": 0.9, "crit": 3, "desc": "Allocate virtual memory", "from": [ { "file": 19 } ] }, { "id": "metadata/file/string/process-name::postgres-name", "conf": 0.4, "crit": 3, "desc": "PostgreSQL database server name", "from": [ { "file": 2 } ] }, { "id": "metadata/package/entrypoint::main-root-javascript-entry", "conf": 0.9, "crit": 2, "desc": "Root JavaScript main entrypoint" }, { "id": "micro-behaviors/communications/ipc/pipe::peek-named-pipe", "atk": "T1559", "conf": 0.9, "crit": 3, "desc": "Peek at pipe data without reading" }, { "id": "micro-behaviors/crypto/asymmetric/ecdh::ec-key-generate-key", "conf": 0.9, "crit": 3, "desc": "EC_KEY_generate_key reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::x86-byte-xor-terminator-loop", "conf": 0.9, "crit": 3, "desc": "In-place byte XOR loop with -1 terminator", "from": [ { "file": 17 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/package/ecosystem::pkginfo-name-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package name", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/fs/link/reparse::mount-point-reparse-tag", "conf": 0.94, "crit": 3, "desc": "Uses the Windows mount-point reparse tag", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::armored-named-private-key-header", "conf": 0.95, "crit": 3, "desc": "References named armored private-key header", "from": [ { "file": 1341 } ] }, { "id": "micro-behaviors/communications/http/server/request::request-network-target-field", "conf": 0.9, "crit": 3, "desc": "HTTP request selects a network target", "from": [ { "file": 2215 } ] }, { "id": "metadata/binary/section/ratio::dominant-section", "conf": 0.6, "crit": 3, "desc": "Single section dominates binary layout", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/options::ipproto-constant-names", "conf": 0.9, "crit": 2, "desc": "Many IPPROTO_ constant names", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/hardware/display/screenshot::create-dib-section", "atk": "T1113", "mbc": "C0014", "conf": 0.9, "crit": 2, "desc": "GDI DIB section creation for BMP capture", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/provenance/version-info::pe-internal-name-differs-from-original", "conf": 0.9, "crit": 2, "desc": "InternalName differs from OriginalFilename" }, { "id": "micro-behaviors/crypto/library/keyword::encryption-algorithm-keyword", "conf": 0.5, "crit": 3, "desc": "Encryption algorithm keyword", "from": [ { "file": 6 } ], "uses": [ 234, 601 ] }, { "id": "micro-behaviors/ui/window/control::create-window-ex", "conf": 0.85, "crit": 2, "desc": "Create window (extended)", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/communications/http/response::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "conf": 0.86, "crit": 2, "desc": "Query locale information" }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 1 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 2, "desc": "File is in common test directory", "from": [ { "file": 1468 } ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 14 } ] }, { "id": "objectives/impact/ransom/affiliate::uploads-staging-path", "conf": 0.7, "crit": 3, "desc": "Upload staging directory path", "from": [ { "file": 1415 } ] }, { "id": "metadata/package/ecosystem::pkginfo-requires-dist", "conf": 0.9, "crit": 3, "desc": "Declares Python runtime dependencies", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::volume-enumeration-continue", "conf": 0.92, "crit": 3, "desc": "Continues Windows volume enumeration", "from": [ { "file": 379 }, { "off": 2930, "file": 416 } ], "uses": [ 603 ] }, { "id": "micro-behaviors/communications/ipc/pipe::create-pipe", "atk": "T1559", "conf": 0.9, "crit": 2, "desc": "Create anonymous pipe", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/request/body::urllib-payload-argument", "conf": 0.86, "crit": 3, "desc": "urllib call supplies a payload argument", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/os/sysinfo/disk::freespace", "atk": "T1082", "conf": 0.5, "crit": 2, "desc": "Disk free space query", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/process/create/shell-subprocess::subprocess-shell-pyc", "atk": "T1059.006", "conf": 0.72, "crit": 3, "desc": "Nearby subprocess and shell keyword in Python bytecode", "from": [ { "file": 1208 } ], "uses": [ 539, 764 ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket protocol headers", "from": [ { "file": 2180 } ] }, { "id": "micro-behaviors/communications/proxy/socks::socks4-proto", "atk": "T1090", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "SOCKS4 protocol reference", "from": [ { "file": 1835 } ] }, { "id": "metadata/lang/compiler/native::python-capi-symbol", "conf": 0.95, "crit": 2, "desc": "References a Python C API runtime symbol", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-pyc", "conf": 0.85, "crit": 3, "desc": "Pinned external IPv4 in Python bytecode", "from": [ { "file": 2090 } ] }, { "id": "micro-behaviors/communications/http/message::raw-http-control-request-line", "conf": 0.94, "crit": 3, "desc": "Raw HTTP control request line", "from": [ { "file": 1447 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "from": [ { "file": 270 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-any", "conf": 0.9, "crit": 3, "desc": "IsDebuggerPresent import or API name reference", "from": [ { "file": 16 } ], "uses": [ 749, 989 ] }, { "id": "micro-behaviors/crypto/kdf/algorithm::pbkdf2", "conf": 0.75, "crit": 3, "desc": "PBKDF2 key-derivation reference", "from": [ { "file": 23 } ] }, { "id": "metadata/binary/layout/overlay::overlay-at-least-half", "conf": 0.9, "crit": 3, "desc": "Binary overlay is at least 50 percent", "from": [ { "file": 36 } ] }, { "id": "metadata/file/string/process-name::apache-name", "conf": 0.4, "crit": 3, "desc": "apache web server name", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/traverse::std-filesystem-runtime", "conf": 0.92, "crit": 3, "desc": "C++ filesystem runtime DLL reference", "from": [ { "file": 64 } ] }, { "id": "micro-behaviors/os/firewall/wfp::fwpm-engine-open", "atk": "T1562.004", "conf": 0.9, "crit": 3, "desc": "Open Windows Filtering Platform engine", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/process/info/thread::get-current-thread-id", "conf": 0.9, "crit": 2, "desc": "Get current thread ID", "from": [ { "file": 14 } ] }, { "id": "objectives/privilege-escalation/token-manipulation::token-manipulation-cluster-recognized-marker", "conf": 0.86, "crit": 3, "desc": "Recognized token manipulation marker", "uses": [ 413 ] }, { "id": "micro-behaviors/mem/alloc/heap::heap-create-enable-execute-flag", "conf": 0.94, "crit": 3, "desc": "HEAP_CREATE_ENABLE_EXECUTE flag (0x40000)", "from": [ { "file": 35 } ] }, { "id": "objectives/anti-static/obfuscation/payload/loader::pyinstaller-pe-bundle-marker", "atk": "T1027.001", "mbc": "B0032.001", "conf": 0.9, "crit": 3, "desc": "PyInstaller packed PE binary marker", "from": [ { "off": 24151327, "file": 378 }, { "off": 17711505, "file": 379 } ], "uses": [ 157, 199, 328 ] }, { "id": "micro-behaviors/fs/file/handle::kernel-device-handle", "conf": 0.9, "crit": 3, "desc": "Opens a Windows kernel device handle", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/crypto/certificate/store::certificate-key-provider-property-api", "conf": 0.9, "crit": 3, "desc": "Reads certificate key provider metadata", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/fs/chmod/modify::fchmod-symbol", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "References fchmod permission-change API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "conf": 1.0, "crit": 3, "desc": "Query/set system parameters (string)", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-17", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 17 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.95, "crit": 2, "desc": "Microsoft code-signing certificate