{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0016859969, "rte": "az", "prob": 0.0016859969 } ], "prob": 0.005354921, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.005354920867830515, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.005354920867830515, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:40:52Z" }, "path": "iproute2-minimal-7.1.0-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₃(CoDy₃Er₂)H₆(Cm₁₀CrDsF₇Os₅Po₃)", "sha": "7119eba29620ae427e1fedf077464a30e950209fee16ac4616b18f44a30ad189", "path": "iproute2-minimal-7.1.0-r0.apk", "risk": 21, "size": 277655, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 277655.0, "entropy": 8.0, "size_bytes": 277655.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 275456.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::getpwnam", "atk": "T1033", "mbc": "E1033", "conf": 0.4000000059604645, "crit": 2, "desc": "Resolve username to password entry", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/group/lookup::getgrnam", "conf": 0.800000011920929, "crit": 3, "desc": "Resolve group name to GID (getgrnam)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "objectives/exfiltration/dns/tunnel::tun-device", "atk": "T1071.004", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "TUN device access for tunneling", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.699999988079071, "crit": 2, "desc": "Short -h help flag", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/system/fingerprint/user::user-info", "atk": "T1033", "conf": 0.699999988079071, "crit": 3, "desc": "User information fingerprinting", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/bpf/trace-frameworks::libbpf", "conf": 0.8500000238418579, "crit": 3, "desc": "libbpf library", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/fileless/staging::proc-self-fd", "conf": 0.699999988079071, "crit": 3, "desc": "Access /proc/self/fd for file descriptor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "off": 433572, "file": 1 } ] }, { "id": "micro-behaviors/communications/profinet::keyword", "conf": 0.8500000238418579, "crit": 3, "desc": "PROFINET protocol keyword reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.8999999761581421, "crit": 2, "desc": "dlsym function symbol", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/process/attribute::pid-template-fd", "atk": "T1057", "mbc": "E1057", "conf": 0.699999988079071, "crit": 3, "desc": "/proc/%s/fd path template", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve address with gethostbyaddr", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 2, "desc": "Get password file entry by UID", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/degrade/firewall::firewall-tool-check", "crit": 3, "desc": "checking for firewall tool availability", "from": [ { "off": 484781, "file": 1 } ] }, { "id": "objectives/discovery/process/attribute::pid-template-comm", "atk": "T1057", "mbc": "E1057", "conf": 0.699999988079071, "crit": 3, "desc": "/proc/%s/comm path template", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/volume/umount::umount2-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Unmount file system", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/hcom::readelf-invocation", "conf": 0.800000011920929, "crit": 3, "desc": "Invokes readelf", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse active mounts from /proc/mounts", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-underscore", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1", "conf": 0.949999988079071, "crit": 3, "desc": "SHA1 hashing functions", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/os/group/lookup::getgrgid", "conf": 0.800000011920929, "crit": 3, "desc": "Resolve GID to group name (getgrgid)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-init", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.8999999761581421, "crit": 3, "desc": "Dynamic library loading via dlopen", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.8500000238418579, "crit": 3, "desc": "Core dlopen/dlsym pattern", "from": [ { "off": 24993, "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/fileless/memory::proc-self-fd-format", "conf": 0.8999999761581421, "crit": 3, "desc": "proc self fd format string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/firewall/iptables::ip6tables", "conf": 0.8999999761581421, "crit": 3, "desc": "ip6tables command", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-add-watch", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/network::network-dev", "conf": 0.6600000262260437, "crit": 3, "desc": "Read network device statistics from", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::ip-link", "conf": 0.8999999761581421, "crit": 3, "desc": "ip link command", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/privilege/paths::sys-kernel-debug", "conf": 0.8999999761581421, "crit": 3, "desc": "/sys/kernel/debug/ debugfs access", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::tunsetiff-ioctl", "atk": "T1090", "conf": 0.6000000238418579, "crit": 3, "desc": "TUN/TAP virtual NIC setup ioctl", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "from": [ { "file": 1 } ] }, { "id": "objectives/collection/network/ssl-intercept::tracing-frameworks", "conf": 0.8500000238418579, "crit": 3, "desc": "eBPF tracing frameworks", "from": [ { "off": 28157, "file": 1 } ] }, { "id": "objectives/discovery/network/enumeration::ip-route-show", "atk": "T1016", "conf": 0.75, "crit": 3, "desc": "ip route network discovery", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr912b.C300000kMy=:00000p*jka0000000000kMA+z4feS[8#{]T1][S61on", "n": [ { "c": 2, "d": "ELF program interpreter metadata", "i": "metadata/binary/linking/runtime::interpreter", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "0000000Ju500000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 24411, "z": 12, "cf": 0.8999999761581421 } ], "ln": 24395 }, { "b": "A@Zo6A:@%90bVdXy\u0026r!-x(^Z8BA)\u003ecByY960a{m.vpPvBuVQr$v@2BYxLQ%!vqfJTxjVf@zGV23BAg(1B7F\u0026#z#:%3A=LV6ASxJ\u0026z!Ph\u003cB-.bbvr8u?BAhhezuao^zddJ@xAi9(v@2T$0crm5v@MX[uTEw+A=b/5y\u0026r/(BzkVh0crm5wPz*f", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 24596, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 24665, "z": 6, "cf": 0.75 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 24588, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 24611, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 24575, "z": 6, "cf": 0.5 } ], "ln": 24559 }, { "b": "zdNM]zeYF@zG6SgzGGE\u003cxMOfgA@Z91z!J}!AaK6gz/L\u00260ByYrjBo2]+y\u0026%/j0bcE)zFPq]BAhneAcRB}B97\u0026j0b(*/zE^E40chTVwmPy{0aP?-B7F(@ASyl0z/]@tg5#Dmy?W^50bVHZx(Th{wPR*h0bls?BzkujuUKy(Bo32)z//Y9D0:#\u003cwm6K?ByO$:B98Csv@MX[B98CAz/]\u003c@B98CjxMs8]B7nS@w=MBVz!0L.B-8nlvrb]Vw]}Q2yYF6*wO2SSB98CzwPdS-zE)]%zGG/o0a{g)ByLq-wPS3dzdNS$wmo--y\u0026r/(y\u0026\u003cxdwDl^[A+oAczdJYVz/xo90a]\u003ePBAmB]v@c78wDlQ\u0026z!Kg(wnDg6wO}GUy\u0026:(s0b2\u003e+Ab](sz^[0fB.