chain", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 2214 } ] }, { "id": "micro-behaviors/os/service/create::create-service-w-reference", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "CreateServiceW named, not imported", "from": [ { "file": 263 } ] }, { "id": "objectives/discovery/system/locale::windows-locale-fingerprint", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 2, "desc": "Imports APIs that query multiple Windows locale settings", "from": [ { "file": 379 }, { "off": 2418, "file": 423 }, { "off": 3996872, "file": 459 }, { "off": 1259694, "file": 463 }, { "file": 464 } ], "uses": [ 249, 421, 504 ] }, { "id": "micro-behaviors/communications/proxy/socks::socks5-proto", "atk": "T1090", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "SOCKS5 protocol reference", "from": [ { "file": 1835 } ] }, { "id": "metadata/binary/symbols/exports::export-dll-can-unload-now", "conf": 0.95, "crit": 3, "desc": "COM unload export present", "from": [ { "file": 20 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-11", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 11 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::repeated-stack-table-indirect-calls-x64", "conf": 0.97, "crit": 3, "desc": "Repeated x64 stack-table indirect calls", "from": [ { "file": 85 } ] }, { "id": "micro-behaviors/process/create/spawn::wspawnvpe", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Spawn process via _wspawnvpe" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::text-heavy-binary", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "One .text section dominates file", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/process/info/thread::thread-context-api-reference-get", "atk": "T1055.003", "conf": 0.94, "crit": 3, "desc": "GetThreadContext API name reference", "from": [ { "file": 52 } ] }, { "id": "objectives/anti-static/obfuscation/name-mangling/import-name::opaque-alpha-import-cluster", "atk": "T1027", "conf": 0.96, "crit": 3, "desc": "Imports cluster of opaque mixed-case names", "from": [ { "file": 86 } ] }, { "id": "metadata/lang/upstream::exports-mem-map-inject-api--writeprocessmemory", "conf": 0.9, "crit": 3, "desc": "Exports memory/section (WriteProcessMemory)" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "atk": "T1027", "mbc": "B0032", "conf": 0.84, "crit": 3, "desc": "Large PE with under eighty imports", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/ui/window/control::destroy-window", "conf": 0.7, "crit": 2, "desc": "Destroy window", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/fs/read/file/descriptor::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/communications/socket/ssl::openssl-server-private-key-file", "conf": 0.86, "crit": 3, "desc": "OpenSSL TLS server private key API", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.88, "crit": 2, "desc": "Registry value query API", "from": [ { "file": 379 }, { "off": 2302080, "file": 459 }, { "file": 463 } ], "uses": [ 288 ] }, { "id": "micro-behaviors/fs/traversal/drives::get-logical-drive-strings", "atk": "T1083", "mbc": "E1083", "conf": 0.9, "crit": 3, "desc": "GetLogicalDriveStrings API reference", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/file/handle::device-io-control-win", "conf": 0.85, "crit": 3, "desc": "DeviceIoControl API usage", "from": [ { "file": 263 } ] }, { "id": "objectives/command-and-control/dropper/execution/loader::pyc-decompress-string", "conf": 0.84, "crit": 3, "desc": "Bytecode decompresses embedded payload data", "from": [ { "file": 6 } ] }, { "id": "objectives/discovery/system/fingerprint/info::native-host-runtime-fields", "atk": "T1082", "conf": 0.85, "crit": 3, "desc": "Native computer identity field", "from": [ { "file": 83 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-14", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 14 by number", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::get-system-info", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Calls Windows GetSystemInfo API", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/capture/windivert::windivert-receive", "atk": "T1040", "conf": 0.95, "crit": 3, "desc": "Receives packets through WinDivert", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/communications/http/message::configured-https-endpoint", "conf": 0.88, "crit": 3, "desc": "Embedded HTTPS endpoint configuration", "from": [ { "file": 1411 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-prefix", "conf": 0.7, "crit": 2, "desc": "X509_ function prefix", "from": [ { "file": 30 } ] }, { "id": "metadata/binary/vendor::apiset-stub", "conf": 0.95, "crit": 2, "desc": "Windows ApiSet Stub DLL" }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.7, "crit": 2, "desc": "References PEM certificate footer", "from": [ { "file": 2095 } ] }, { "id": "micro-behaviors/fs/directory/traverse::findfirst", "conf": 0.8, "crit": 3, "desc": "Find first file (DOS/Windows)" }, { "id": "objectives/evasion/process/injection/callback::enum-locale-callback", "atk": "T1106", "mbc": "E1106", "conf": 0.7, "crit": 3, "desc": "EnumSystemLocales callback API" }, { "id": "metadata/binary/section/header::reloc-overhang-bytes-significant", "conf": 0.9, "crit": 3, "desc": "PE reloc has large non-relocation tail", "from": [ { "file": 75 } ] }, { "id": "metadata/file/magic/identity::elf-header", "conf": 1.0, "crit": 2, "desc": "ELF binary magic at file start", "from": [ { "file": 2 } ] }, { "id": "metadata/package/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 2, "desc": "Declares Python Core Metadata version", "from": [ { "file": 247 } ] }, { "id": "objectives/command-and-control/dropper/execution/loader::pyc-dotnet-entrypoint-string", "conf": 0.86, "crit": 3, "desc": "Bytecode references .NET entry point", "from": [ { "file": 1563 } ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-string", "conf": 0.9, "crit": 3, "desc": "IsDebuggerPresent API name in PE strings", "from": [ { "file": 16 } ] }, { "id": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "atk": "T1071", "mbc": "B0025", "conf": 0.9, "crit": 3, "desc": "OLE automation DLL import", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/http/download/cli::powershell-http-transfer-command-reference", "atk": "T1105", "mbc": "E1105", "conf": 0.9, "crit": 3, "desc": "PowerShell HTTP transfer command reference", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-release-context", "conf": 0.9, "crit": 3, "desc": "Release cryptographic context", "from": [ { "file": 74 } ] }, { "id": "metadata/lang/natural::lang-tamil", "conf": 0.8, "crit": 3, "desc": "Contains Tamil script", "from": [ { "file": 470 } ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.98, "crit": 2, "desc": "Microsoft-signed Windows binary", "from": [ { "file": 14 } ], "uses": [ 139, 804 ] }, { "id": "objectives/evasion/masquerade/binary::overlay-digicert-string", "atk": "T1036.001", "conf": 0.8, "crit": 3, "desc": "DigiCert string in overlay", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 3, "desc": "Python JSON content type", "from": [ { "file": 1408 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product" }, { "id": "metadata/binary/framework::mscoree-name", "conf": 0.95, "crit": 3, "desc": "References the .NET mscoree loader name", "from": [ { "file": 88 } ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/path/app-data::windows-user-profile-data-path", "conf": 0.82, "crit": 3, "desc": "Windows Documents/Desktop/Roaming path", "from": [ { "file": 1264 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-send-end", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response send/end method", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/os/exception/handler::capture-context", "atk": "T1005", "conf": 0.9, "crit": 2, "desc": "Capture CPU context/registers", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-116", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 