$P0ASyf5A==ko0b2\u003e+AcDhdz2!iWBz2SivqM0=BAhhcvrqGZwPR)nB.Lv^xjVf$A+x8%0b3a^vGp4LBz$@80chTVwnC%$yxd^:Ab]VgBy\u003eI+wP8eXw]?D\u003czE@(XwPz*fASx-*z^)s0wN$\u003c.BAhnezeYF/wPR)iz/+", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 24807, "z": 6, "cf": 0.9200000166893005 }, { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 24968, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Converts host to network long", "i": "micro-behaviors/communications/ip/parse::htonl-symbol", "o": 24754, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 24721, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Parse IP with inet_ntop", "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "o": 24920, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host long", "i": "micro-behaviors/communications/ip/parse::ntohl-symbol", "o": 24727, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 24987, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Dynamic library loading via dlopen", "i": "micro-behaviors/dylib/load/runtime::dlopen", "o": 24993, "z": 6, "cf": 0.8999999761581421 }, { "c": 3, "d": "Core dlopen/dlsym pattern", "i": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "o": 25000, "z": 5, "cf": 0.8500000238418579 }, { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 24907, "z": 5, "cf": 0.699999988079071 }, { "c": 3, "d": "Read file status and metadata", "i": "micro-behaviors/fs/file/stat::stat", "o": 24768, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "Unmount file system", "i": "micro-behaviors/fs/volume/umount::umount2-fn", "o": 24799, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Monitor filesystem events via inotify", "i": "micro-behaviors/fs/watch/inotify::inotify-add-watch", "o": 24839, "z": 17, "cf": 0.6600000262260437 }, { "c": 3, "d": "Monitor filesystem events via inotify", "i": "micro-behaviors/fs/watch/inotify::inotify-init", "o": 24826, "z": 12, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve GID to group name (getgrgid)", "i": "micro-behaviors/os/group/lookup::getgrgid", "o": 25065, "z": 8, "cf": 0.800000011920929 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 25056, "z": 8, "cf": 0.4000000059604645 }, { "c": 3, "d": "Enumerate account names from IDs", "i": "objectives/discovery/account/lookup::account-name-resolution", "o": 25039, "z": 8, "cf": 0.8500000238418579 }, { "c": 3, "d": "User information fingerprinting", "i": "objectives/discovery/system/fingerprint/user::user-info", "o": 25030, "z": 8, "cf": 0.699999988079071 }, { "c": 2, "d": "Create directories", "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "o": 24814, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 24790, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 24774, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 24782, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Formatted input from file", "i": "micro-behaviors/fs/file/read::fscanf", "o": 25109, "z": 6, "cf": 0.699999988079071 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 24930, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Read symbolic link target path", "i": "micro-behaviors/fs/link/symlink::readlink", "o": 25086, "z": 8, "cf": 0.800000011920929 }, { "c": 2, "d": "Apply or remove advisory lock", "i": "micro-behaviors/fs/lock/flock::flock-fn", "o": 24887, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 24974, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 25079, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Get current time with microsecond precision", "i": "micro-behaviors/time/query::gettimeofday", "o": 24936, "z": 12, "cf": 0.30000001192092896 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 24950, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 24959, "z": 8, "cf": 0.20000000298023224 } ], "ln": 24705 }, { "b": "ASyf5A=Vty0aPCNy\u0026r!-y\u0026:YbBo3x7A:@K10b2\u003e+Aa9*e0chTVy\u00261310af8wB8$]kByeS*x(0=?B8M8v0crm5woz?\u003eB98CAz!n#\u003cBAhFwwb{W)A=.", "n": [ { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 25202, "z": 7, "cf": 0.6000000238418579 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 25220, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 25189, "z": 5, "cf": 0.800000011920929 } ], "ln": 25173 }, { "b": "B98CAz!%j\u0026B98Cuy?mF:B9R?pz/fd!vrk}2x(dzYxjVgcx\u003ediRwPRHax\u003ediNvq]N^wPRo#A=kB/v{%s-xjVf(w]7)*0aPCRuT)[-vr8uTvq]N{wPRo#A=kB/v{%s-w].D]0a{m.z/xo90b2\u003e+y?W=#0crm5B8V0%B98CjB8V0%x(mH7uVpa9zua-?BzbPlBy/ui0b2\u003e+xM4%lvThx)wo4V:w)Ym\u0026wmZ1cz/f02wDlBRuV6p?wPR\u003c8zE^s60ax$XCXIm1B7]n}v@#B6zua:1vrua50crB5y?W^50ch{!x(Th{wO#3}B7UF[wN/[2B7UF[wN/(-B97\u0026jC4L^}C4LYlx(n380a]}YwO#z^B98CjxMw0kyYE%-zF\u003c2}Bo2=:zE--*D2)F7y?%8-z/PQ[CvticAa@?.uUaE@Bo2(%wN/[50b=jZwNxK$uUA\u003e=wnC*:vrqG/AaJ]]vThr]vqYQ(wNw\u003e/0a{B}x()[^B7GDmz!0N3Ac87)wPS0iv@2%\u003czdJY*wPR%ex(dNa0bVNYz#:-$zF-*30aGwTwO${[wDlsPwPRzZwO+%=wO#2UwO+%=xjVf}", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 25404, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve address with gethostbyaddr", "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "o": 25425, "z": 13, "cf": 0.6600000262260437 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 25570, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 25439, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Looks up index with if_nametoindex", "i": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "o": 25454, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 25652, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recv socket call", "i": "micro-behaviors/communications/socket/receive::recv-symbol", "o": 25523, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 25515, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 25507, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 25562, "z": 7, "cf": 0.75 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 25602, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "freopen stream redirection import", "i": "micro-behaviors/process/fd/stdio::freopen-import", "o": 25373, "z": 7, "cf": 0.699999988079071 }, { "c": 2, "d": "Remove directories", "i": "micro-behaviors/fs/directory/rmdir::rmdir-base", "o": 25501, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 25645, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Create symbolic links", "i": "micro-behaviors/fs/link/symlink::symlink", "o": 25493, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Maps files or devices into memory", "i": "micro-behaviors/fs/memory/mmap::mmap", "o": 25685, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Unmap files from memory", "i": "micro-behaviors/fs/memory/mmap::munmap", "o": 25690, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Get effective user ID", "i": "micro-behaviors/os/privilege/query::geteuid", "o": 25307, "z": 7, "cf": 0.5 }, { "c": 2, "d": "Get user ID", "i": "micro-behaviors/os/privilege/query::getuid", "o": 25300, "z": 6, "cf": 0.5 }, { "c": 2, "d": "cap_get_proc function", "i": "micro-behaviors/os/security/capabilities::cap-get-proc", "o": 25315, "z": 12, "cf": 0.75 }, { "c": 2, "d": "cap_set_proc function", "i": "micro-behaviors/os/security/capabilities::cap-set-proc", "o": 25351, "z": 12, "cf": 0.75 }, { "c": 2, "d": "Install signal handler (POSIX