116 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/shell-subprocess::subprocess-shell-keyword-pyc", "atk": "T1059.006", "conf": 0.7, "crit": 1, "desc": "shell keyword in Python bytecode", "from": [ { "file": 1208 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/rc4::rc4-strings", "atk": "T1573", "mbc": "C0027", "conf": 0.5, "crit": 3, "desc": "RC4 implementation text marker", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/ui/window/control::screen-to-client", "conf": 0.7, "crit": 2, "desc": "Convert screen to client coordinates", "from": [ { "file": 87 } ] }, { "id": "metadata/import/c/stdio/h::stdio/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cstdio.h\u003e", "from": [ { "file": 91 } ] }, { "id": "micro-behaviors/time/query::local-timezone-conversion", "conf": 0.9, "crit": 3, "desc": "Local timezone time conversion", "from": [ { "file": 379 }, { "off": 1401, "file": 435 }, { "off": 2302744, "file": 459 }, { "off": 759440, "file": 464 } ], "uses": [ 40, 221, 497 ] }, { "id": "objectives/persistence/system/surface/paths::managed-persistence-marker--rx-9", "atk": "T1547", "conf": 0.84, "crit": 3, "desc": "Managed or installed service/cron wording", "from": [ { "file": 2043 } ] }, { "id": "micro-behaviors/os/package-manager/install::apt-get-install-cmd", "conf": 0.75, "crit": 3, "desc": "apt-get install command" }, { "id": "micro-behaviors/communications/socket/options::ip-option-constant-names", "conf": 0.9, "crit": 2, "desc": "Many IP_ option constant names", "from": [ { "file": 28 } ] }, { "id": "objectives/anti-static/obfuscation/decoy-imports::heap-walk-import", "conf": 0.85, "crit": 3, "desc": "HeapWalk junk API import", "from": [ { "file": 88 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version" }, { "id": "micro-behaviors/communications/ip/literal::localhost-binary", "conf": 0.78, "crit": 2, "desc": "Binary contains the localhost hostname", "from": [ { "file": 74 } ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.85, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "from": [ { "file": 2 } ] }, { "id": "objectives/impact/services/stop::sc-stop", "atk": "T1489", "conf": 0.8, "crit": 3, "desc": "Stops a Windows service with sc.exe", "from": [ { "file": 2043 } ] }, { "id": "micro-behaviors/fs/file/rename::any-rename", "conf": 0.9, "crit": 3, "desc": "Rename or move file on Windows", "from": [ { "file": 379 }, { "off": 1568, "file": 418 }, { "file": 459 }, { "file": 462 }, { "file": 464 } ], "uses": [ 142, 466 ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-prime-32bit-literal", "conf": 0.7, "crit": 3, "desc": "FNV-1a 32-bit prime constant (0x01000193)", "from": [ { "file": 86 } ] }, { "id": "metadata/lang/compiler/native::python3-dll-import", "conf": 0.95, "crit": 2, "desc": "Imports the Python runtime DLL", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/http/header/transfer-encoding::chunked-transfer-encoding", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP chunked transfer encoding", "from": [ { "file": 1516 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal--wakeconditionvariable", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (WakeConditionVariable)", "from": [ { "file": 35 } ] }, { "id": "well-known/lib/native/pywin32::pywin32-module-basename", "conf": 0.9, "crit": 3, "desc": "pywin32 extension module filename", "from": [ { "file": 1272 } ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-getdibits", "atk": "T1113", "mbc": "C0014", "conf": 0.9, "crit": 3, "desc": "GDI GetDIBits pixel readback import", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/client/urlmon::urlmon-dynamic-load-cond-0--inline-19271", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/crypto/asymmetric/key::openssh-private-key-footer", "conf": 0.99, "crit": 3, "desc": "OpenSSH private-key footer", "from": [ { "file": 1341 } ] }, { "id": "micro-behaviors/communications/socket/init::wsa-socket", "conf": 0.9, "crit": 3, "desc": "Create a Winsock socket with WSASocketW", "from": [ { "file": 28 } ] }, { "id": "metadata/package/repository::has-repository-url", "conf": 0.85, "crit": 2, "desc": "package.json declares a repository URL" }, { "id": "micro-behaviors/communications/socket/ssl::tls-server-certificate", "conf": 0.92, "crit": 3, "desc": "TLS server certificate material", "from": [ { "file": 379 }, { "file": 453 } ], "uses": [ 621 ] }, { "id": "micro-behaviors/fs/traversal/drives::set-current-directory", "conf": 0.9, "crit": 3, "desc": "Switch current working directory" }, { "id": "micro-behaviors/communications/socket/init::ntohl-api-ordinal", "conf": 0.88, "crit": 3, "desc": "Winsock ntohl ordinal import", "from": [ { "file": 26 } ], "uses": [ 521, 736 ] }, { "id": "metadata/binary/vendor::windows-os-product-name", "conf": 0.8, "crit": 3, "desc": "Windows OS product name in version resource" }, { "id": "micro-behaviors/fs/device/query::query-dos-device-w", "conf": 0.8, "crit": 3, "desc": "Resolve NT device symbolic link" }, { "id": "micro-behaviors/ui/window/message::dispatch-message", "conf": 0.7, "crit": 2, "desc": "Dispatch window message", "from": [ { "file": 86 } ] }, { "id": "metadata/binary/layout/entropy::overall-entropy-78", "conf": 0.95, "crit": 3, "desc": "Binary overall entropy at least 7.8", "from": [ { "file": 2 } ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/binary/layout/ratio::overlay-over-90pct", "conf": 0.95, "crit": 3, "desc": "PE overlay exceeds ninety percent", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/user-agent::bot-user-agent-list--rx-1", "conf": 0.85, "crit": 3, "desc": "Contains a crawler User-Agent string", "from": [ { "file": 2160 } ] }, { "id": "micro-behaviors/mem/c-runtime/functions::vectorized-zero-fill", "conf": 0.6, "crit": 3, "desc": "Vectorized zero-fill instruction sequence", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/thread/lifecycle::switch-to-fiber", "conf": 0.9, "crit": 3, "desc": "Switch to a fiber object", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::write-process-memory-dup", "atk": "T1055", "mbc": "C0032", "conf": 0.95, "crit": 3, "desc": "WriteProcessMemory API reference", "from": [ { "file": 379 }, { "file": 424 } ], "uses": [ 216 ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::call-next-hook-ex", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.8, "crit": 3, "desc": "Forward events in Windows hook chain", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.85, "crit": 3, "desc": "Dynamic library loading and symbol lookup", "from": [ { "off": 38737, "file": 377 }, { "off": 2815, "file": 378 } ], "uses": [ 247, 565 ] }, { "id": "well-known/lib/runtime/scripted/python-runtime::pyd-extension-basename", "conf": 0.95, "crit": 3, "desc": "CPython native extension module filename", "from": [ { "file": 16 } ] }, { "id": "metadata/signed/platform::microsoft-signature-verified", "conf": 1.0, "crit": 2, "desc": "Microsoft certificate chain has verified Authenticode signature", "from": [ { "file": 14 } ], "uses": [ 9, 714, 795, 933 ] }, { "id": "objectives/execution/exploit/rop::stack-adjust-ret", "atk": "T1203", "conf": 0.9, "crit": 3, "desc": "Stack adjustment gadget", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "conf": 0.92, "crit": 2, "desc": "Directory walker using Win32 wide APIs", "from": [ { "file": 379 }, { "off": 2711, "file": 416 }, { "off": 2891102, "file": 450 }, { "off": 3379544, "file": 451 }, { "off": 3997576, "file": 459 }, { "off": 1623300, "file": 462 }, { "off": 968118, "file": 464 } ], "uses": [ 52, 465, 850 ] }, { "id": "micro-behaviors/mem/alloc/heap::heap-create", "conf": 0.9, "crit": 3, "desc": "Create private heap (HeapCreate)" }, { "id": "micro-behaviors/communications/ssh/connect::ssh-string", "atk": "T1021.004", "conf": 0.4, "crit": 1, "desc": "References the SSH protocol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "from": [ { "file": 2591 } ], "uses": [ 886 ] }, { "id": "micro-behaviors/os/registry/access::registry-create-key-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key creation API", "from": [ { "file": 379 }, { "off": 2302024, "file": 459 } ], "uses": [ 138, 835 ] }, { "id": "metadata/package/versioning/scheme::pe-file-version-ipv4-shape", "conf": 0.92, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 83 } ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-recognized-marker", "conf": 0.8, "crit": 3, "desc": "Recognized token privilege marker", "from": [ { "file": 14 } ], "uses": [ 576 ] }, { "id": "micro-behaviors/process/create/subprocess::pyc-check-output-call", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.9, "crit": 3, "desc": "Python bytecode references check_output", "from": [ { "file": 1190 } ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write", "conf": 0.66, "crit": 2, "desc": "CRT or POSIX file-write capability", "from": [ { "file": 1 } ], "uses": [ 596, 617 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::python-column0-noarg-call-assignment", "conf": 0.84, "crit": 3, "desc": "Module assigns a no-arg call" }, { "id": "micro-behaviors/data/compress/zstd::zstd-cctx", "conf": 0.9, "crit": 3, "desc": "ZSTD_CCtx type", "from": [ { "file": 35 } ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-1", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 1 by number", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/os/clipboard/reference::close-clipboard", "conf": 0.65, "crit": 3, "desc": "Close clipboard", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/fs/write/file/handle::write-file", "conf": 0.9, "crit": 2, "desc": "Write data to file handle", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/embedded/payload/installer::overlay-bzip2-magic", "conf": 0.9, "crit": 3, "desc": "Bzip2 header in overlay", "from": [ { "file": 3 } ] }, { "id": "metadata/package/homepage::homepage-git-host", "conf": 0.9, "crit": 3, "desc": "Homepage points to major Git host" }, { "id": "micro-behaviors/os/env/read::getenv-profiling-api", "conf": 0.86, "crit": 3, "desc": "GetEnvironmentVariable profiler check", "from": [ { "file": 33 } ] }, { "id": "metadata/import/npm/http::http", "conf": 0.95, "crit": 3, "desc": "imports http", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.86, "crit": 3, "desc": "Process creation via fork or clone", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_pton", "from": [ { "file": 28 } ] }, { "id": "well-known/lib/crypto/openssl::openssl-capi-engine-source-marker", "conf": 0.95, "crit": 3, "desc": "OpenSSL CAPI engine source string", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/header/custom::form-data-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "HTTP multipart form-data header", "from": [ { "file": 2158 } ] }, { "id": "metadata/file/extension/executable::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::file-enumeration-with-access", "conf": 0.9, "crit": 3, "desc": "Directory enumeration with file-content access", "from": [ { "file": 83 } ], "uses": [ 80, 266, 465, 569, 618, 850 ] }, { "id": "metadata/binary/symbols/exports::export-dll-get-class-object", "conf": 0.95, "crit": 3, "desc": "COM class factory export", "from": [ { "file": 20 } ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "from": [ { "file": 363 } ] }, { "id": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "atk": "T1112", "conf": 0.92, "crit": 3, "desc": "Create registry key via WinAPI", "from": [ { "file": 83 } ] }, { "id": "metadata/lang/compiler/native::msvcrt", "conf": 0.9, "crit": 3, "desc": "msvcrt library (MSVC C runtime)", "from": [ { "file": 263 } ] }, { "id": "metadata/lang/runtime::main-entry-symbol", "conf": 0.5, "crit": 3, "desc": "_main program entry symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/keyword::openssl-evp-encrypt", "conf": 0.9, "crit": 3, "desc": "OpenSSL EVP encryption functions", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "conf": 0.85, "crit": 3, "desc": "LoadLibraryExW w/ SYSTEM32 search", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-cursor-list", "conf": 1.0, "crit": 3, "desc": "PE has RT_CURSOR in resources list" }, { "id": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "atk": "T1113", "mbc": "C0014", "conf": 0.85, "crit": 2, "desc": "GDI compatible device context", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::unhook-windows-hook", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.85, "crit": 3, "desc": "Remove Windows event hook", "from": [ { "file": 87 } ] }, { "id": "metadata/binary/debug::pdb-absolute-path", "conf": 0.72, "crit": 3, "desc": "Embedded absolute PDB path" }, { "id": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "conf": 1.0, "crit": 3, "desc": "Call to GetDriveTypeA by raw bytes", "from": [ { "file": 40 } ] }, { "id": "metadata/package/repository::repo-url-git-host", "conf": 0.9, "crit": 3, "desc": "Repository identifies major Git host" }, { "id": "micro-behaviors/hardware/input/keyboard/poll::get-async-key-state", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.9, "crit": 2, "desc": "Poll asynchronous virtual key state", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-memory-allocation-protection-api-pair", "conf": 0.9, "crit": 3, "desc": "Imports virtual-memory allocation and protection APIs", "from": [ { "file": 379 }, { "off": 110616, "file": 395 }, { "off": 69784, "file": 396 }, { "off": 24592, "file": 452 }, { "off": 2303048, "file": 459 }, { "off": 758928, "file": 464 } ], "uses": [ 412, 661 ] }, { "id": "micro-behaviors/process/create/spawn::proc-thread-attribute-list", "conf": 0.96, "crit": 3, "desc": "Extended process startup attributes", "from": [ { "file": 379 }, { "off": 2815, "file": 427 }, { "off": 2302960, "file": 459 } ], "uses": [ 135, 252 ] }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file", "conf": 0.9, "crit": 2, "desc": "Directory enumeration" }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.8, "crit": 3, "desc": "References stat-family file-status API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/hardware/display/screenshot::gdi-screen-capture-primitives", "atk": "T1113", "mbc": "C0014", "conf": 0.93, "crit": 3, "desc": "Windows GDI screenshot primitives", "from": [ { "file": 379 }, { "off": 1260872, "file": 463 } ], "uses": [ 207, 347, 783 ] }, { "id": "metadata/package/ecosystem::pkginfo-requires-python", "conf": 0.9, "crit": 3, "desc": "Declares supported Python versions", "from": [ { "file": 247 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "conf": 0.9, "crit": 2, "desc": "Directory enumeration (ANSI)", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/message/queue::get-message-w", "conf": 0.85, "crit": 2, "desc": "Get message (Unicode)", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdout-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdout to custom stream", "from": [ { "file": 1208 } ] }, { "id": "micro-behaviors/communications/socket/init::socket-api-ordinal", "conf": 0.88, "crit": 3, "desc": "Winsock socket creation import", "from": [ { "file": 26 } ], "uses": [ 188, 521 ] }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "conf": 1.0, "crit": 3, "desc": "Query/set system parameters (symbol)", "from": [ { "file": 87 } ] }, { "id": "metadata/file/string/process-name::mysql-name", "conf": 0.4, "crit": 3, "desc": "MySQL database server name", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/symbols/fake-windows::sideload-export-cluster-size-10-25", "conf": 0.9, "crit": 3, "desc": "DLL exports ten to twenty-five APIs", "from": [ { "file": 36 } ] }, { "id": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "atk": "T1070.006", "mbc": "F0006", "conf": 0.85, "crit": 3, "desc": "File timestamp modification with file operations", "from": [ { "file": 83 } ], "uses": [ 45, 448, 465, 569, 820 ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/fs/file/binary::ftell-import", "conf": 0.7, "crit": 2, "desc": "References the CRT ftell position routine", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/pack/polymorphic::very-low-func-count", "atk": "T1027", "conf": 0.95, "crit": 3, "desc": "Very low recovered function count", "from": [ { "file": 82 } ] }, { "id": "micro-behaviors/data/embedded/script::embedded-php-command-exec-call", "conf": 0.96, "crit": 3, "desc": "Embedded PHP command execution call", "from": [ { "file": 271 } ] }, { "id": "micro-behaviors/communications/socket/init::shutdown-api-ordinal", "conf": 0.84, "crit": 3, "desc": "Winsock shutdown import", "from": [ { "file": 28 } ], "uses": [ 410, 521 ] }, { "id": "micro-behaviors/fs/path/secret-config::ssh-tooling-or-transcript-context", "atk": "T1552.001", "conf": 0.9, "crit": 1, "desc": "SSH tooling or documentation transcript", "from": [ { "file": 377 }, { "file": 378 }, { "file": 379 }, { "off": 48304, "file": 1670 }, { "off": 1315, "file": 1715 }, { "off": 14044, "file": 1717 } ], "uses": [ 13, 808 ] }, { "id": "micro-behaviors/crypto/certificate/store::cert-enum-certificates", "conf": 0.9, "crit": 3, "desc": "Enumerate certificates in store", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "atk": "T1083", "mbc": "E1083", "conf": 0.75, "crit": 3, "desc": "References GetLogicalDrives API name", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value", "from": [ { "file": 2211 } ] }, { "id": "well-known/lib/runtime/native-platform/tcl-tk::tcl-tk-runtime-library", "conf": 0.98, "crit": 3, "desc": "Tcl/Tk runtime shared library", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/ui/window/station::get-user-object-information", "conf": 0.85, "crit": 2, "desc": "Query window station object info", "from": [ { "file": 74 } ] }, { "id": "metadata/binary/vendor::common-fp-context", "conf": 0.9, "crit": 2, "desc": "Common Windows binary compatibility context", "from": [ { "file": 14 } ], "uses": [ 741, 754 ] }, { "id": "metadata/binary/symbols/fake-windows::dll-forwarded-export", "conf": 0.95, "crit": 3, "desc": "Forwarded export detected" }, { "id": "micro-behaviors/process/info/thread::thread-context-api-reference-set", "atk": "T1055.003", "conf": 0.94, "crit": 3, "desc": "SetThreadContext API name reference", "from": [ { "file": 52 } ] }, { "id": "metadata/file/format/markup::postscript-adobe-header", "conf": 0.97, "crit": 3, "desc": "Adobe PostScript document header", "from": [ { "file": 1110 } ] }, { "id": "micro-behaviors/process/create/flags::chromium-no-first-run-flag", "conf": 0.9, "crit": 3, "desc": "Chromium --no-first-run launch flag", "from": [ { "file": 1728 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::ftp-port-21", "conf": 0.6, "crit": 3, "desc": "FTP service port number", "from": [ { "file": 1426 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-ordinal-api-set", "conf": 0.9, "crit": 3, "desc": "Winsock client ordinal connect send recv set", "from": [ { "file": 379 }, { "off": 14376, "file": 401 }, { "off": 20872, "file": 402 }, { "off": 59444, "file": 404 }, { "off": 2245408, "file": 450 }, { "off": 3380392, "file": 451 }, { "off": 2303440, "file": 459 }, { "off": 1625500, "file": 462 } ], "uses": [ 273, 439, 469, 857 ] }, { "id": "metadata/file/string/identity::android-system-runtime-path", "conf": 0.9, "crit": 3, "desc": "Android system runtime path", "from": [ { "file": 2100 } ] }, { "id": "objectives/evasion/anti-av/code-padding::small-code-section-in-large-pe", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Small code section in large PE", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/crypto/symmetric/stream/chacha::salsa20-stream-cipher-call", "conf": 0.9, "crit": 3, "desc": "Salsa20 stream-cipher call", "from": [ { "file": 1944 } ] }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry value write API", "from": [ { "file": 379 }, { "file": 459 } ], "uses": [ 894 ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::windows-hook-chain-api-cluster", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.96, "crit": 3, "desc": "Windows event-hook lifecycle API cluster", "from": [ { "file": 379 }, { "off": 1261890, "file": 463 } ], "uses": [ 586, 904, 945 ] }, { "id": "micro-behaviors/crypto/library/provider::openssl-evp-pkey-api-reference", "conf": 0.8, "crit": 3, "desc": "OpenSSL EVP_PKEY key-management API reference", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "from": [ { "file": 2215 } ] }, { "id": "micro-behaviors/communications/http/services/google::google-api-host-reference", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "References a Google API host", "from": [ { "file": 1502 } ] }, { "id": "objectives/credential-access/credential-manager/store-api::cert-find-cert-in-store", "atk": "T1552.004", "conf": 0.9, "crit": 3, "desc": "CertFindCertificateInStore symbol", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Query computer/host name", "from": [ { "file": 28 } ] }, { "id": "metadata/import/python/builtins/object::object", "conf": 0.95, "crit": 2, "desc": "imports object from builtins" }, { "id": "micro-behaviors/fs/path/construct::script-dirname-ref", "conf": 0.6, "crit": 3, "desc": "References script directory path", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::get-keyboard-layout-str", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.8, "crit": 3, "desc": "GetKeyboardLayout P/Invoke string reference", "from": [ { "file": 87 } ] }, { "id": "metadata/import/npm/net::net", "conf": 0.95, "crit": 3, "desc": "imports net", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "atk": "T1112", "conf": 0.85, "crit": 2, "desc": "Set registry value via WinAPI", "from": [ { "file": 83 } ] }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-70", "conf": 0.85, "crit": 3, "desc": "Binary overall entropy at least 7.0", "from": [ { "file": 1 } ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 795, 931 ] }, { "id": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "conf": 0.88, "crit": 3, "desc": "Configure waitable timer", "from": [ { "file": 56 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::module32-next-string", "conf": 0.8, "crit": 3, "desc": "Module32Next API string", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/os/exception/register::rtl-add-function-table", "atk": "T1006", "conf": 0.95, "crit": 3, "desc": "Register exception handling function table" }, { "id": "metadata/binary/symbols/imports::four-low-ordinal-imports", "conf": 0.86, "crit": 3, "desc": "PE imports four or more low ordinals by number", "from": [ { "file": 28 } ], "uses": [ 70, 94, 161, 188, 360, 370, 410, 615, 713 ] }, { "id": "micro-behaviors/process/create/exec::node-child-process-capability", "conf": 0.8, "crit": 3, "desc": "Imports or invokes Node.js child-process APIs", "from": [ { "off": 19, "file": 2587, "line": 1 } ], "uses": [ 120, 184 ] }, { "id": "micro-behaviors/fs/file/stat::is-file-identifier", "conf": 0.92, "crit": 3, "desc": "File-type flag or predicate named is_file", "from": [ { "file": 83 } ] }, { "id": "objectives/command-and-control/remote-command/keywords::file-op-delete-verb", "conf": 0.2, "crit": 3, "desc": "DELETE file-operation verb", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/hook::set-windows-hook-text", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.84, "crit": 3, "desc": "SetWindowsHookEx API string", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/info/commandline::get-command-line", "conf": 0.82, "crit": 2, "desc": "Query current process command line" }, { "id": "micro-behaviors/os/clipboard/write::set-clipboard-data", "conf": 0.8, "crit": 3, "desc": "Write data to clipboard", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/sync/mutex::create-mutex", "mbc": "C0042", "conf": 0.9, "crit": 3, "desc": "CreateMutex API call", "from": [ { "file": 56 } ] }, { "id": "micro-behaviors/process/debug/event::output-debug-string", "conf": 0.82, "crit": 3, "desc": "References the Windows debugger output API", "from": [ { "file": 38 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-drive-type", "atk": "T1083", "conf": 0.9, "crit": 2, "desc": "Query drive type by symbol" }, { "id": "metadata/signed/certificate/identity::pe-cert-shallow-chain", "conf": 1.0, "crit": 3, "desc": "Cert chain has only 2 entries" }, { "id": "third_party/elastic/Windows_VulnDriver_WinDivert/windows/vulndriver_windivert", "conf": 0.9, "crit": 5, "desc": "Detects Windows.VulnDriver.WinDivert" }, { "id": "micro-behaviors/os/exception/register::rtl-delete-function-table", "conf": 0.95, "crit": 3, "desc": "Unregister exception function table" }, { "id": "micro-behaviors/data/embedded/payload/compression::zstd-magic", "atk": "T1027.009", "mbc": "F0001.006", "conf": 0.7, "crit": 3, "desc": "Embedded ZSTD compressed data", "from": [ { "file": 35 } ] }, { "id": "metadata/signed/trust-level::unsigned-pe-executable", "conf": 0.8, "crit": 3, "desc": "PE executable is unsigned" }, { "id": "micro-behaviors/fs/path/secret-config::netrc", "atk": "T1552.001", "conf": 0.95, "crit": 3, "desc": ".netrc credentials file", "from": [ { "file": 1914 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::get-thread-context-text", "atk": "T1005", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "GetThreadContext dynamic API string", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/crypto/symmetric/xor/lodsb::asm-loop-dup", "conf": 1.0, "crit": 3, "desc": "Assembly LOOP target mnemonic", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/ui/window/visibility::sw-hide-token", "conf": 0.9, "crit": 3, "desc": "SW_HIDE window flag reference", "from": [ { "file": 83 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "from": [ { "file": 2591 } ], "uses": [ 809 ] }, { "id": "metadata/binary/symbols/exports::com-export-pair", "conf": 0.95, "crit": 3, "desc": "DLL exports the COM unload and class-factory pair", "from": [ { "file": 379 }, { "off": 54272, "file": 396 } ], "uses": [ 719, 833 ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/firewall/wfp::fwpm-filter-add", "atk": "T1562.004", "conf": 0.93, "crit": 3, "desc": "Install Windows Filtering Platform filter", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-decrypt", "conf": 0.9, "crit": 3, "desc": "Decrypt buffer with CryptoAPI", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/communications/socket/options::sockopt-constant-names", "conf": 0.9, "crit": 2, "desc": "Many SO_ socket option constant names", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/url/path::loopback-http-target", "conf": 0.9, "crit": 3, "desc": "HTTP request targets loopback address", "from": [ { "file": 2591 } ], "uses": [ 179, 585 ] }, { "id": "micro-behaviors/fs/read/file/handle::fgets-api-import", "conf": 0.8, "crit": 2, "desc": "Imports C fgets line-input API", "from": [ { "file": 30 } ] }, { "id": "metadata/package/files/included::npm-publish-root-manifest", "conf": 0.95, "crit": 2, "desc": "Manifest sits at npm publish root", "from": [ { "file": 2213 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha512", "conf": 0.95, "crit": 3, "desc": "SHA512 hashing functions", "from": [ { "file": 23 } ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "micro-behaviors/fs/temp/pyinstaller::meipass-runtime-dir", "conf": 0.96, "crit": 3, "desc": "PyInstaller MEIPASS runtime directory", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.9, "crit": 3, "desc": "Microsoft certificate-chain identity marker" }, { "id": "micro-behaviors/fs/path/temp::tmp-zip-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory ZIP path reference", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/communications/socket/raw::ipproto-raw-constant", "mbc": "C0001", "conf": 0.75, "crit": 3, "desc": "IPPROTO_RAW constant name", "from": [ { "file": 28 } ] }, { "id": "objectives/credential-access/credential-manager/store-api::cert-duplicate-marker", "atk": "T1552.004", "conf": 0.9, "crit": 3, "desc": "CertDuplicateCertificateContext symbol", "from": [ { "file": 74 } ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-encrypt", "conf": 0.6, "crit": 3, "desc": "RSA_public_encrypt reference", "from": [ { "file": 75 } ] }, { "id": "metadata/package/config::get-env-var", "conf": 0.6, "crit": 3, "desc": "GetEnvironmentVariable method", "from": [ { "file": 33 } ] }, { "id": "metadata/signed/leaf::ars-nova-systems", "conf": 1.0, "crit": 3, "desc": "Signed by Ars Nova Systems", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/ui/window/probe::message-box-a", "conf": 0.9, "crit": 2, "desc": "MessageBoxA dialog API reference", "from": [ { "file": 88 } ] }, { "id": "metadata/binary/layout/overlay::large-overlay-1mb", "conf": 0.96, "crit": 3, "desc": "Overlay size at least 1 MiB", "from": [ { "file": 3 } ] }, { "id": "objectives/supply-chain/trojanized/app/bytecode::pyc-environment-enumeration", "atk": "T1059.006,T1082", "conf": 0.95, "crit": 3, "desc": "Python bytecode contains environ name", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/link/reparse::create-symbolic-link-directory-api", "conf": 0.9, "crit": 3, "desc": "Creates a Windows symbolic link" }, { "id": "micro-behaviors/hardware/input/keyboard/hook::call-next-hook-ex-text", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.84, "crit": 3, "desc": "CallNextHookEx API string", "from": [ { "file": 87 } ] }, { "id": "well-known/lib/ui/tcl-tk::tcl-tk-runtime-basename", "conf": 0.9, "crit": 3, "desc": "Tcl/Tk Windows runtime DLL", "from": [ { "file": 86 } ] }, { "id": "micro-behaviors/os/random/crypto::srand-symbol", "conf": 0.4, "crit": 2, "desc": "Random seed initialization (srand)" }, { "id": "micro-behaviors/communications/http/cookies::ascii-cookie-header-binary", "conf": 0.75, "crit": 3, "desc": "Cookie header-form string in binary", "from": [ { "file": 1448 } ] }, { "id": "micro-behaviors/fs/path/check::get-module-filename", "conf": 0.85, "crit": 2, "desc": "Query current module path", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/socket/ssl::tls-server-private-key", "conf": 0.92, "crit": 3, "desc": "TLS server private key material", "from": [ { "file": 379 }, { "off": 55016, "file": 406 }, { "file": 453 } ], "uses": [ 730 ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-decrypt", "conf": 0.6, "crit": 3, "desc": "RSA_public_decrypt reference", "from": [ { "file": 75 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 1 } ] }, { "id": "metadata/signed/unknown::ars-nova-systems", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Ars Nova Systems", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/data/compress/bzip2::bzip2-string", "conf": 0.8, "crit": 1, "desc": "bzip2 string", "from": [ { "file": 18 } ] }, { "id": "metadata/import/package::dep-eslint", "conf": 0.9, "crit": 3, "desc": "Depends on ESLint", "from": [ { "file": 2213 } ] }, { "id": "metadata/import/npm/path::path", "conf": 0.95, "crit": 2, "desc": "imports path", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-volume-info", "conf": 0.9, "crit": 3, "desc": "Windows volume-information API name reference", "from": [ { "file": 40 } ] }, { "id": "well-known/lib/runtime/compiled/msvc-runtime::microsoft-visual-cpp-runtime", "conf": 0.99, "crit": 3, "desc": "Microsoft Visual C++ runtime library", "from": [ { "file": 14 } ], "uses": [ 219, 245, 429 ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::pipe-access-duplex", "atk": "T1559", "conf": 0.6, "crit": 3, "desc": "PIPE_ACCESS_DUPLEX mode", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-startup-ordinal", "conf": 0.86, "crit": 3, "desc": "Initialize Winsock library", "from": [ { "file": 28 } ], "uses": [ 64, 521 ] }, { "id": "micro-behaviors/ui/help::usage-title", "conf": 