sigaction)", "i": "micro-behaviors/os/signal/handler::sigaction", "o": 25476, "z": 9, "cf": 0.8999999761581421 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 25284, "z": 7, "cf": 0.4000000059604645 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 25588, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 25583, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Set resource limits for process", "i": "micro-behaviors/process/resources/limits::setrlimit", "o": 25675, "z": 9, "cf": 0.4000000059604645 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 25597, "z": 4, "cf": 0.4000000059604645 } ], "ln": 25268 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AyiarhCvbfex(n31w[+*)wb{v=z/f=avS8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 26034, "z": 6, "cf": 0.5 } ], "ln": 26018 }, { "b": "uU/ZOx(mD*v}P?2B-o9yzeTMmBo2]\u003eA=2lbuUBw0Byf4*z/xoduVQr$By!/?z!%uj00", "n": [ { "c": 3, "d": "Mount file systems", "i": "micro-behaviors/fs/volume/mount::mount-fn", "o": 26291, "z": 5, "cf": 0.6600000262260437 } ], "ln": 26275 }, { "b": "y\u0026r-)uT[1\u003ezeTp(xjVf(y?Wu/AaSE2wPz\u003caz/bL:AaSD@A=kO$wmY\u003c\u003ev}YjYwb{T(zFP", "n": [ { "c": 3, "d": "libbpf library", "i": "micro-behaviors/os/bpf/trace-frameworks::libbpf", "o": 28157, "z": 6, "cf": 0.8500000238418579 } ], "ln": 28141 }, { "b": "xM4l#wPq\u003c7B94z5Bz+]4B7Gl10b2\u003e+Aa@\u0026)z/bL@BAg-gz^M%(z!]zZzffc3x(mY[", "n": [ { "c": 3, "d": "Uses _send socket call", "i": "micro-behaviors/communications/socket/send::_send-symbol", "o": 30039, "z": 4, "cf": 0.6600000262260437 } ], "ln": 30023 }, { "b": "zE\u0026/XwO#71x\u003e7H?A=kC{z/xo90b=v\u0026wmY}9x(di[x(mY[B-.tl0b#%)zGGlbBAh8k", "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::open-base", "o": 32275, "z": 4, "cf": 0.6600000262260437 } ], "ln": 32259 }, { "b": "BzkK\u003exjVf(B2bMKxjVf(BzkP60cA9{uVp44uUKB*BzH}(B8L@uuUBMZx\u003ey^Xw)]K\u003c", "n": [ { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 32927, "z": 4, "cf": 0.30000001192092896 } ], "ln": 32911 }, { "b": "CXg#kuVP.0CWCz#A=U^(B7!#p0blyVy?W^5uU\u003cB$Bo2=*zE^9}y*?G#uU\u003cB]yHqja", "n": [ { "c": 3, "d": "SHA1 hashing functions", "i": "micro-behaviors/crypto/hash/digest::sha1", "o": 33118, "z": 4, "cf": 0.949999988079071 } ], "ln": 33102 }, { "b": "0@$(A-1lcUl0MYYl0?Es1R?1q555\u003ck^St?iZ-=nG-@TMM[54B(nS0dbry@5CnqW7br8(FC!L(F.O=", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 346842, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 346853, "z": 2, "cf": 0.699999988079071 } ], "ln": 346826 }, { "b": "00000000000000000000rDzOYwJy@FA3evcpF+1ZpFK?ht{8{fn\u003c#9DaBtj#pFBLHpdcjLaztt5A3fMoarR^HarR!vA3evceOn{wv}u=*at45hByO#bw[=6)zEEx[3u{e{A+cvopEmVxlStf?jS]7]vpS[?wPI]nD(#\u003cdwo8G{vR6u#D)03tBS=5OxK#10aBCqCy*!DlazC+5z6jiGy+*9KaBCqF", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 421888, "z": 128, "cf": 0.949999988079071 } ], "ln": 421872 }, { "b": "arR^HarR^HarR^HarR^HeOFvhzddrlA+eV\u0026vpB4:t{aIqeOO^aaBCp-yfL:$zE1v", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 422433, "z": 3, "cf": 0.699999988079071 } ], "ln": 422417 }, { "b": "azC.8Bt+m?az(7lB0b\u0026MvSDf[xjSikaz++fyAO3FD\u003cQ#sarR^HarR^HarR^HarR^HarQ", "n": [ { "c": 1, "d": "bridge interface", "i": "micro-behaviors/os/container/namespace::bridge-str", "o": 422536, "z": 6, "cf": 1.0 } ], "ln": 422520 }, { "b": "vLqCm07*0]oI4MTl}HnRrDzOYwJy@FA3fgtB-.gqDMWcsB95KLazbCjB7=XAax7Z5mmg3IqvjJ?arR^HazC^qA=l8xwGV55C4z^{mnccqr8ly0arR^HarR!vA3fgtB-.gqA+frlz/Py@arR^HarR!vA3fgtB-.gqB7/Gowoz:d3lQDlarR^Hx(Chnz/{ekazkncax]%^pGpv.uQ)K:uQ^ZPm]HKo", "n": [ { "c": 3, "d": "ip route network discovery", "i": "objectives/discovery/network/enumeration::ip-route-show", "o": 423150, "z": 13, "cf": 0.75 } ], "ln": 423031 }, { "b": "z/xo9aAzNwwPR:5zFGNVrDzOYwJy@FA3eO1wo8m5B0b*rwmQ6$xKL^\u003ewQFJfAbn@)wQLW)mNoBgqxPHYB%6vCpc?Pyax]%ZnK=cFnLIR@t).X%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HtoDpepdvYDk$rI2nMeOht).X%arR^HazC^qvpS[?wPI]n", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 426527, "z": 128, "cf": 0.949999988079071 } ], "ln": 426511 }, { "b": "08MM?o?wnJ08k:Tr7fW+q+PFTmf2.AlrcIQl%inJo?vXLk#*(Wo*}Dwk(:.SqDcN-oA", "n": [ { "c": 2, "d": "Slave keyword", "i": "objectives/command-and-control/botnet/keywords::slave-term", "o": 427925, "z": 5, "cf": 0.4000000059604645 } ], "ln": 427909 }, { "b": "wn=WfuVGZ^B8L}sjoc]PB8V5ow/$O%wN/H\u0026zF78gzu8jgB8V5ow/$O%wN/H\u0026zF78gw=", "n": [ { "c": 2, "d": "Generic 'spoof' term in strings", "i": "micro-behaviors/communications/ip/spoof::spoof-keyword", "o": 428609, "z": 5, "cf": 0.6499999761581421 } ], "ln": 428593 }, { "b": "x\u003ey^Xw]7)*A@Y/*vp%T7b}}90aolw3z//[uc37gearR^HarR!IvqGT*uU\u003cs@aolN[", "n": [ { "c": 2, "d": "Printf hex byte format", "i": "micro-behaviors/data/encode/payload::printf-hex-byte-format", "o": 430527, "z": 4, "cf": 0.6000000238418579 } ], "ln": 430511 }, { "b": "v{%l$vR3W6wPP5kzFTOvw]zYjnL\u003cN*ayO!\u003eA+frkwPFgUph+j%wO#Bexj@A4zF0!", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 431704, "z": 3, "cf": 0.800000011920929 } ], "ln": 431688 }, { "b": "B97\u0026oay/tbAa9\u003c5vR/P#CwhejaA87baAI4kx(Ffne^-ZzarR^HarR^}CYmFkv}*43C{4fEwN/B^C{4ixwGU@jwObU3az+Rbxlm/fc)-{/c1FCE", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 431833, "z": 4, "cf": 0.800000011920929 } ], "ln": 431817 }, { "b": "wft#cx(+zvvrcm1zF7NearR^HarR^Haxi2*B0bKywN/B.y-)g#xKM6#z/{7yx(+zk", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 431928, "z": 4, "cf": 0.800000011920929 } ], "ln": 431912 }, { "b": "CYW$mayPq6B.$YcBAm=?rDzOYwJy@FA3eO1wo8G{vR6u#DMV:cwfumxwmYN1EirGHwObU3aw+%8mOcY8toED/B%6gwrV\u003eV\u003ctoE-\u003cvR6u#oHh0loDWQFarR^HarR!vA3eO1wo8G{vR6u#toE-@B95KLazbCjB7=Xzaztt5A3eA[07gWwzddr)ar\u0026aMa%pPvaA.NqzF%-pefG4PC{1p", "n": [ { "c": 2, "d": "Benign POSIX fd redirect shell context", "i": "objectives/command-and-control/reverse-shell/dup::posix-fd-redirect-shell-benign-context", "o": 432371, "z": 119, "cf": 0.9399999976158142 } ], "ln": 432355 }, { "b": "BzbPi0bVW%v@IAZz^^F.rDzOYwJy@FA3fgzy?j-oayO!\u003eaBCqxwO-Gqax7Z5mmg3IqxOm)r7P\u003eX3lQDlarR^Hx(ChnB.\u003eRiDMV{pB-RjsD)0GsC4z!zaAz4mBz(hhaBKOtarR^HarUxqaAzQvwGUh1y?W%jax]%!mnccqr8lymu0N!omnccqr8lymiZ1P\u0026az#atayc9]azbUjz6hUMmmG\u003cJayc9]", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 433572, "z": 128, "cf": 0.5 } ], "ln": 433556 }, { "b": "B.(dxD(#f:o*RoDaybrOrDzOYwJyciA3f4fBz=dxy?W%j3jgA=az$+jzGu}ewmM/Tk$%=P32au3zE){cB0a[kBywV)awLi%miCz#l\u003c:lmA3f4fBz=dxB7GCopc?PyawLv8pe:.L3jgA=ax{Bay\u00260x1zE){cB0b18y?mZ1ax}Pbo*@s{32au3zE){cB0bgcwO#Q7w{CI6p!s5X3jgA=az$+jzGu}t", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 434421, "z": 128, "cf": 0.5 } ], "ln": 434405 }, { "b": "aAIHkv}/K?wN(bFflQ=AflhhMfk+uyzGt!BvqY$3BrCHvwO@SdwPScmA+=!nvqPN%Aa9l/iV[", "n": [ { "c": 1, "d": "Reference to /run", "i": "micro-behaviors/fs/path/system::system-run", "o": 434891, "z": 10, "cf": 0.6600000262260437 } ], "ln": 434875 }, { "b": "azbt7wGSfyB0rT/c36y[zeiV@AV=VHazb4@y?mcrash7o0cqZ[zGt!