0.5, "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 80 } ] }, { "id": "objectives/impact/ransom/encrypt/cli::partial-encryption-speed-flags", "atk": "T1486", "conf": 0.85, "crit": 3, "desc": "Fast-mode CLI flag", "from": [ { "file": 1512 } ] }, { "id": "micro-behaviors/fs/path/construct::search-path-api", "conf": 0.9, "crit": 3, "desc": "Search executable path via Windows API" }, { "id": "well-known/lib/stdlib/python-stdlib::zipimport-module-bytecode", "conf": 0.97, "crit": 3, "desc": "Compiled zipimport standard library module" }, { "id": "micro-behaviors/communications/socket/connect::net-create-connection-call", "conf": 0.88, "crit": 3, "desc": "Node net.createConnection call", "from": [ { "file": 2211 } ] }, { "id": "micro-behaviors/fs/file/stat::get-file-size", "conf": 0.65, "crit": 2, "desc": "Get file size" }, { "id": "micro-behaviors/fs/traversal/drives::logical-drive-type-enumeration", "atk": "T1083", "conf": 0.92, "crit": 3, "desc": "Enumerates logical drives and queries drive types", "from": [ { "file": 379 }, { "off": 3977, "file": 416 }, { "file": 462 }, { "off": 969258, "file": 464 } ], "uses": [ 110, 909 ] }, { "id": "metadata/signed/certificate/identity::pe-whql-hardware-compat-nested", "conf": 0.95, "crit": 3, "desc": "Nested Microsoft WHQL hardware attestation" }, { "id": "micro-behaviors/data/db/sqlite::sqlite3-open", "conf": 0.9, "crit": 3, "desc": "References the SQLite sqlite3_open routine", "from": [ { "file": 29 } ] }, { "id": "micro-behaviors/os/firewall/wfp::fwpm-sublayer-add", "atk": "T1562.004", "conf": 0.9, "crit": 3, "desc": "Add Windows Filtering Platform sublayer", "from": [ { "file": 264 } ] }, { "id": "metadata/binary/installer/sfx::wextract-cabinet-directive", "conf": 0.98, "crit": 3, "desc": "Wextract Cabinet directive marker", "from": [ { "file": 89 } ] }, { "id": "metadata/file/line::file-has-30-plus-lines", "conf": 0.9, "crit": 2, "desc": "File has 30 or more lines" }, { "id": "micro-behaviors/os/env/read::get-environment-variable", "conf": 0.85, "crit": 3, "desc": "Read a process env var (GetEnvironmentVariable)", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer", "conf": 0.9, "crit": 2, "desc": "Set file position" }, { "id": "micro-behaviors/process/fd/stdio::py-stderr-stdout", "conf": 0.6, "crit": 3, "desc": "stderr=STDOUT pipe argument (Python)", "from": [ { "file": 2100 } ] }, { "id": "micro-behaviors/communications/http/user-agent::bot-user-agent-list--rx-2", "conf": 0.85, "crit": 3, "desc": "Search-engine crawler User-Agent marker", "from": [ { "file": 2160 } ] }, { "id": "metadata/build/archive::archive-member-over-10mb", "conf": 0.95, "crit": 3, "desc": "Archive has member larger than 10 MB" }, { "id": "metadata/build/archive::archive-windows-executable-entry", "conf": 0.86, "crit": 3, "desc": "Windows executable archive member" }, { "id": "metadata/build/archive::archive-windows-library-entry", "conf": 0.86, "crit": 1, "desc": "Windows DLL archive member" }, { "id": "metadata/file/format/markup::archive-member-postscript-extension", "conf": 0.95, "crit": 3, "desc": "Archive member has PostScript/EPS extension" }, { "id": "metadata/package/files/archive-member::archive-css-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a stylesheet" }, { "id": "metadata/package/files/archive-member::archive-html-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an HTML document" }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/package/files/archive-member::archive-nested-zip-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a nested ZIP" }, { "id": "metadata/package/files/archive-member::archive-svg-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an SVG document" }, { "id": "metadata/package/testing/presence/path::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" }, { "id": "well-known/malware/virus/archive-label::av-dos-classic-member", "conf": 0.94, "crit": 3, "desc": "Classic DOS virus family member name" }, { "id": "micro-behaviors/data/compress/bzip2::bzip2-comp", "conf": 0.9, "crit": 3, "desc": "Bzip2 compression library", "from": [ { "file": 379 }, { "file": 394 }, { "off": 776, "file": 1620 }, { "off": 1525, "file": 1747 }, { "off": 22062, "file": 2463 }, { "off": 7332, "file": 2478 } ], "uses": [ 954 ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-import", "conf": 0.9, "crit": 3, "desc": "References the IsDebuggerPresent API", "from": [ { "file": 16 } ] }, { "id": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "atk": "T1070.006", "conf": 0.9, "crit": 3, "desc": "Export dir timestamp set to 0xFFFFFFFF", "from": [ { "file": 16 } ] }, { "id": "metadata/binary/provenance/version-info::pe-internal-name-unrelated-phrase", "conf": 0.85, "crit": 3, "desc": "InternalName is an unrelated phrase", "from": [ { "file": 16 } ], "uses": [ 93, 675 ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-a", "atk": "T1574.002", "conf": 0.95, "crit": 2, "desc": "Dynamic library loading via LoadLibraryA", "from": [ { "file": 19 } ] }, { "id": "objectives/impact/degrade/edr/terminate::process-termination-chain", "atk": "T1562.001", "conf": 0.8, "crit": 3, "desc": "Debugger check with dynamic loading and forced termination", "from": [ { "file": 19 } ], "uses": [ 403, 698, 993 ] }, { "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "atk": "T1027", "mbc": "B0032", "conf": 0.82, "crit": 3, "desc": "Packed loader largest section ratio above 0.65", "from": [ { "file": 21 } ] }, { "id": "well-known/malware/trojan/elex-technoinox::malformed-pe-stub-pair", "conf": 0.96, "crit": 3, "desc": "Elex malformed embedded PE stubs", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::connect-named-pipe", "atk": "T1559", "conf": 0.65, "crit": 3, "desc": "ConnectNamedPipe API call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-host-literal-binary", "conf": 0.85, "crit": 3, "desc": "Pinned external IPv4 host literal in binary", "from": [ { "file": 28 } ] }, { "id": "objectives/anti-analysis/timing/evasion::protect-cycling-rw-rx-multi", "atk": "T1497.003", "conf": 0.82, "crit": 3, "desc": "Many W^X protection constant cycles (RW-\u003eRX)", "from": [ { "file": 28 } ] }, { "id": "metadata/binary/section/ratio::pe-no-executable-sections", "conf": 0.95, "crit": 3, "desc": "PE has no executable sections", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "atk": "T1587.001", "conf": 0.9, "crit": 3, "desc": "VirtualAlloc API string reference", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect-text-pe", "conf": 0.9, "crit": 3, "desc": "Hidden VirtualProtect string reference", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/process/info/thread::resume-thread", "conf": 0.9, "crit": 3, "desc": "ResumeThread named, not imported", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process-name-text", "mbc": "C0018", "conf": 0.92, "crit": 3, "desc": "TerminateProcess API name in binary strings", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/event/log::event-log-write", "conf": 0.93, "crit": 3, "desc": "Windows event log writing", "from": [ { "file": 379 }, { "file": 450 }, { "file": 451 } ], "uses": [ 19, 475 ] }, { "id": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "conf": 0.85, "crit": 3, "desc": "Inline MZ header validation constant", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "conf": 0.8, "crit": 3, "desc": "In-code MZ/PE compare immediate", "from": [ { "file": 76 } ] }, { "id": "objectives/anti-static/obfuscation/imports::mz-magic-check", "atk": "T1027.007", "mbc": "B0032.014", "conf": 0.85, "crit": 3, "desc": "Loads MZ header magic in code", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::create-named-pipe", "atk": "T1559", "conf": 0.7, "crit": 3, "desc": "CreateNamedPipe API call", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-first", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32First API name", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-next", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32Next API name", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::named-pipe-server", "atk": "T1559", "conf": 0.8, "crit": 3, "desc": "Named pipe server creation", "from": [ { "file": 379 }, { "file": 402 }, { "off": 2303024, "file": 459 } ], "uses": [ 997, 1009 ] }, { "id": "objectives/anti-analysis/sandbox-detect/tool-references::hardware-fingerprint-cluster", "atk": "T1497.001", "mbc": "B0007", "conf": 0.85, "crit": 2, "desc": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "from": [ { "file": 83 } ], "uses": [ 533, 600, 737 ] }, { "id": "metadata/binary/provenance/version-info::pe-non-architecture-filename-mismatch", "conf": 0.9, "crit": 3, "desc": "PE filename conflicts with OriginalFilename", "from": [ { "file": 86 } ] }, { "id": "objectives/discovery/system/fingerprint/info::win32-system-profiling", "atk": "T1082", "conf": 0.85, "crit": 3, "desc": "Win32 host profiling via multiple APIs", "from": [ { "file": 86 } ], "uses": [ 73, 166, 213, 316, 506, 737, 889, 957 ] }, { "id": "micro-behaviors/process/debug/detect::resource-debugger-import-cluster", "conf": 0.96, "crit": 3, "desc": "Resource and debugger API import cluster", "from": [ { "file": 87 } ], "uses": [ 143, 544, 762, 989 ] }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member", "from": [ { "file": 92 } ] }, { "id": "metadata/binary/resource/size::small-pe-no-resources", "conf": 0.82, "crit": 3, "desc": "Small PE lacks resource section", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/control::control-service", "atk": "T1543.003", "conf": 0.86, "crit": 3, "desc": "Send service control code", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/control::open-sc-manager", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Open service control manager", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/control::open-service", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Open existing service handle", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/create::create-service", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Create Windows service", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/delete::delete-service", "atk": "T1543.003", "conf": 0.84, "crit": 3, "desc": "DeleteService API import", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/start::start-service", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Start Windows service", "from": [ { "file": 263 } ] }, { "id": "micro-behaviors/os/service/control::service-admin-import-cluster", "atk": "T1543.003", "conf": 0.95, "crit": 3, "desc": "Windows service admin import cluster", "from": [ { "file": 379 }, { "file": 639 }, { "file": 641 } ], "uses": [ 1020, 1021, 1022, 1024 ] }, { "id": "micro-behaviors/os/service/create::service-create-open-import-pair", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Windows service create/open API import pair", "from": [ { "file": 379 }, { "file": 639 }, { "file": 641 } ], "uses": [ 1021, 1022 ] }, { "id": "micro-behaviors/os/service/stop::service-stop-control", "atk": "T1543.003", "conf": 0.92, "crit": 3, "desc": "Open and control or delete service API chain", "from": [ { "file": 379 }, { "file": 639 }, { "off": 4136, "file": 641 } ], "uses": [ 1019, 1020, 1021, 1023 ] }, { "id": "micro-behaviors/data/format/crypto-address::hardcoded-btc-addr", "conf": 0.7, "crit": 3, "desc": "Hardcoded Bitcoin address", "from": [ { "file": 264 } ] }, { "id": "micro-behaviors/fs/path/extension::exe-name-or-extension", "conf": 0.5, "crit": 2, "desc": "References a Windows .exe filename or extension", "from": [ { "file": 264 } ] }, { "id": "metadata/file/naming::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "from": [ { "file": 270 } ] }, { "id": "micro-behaviors/process/create/local-exec::shell-variable-exec-with-args", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "Shell runs a variable command with args", "from": [ { "file": 272 } ] }, { "id": "metadata/file/extension/encrypted::ext-enc", "conf": 0.6, "crit": 3, "desc": "Basename uses the .enc encrypted extension", "from": [ { "file": 306 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::http-port-80", "conf": 0.6, "crit": 3, "desc": "HTTP service port number", "from": [ { "file": 353 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::ciphertext-key-vocabulary", "conf": 0.8, "crit": 3, "desc": "Uses ciphertext, shared-secret, or trailer terms", "from": [ { "file": 1308 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::bind-all-interfaces", "conf": 0.8, "crit": 3, "desc": "Binds or listens on all interfaces (0.0.0.0)", "from": [ { "file": 1408 } ] }, { "id": "micro-behaviors/communications/http/form::multipart-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "multipart/form-data content type", "from": [ { "file": 1413 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-auth", "atk": "T1071.002", "mbc": "C0004", "conf": 0.7, "crit": 3, "desc": "FTP authentication command token", "from": [ { "file": 1426 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-listing", "atk": "T1071.002", "mbc": "C0004", "conf": 0.7, "crit": 3, "desc": "FTP listing/navigation command token", "from": [ { "file": 1426 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-cmd-transfer", "atk": "T1071.002", "mbc": "C0004", "conf": 0.7, "crit": 3, "desc": "FTP upload command token", "from": [ { "file": 1426 } ] }, { "id": "micro-behaviors/communications/ftp/control::ftp-protocol-support", "atk": "T1071.002", "mbc": "C0004", "conf": 0.85, "crit": 3, "desc": "FTP control-channel command support", "from": [ { "file": 379 }, { "off": 12216, "file": 1802 }, { "off": 15108, "file": 2291 } ], "uses": [ 1038, 1039, 1040 ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "from": [ { "file": 379 }, { "off": 8790, "file": 2297 } ], "uses": [ 30 ] }, { "id": "micro-behaviors/os/clipboard/read::get-clipboard-data-text", "conf": 0.76, "crit": 3, "desc": "GetClipboardData named, not imported", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/os/clipboard/reference::close-clipboard-text", "conf": 0.7, "crit": 3, "desc": "CloseClipboard named, not imported", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/os/clipboard/reference::open-clipboard-text", "conf": 0.74, "crit": 3, "desc": "OpenClipboard named, not imported", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/os/clipboard/write::empty-clipboard-text", "conf": 0.74, "crit": 3, "desc": "EmptyClipboard named, not imported", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/os/clipboard/write::set-clipboard-data-text", "conf": 0.78, "crit": 3, "desc": "SetClipboardData named, not imported", "from": [ { "file": 2050 } ] }, { "id": "micro-behaviors/os/clipboard/reference::win32-clipboard-access", "conf": 0.82, "crit": 3, "desc": "Win32 clipboard access", "from": [ { "file": 379 }, { "off": 13862, "file": 2426 } ], "uses": [ 1043, 1045, 1046, 1047 ] }, { "id": "micro-behaviors/communications/http/websocket::ws-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an unencrypted ws:// WebSocket URL", "from": [ { "file": 2155 } ] }, { "id": "micro-behaviors/communications/http/websocket::wss-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an encrypted wss:// WebSocket URL", "from": [ { "file": 2155 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443-protocol", "conf": 0.6, "crit": 3, "desc": "References HTTPS service port 443", "from": [ { "file": 2155 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::https-port-443", "conf": 0.6, "crit": 1, "desc": "HTTPS service port number", "from": [ { "file": 379 }, { "off": 48858, "file": 2531 } ], "uses": [ 1051 ] }, { "id": "micro-behaviors/communications/ip/endpoint::common-service-port", "conf": 0.6, "crit": 3, "desc": "Common service port number", "from": [ { "file": 379 }, { "file": 2531 } ], "uses": [ 1052 ] } ] } ] } }