(zF%Shw{E-$zu", "n": [ { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 435051, "z": 5, "cf": 0.8500000238418579 } ], "ln": 435035 }, { "b": "0cz){z*8haA+frgy\u003c6v\u0026rDzOYwJy@FA3fmBzF\u003c34aBtktwmM*gay/7[zF9J6D(#%hy-[9FB7/GoaBCqJA+(\u003eCau1mJaBLwpawLi%miC\u003eyarR^HarR^HtoE^3wmV)gazk.aaBCqCAa%nlD)0cAvrt{%aBCqMx(\u003eFBaA?\u003cvaBLwr3lQDlarR^Hax]$ewO(vcwGTobl@Cdkax]$8z!0i(avey-qxPlL", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 435250, "z": 128, "cf": 0.5 } ], "ln": 435234 }, { "b": "3ii?taz$+jzGu}rvqPM#vqYP#p!s4$B8UY2x\u003ez6\u003cwc@rdzGYD8x\u003eet.nKLPZc36y", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 437878, "z": 3, "cf": 0.800000011920929 } ], "ln": 437862 }, { "b": "A+f5}D0+JhwObU3y?mF:rDzOYwJy@FA3f4fx\u003eI94DMV:cwfumxwmYN1D(#{jvqYZ?aBCqLwPhD]v}u^h3lQDlarR^HarR^HarR^HaBtj%l{%]}toE-#vpS[?awtD{l{%]}t{9t]zGPFjq=D4ZmiC\u003eUAb](wC{2yvl@CdQ3lQDlarR^HarR^HarR^Hax]$0wP/g:mogKpax]$ez/{ekAV!TgtoF6f", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 440861, "z": 128, "cf": 0.5 } ], "ln": 440845 }, { "b": "arR^HarR^HaA?m6zxKrHC4C=eaBCqPy*?i7D)0PMw/#EzC64BvD)0PSv{%l$D)0PS", "n": [ { "c": 1, "d": "veth interface", "i": "micro-behaviors/os/container/namespace::veth-str", "o": 442628, "z": 4, "cf": 1.0 } ], "ln": 442612 }, { "b": "uW3i@x=}*h09a8GxjTaDx(Chhx(mYevpS)\u003etwO1\u003eyAM2lrV(=jAa9=#zGGA2B%6KCo*@tgtoE!", "n": [ { "c": 3, "d": "ip link command", "i": "micro-behaviors/os/network/interface::ip-link", "o": 442714, "z": 11, "cf": 0.8999999761581421 } ], "ln": 442698 }, { "b": "CWCJaDsXi=sYv**aybrY32au3y?W^5aAIjmCoy9jl}7cFlQ-bBazk.kB-nD[qCQp?ayc9]aBtkN", "n": [ { "c": 3, "d": "ip link command", "i": "micro-behaviors/os/network/interface::ip-link", "o": 444376, "z": 12, "cf": 0.8999999761581421 } ], "ln": 444360 }, { "b": "toED/B%6Z.qB%RNaybrOfk$@Iv\u003eR.hBt4foC3/8@vrlI\u003cc1Fryc1Frjc365tAb](bfk+uyfkk6oz#", "n": [ { "c": 3, "d": "Read network device statistics from", "i": "micro-behaviors/fs/proc/network::network-dev", "o": 444838, "z": 13, "cf": 0.6600000262260437 } ], "ln": 444822 }, { "b": "B7lIq0c-c[wo8l\u003eB%Rhfx\u003e810c365{w?wdyB8UY2c365{y?WK1g:NhywPI-nA@Wsh", "n": [ { "c": 3, "d": "ICMP covert channel indicators", "i": "objectives/command-and-control/channel/covert::icmp-indicators", "o": 453929, "z": 4, "cf": 0.800000011920929 } ], "ln": 453913 }, { "b": "fFbp\u003cdGBBdz!0v1B7Gy)fk$@Iv\u003ePcsfj[-Fc1E0@wNPa=x(mX^fjXTqfk+uyflztO055qiz^$BDwg}L9x(mK3fc$cec2D\u003c)i:B=?c2EYg0a{pZvqYVSx\u003ey@S", "n": [ { "c": 3, "d": "/proc/%s/fd path template", "i": "objectives/discovery/process/attribute::pid-template-fd", "o": 454731, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "TUN device access for tunneling", "i": "objectives/exfiltration/dns/tunnel::tun-device", "o": 454755, "z": 12, "cf": 0.6000000238418579 } ], "ln": 454715 }, { "b": "oG\u0026C*v@c78wDlB.v@#Jnr8(W(mn#\u0026FmKXsKz!0)9c@:hwq:\u003cUYs58gZdfa72v@#Jnr8(W(mf", "n": [ { "c": 3, "d": "TUN/TAP device usage", "i": "micro-behaviors/communications/proxy/tunnel::tun", "o": 454831, "z": 9, "cf": 0.6600000262260437 } ], "ln": 454815 }, { "b": "xAhZOzVBG\u003cB7F\u0026kvqZt\u003cvpJ!UAc87WB75Y)iV{4ce*8DYaz(4cwGTYyl}5k5w]7)*awz", "n": [ { "c": 3, "d": "Accept API symbol text", "i": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "o": 461166, "z": 6, "cf": 0.75 } ], "ln": 461150 }, { "b": "t)Z(A30OJ-A=VhdzEm73x\u003eeu1CwgOgt)ZMss7(e=wJyb-l{%]}iZ1Qjaw2ypk$1as", "n": [ { "c": 1, "d": "Hardware ID (HWID) reference", "i": "micro-behaviors/os/sysinfo/machine-id::hwid-string", "o": 462788, "z": 4, "cf": 0.699999988079071 } ], "ln": 462772 }, { "b": "w[CT!w/#He09a8GxjTaDx(Chhx(mYeB7GCol}7cFlQ-btD2Nsqv{%lZ30OJYx([x7By=NYnMnN", "n": [ { "c": 3, "d": "ip link command", "i": "micro-behaviors/os/network/interface::ip-link", "o": 462967, "z": 11, "cf": 0.8999999761581421 } ], "ln": 462951 }, { "b": "03Dq[v%d\u0026)wN/)\u003cB7Gs\u003erC(O\u0026z*c7wBAIFswO-G2zEW9]B9hqcBzkVhar\u0026aMa{[r:zGYD8x\u003eetTl\u003c-{kBzkm=Ac2-70cI*\u003euVQg8AS", "n": [ { "c": 1, "d": "Kyber encapsulation term", "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-3", "o": 473021, "z": 33, "cf": 0.9200000166893005 } ], "ln": 473005 }, { "b": "rZ!+}nK:3[BzbkdBA.TCB8kodwGUI{C4\u003eC$B0a}gB-7.jBz\u0026pzxK@qSq=j-GwP?=$wD", "n": [ { "c": 2, "d": "Slave keyword", "i": "objectives/command-and-control/botnet/keywords::slave-term", "o": 482896, "z": 5, "cf": 0.4000000059604645 } ], "ln": 482880 }, { "b": "oHR(5t)Z(AarT(hzF0l=vqG:!x(C$LvpB4:B0ajEuQEaMoKyv/hDh$eoHR(5t)Z(AarT(hzF0l=ve", "n": [ { "c": 3, "d": "ip6tables command", "i": "micro-behaviors/os/firewall/iptables::ip6tables", "o": 484781, "z": 9, "cf": 0.8999999761581421 } ], "ln": 484765 }, { "b": "x(n95y?WA5zF0l=vqG:!x(C$LvpB4:A@Y](C42i3wft=4uT)IXy*QQ\u003eAcbI$y?mU/x(n95yY", "n": [ { "c": 3, "d": "ip6tables command", "i": "micro-behaviors/os/firewall/iptables::ip6tables", "o": 490671, "z": 9, "cf": 0.8999999761581421 } ], "ln": 490655 }, { "b": "y?mVgc3psgzF0l=vqG:!x(C$LvpB4:B08=Kaolp\u003euT)IXy*QQ\u003eAcbI$y?mVgc3psgb}Q\u0026fA@", "n": [ { "c": 3, "d": "ip6tables command", "i": "micro-behaviors/os/firewall/iptables::ip6tables", "o": 492966, "z": 9, "cf": 0.8999999761581421 } ], "ln": 492950 }, { "b": "arR^HarR^HarR^HarT(hv}/)}wPw]uay]4}vrDydaBCqAv@i/awPGBTgb{z7azkh3eNX", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 495958, "z": 6, "cf": 0.5 } ], "ln": 495942 }, { "b": "arR^HarR^HarR^HarT(hwO#0#D2N\u003cFDMWlAaBCqIw[Aflaybr%arR^HarR^HarR^HarR^", "n": [ { "c": 3, "d": "Generic 'encrypt' term in strings", "i": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "o": 496102, "z": 7, "cf": 0.4000000059604645 } ], "ln": 496086 }, { "b": "A=k$VazbLjaz2CjA^m#(fj/lnfkkxCz/{ekgb0oXz/{10flItRflp/nA+c[rAb](tBy^iXxl4{kz#.L5ByM$rAb](tBy^iXA=+Vfv@Dr$A@W\u003eoB8\u0026{PxKL{)fkkxCz/{ekgb0V\u0026uVPZ}AaK7\u003cfj/lnfkkxCz/{ekgb0V\u0026uVGZ^y\u0026aj[flItRflp/nA+c[rAb](tBy^iXA=+VewNPy(A@W\u003e8ByM$rAb](tBy^iXA=+V0B7Pb$y?9J0B-RNRB7/05wIm-", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 505901, "z": 5, "cf": 0.6600000262260437 } ], "ln": 505885 }, { "b": "B-.gIflhewwohu%wO+(Sfj/lnfkkxCz/{ekgb0JYuVp47Bz(j2flItRflp/nA+c[rz#", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 506111, "z": 5, "cf": 0.6600000262260437 } ], "ln": 506095 }, { "b": "flp/nA+c[rAb](tBy^icfj/lnfkkxCz/{ekg5@$sByM$rAb](tBy^iXA=+VcA=l5rA@W\u003eoB8\u0026{PxKL{)fkkw", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 506191, "z": 5, "cf": 0.6600000262260437 } ], "ln": 506175 }, { "b": "Bz(j2A=+VcA=l5rB1Q#6fj/lnfkkxCz/{ekgb0V\u0026uTWFQA=u5qBz(j2flItRflp/nAS", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 506271, "z": 5, "cf": 0.6600000262260437 } ], "ln": 506255 }, { "b": "ash7K0b#HXA:J($A=\u003e*\u003eflqzWfjO*bB8%0LwPPNKB1X?X0aP}\u0026y?aVaz/^ahB.LV5aAg+hxL}l}wGUN", "n": [ { "c": 2, "d": "/sys/class/net/ path", "i": "micro-behaviors/os/network/interface::sys-class-net", "o": 506540, "z": 15, "cf": 0.5 } ], "ln": 506524 }, { "b": "A+5OUwN/T@wPN]]x(ELZAb](ex(mH70ax!S0a*m=wPzo?Bo1oOga\u003epU05#U/e?{^B0bVW\u003e", "n": [ { "c": 3, "d": "PROFINET protocol keyword reference", "i": "micro-behaviors/communications/profinet::keyword", "o": 510644, "z": 8, "cf": 0.8500000238418579 } ], "ln": 510628 }, { "b": "diG=%asemSasIhyzyC[)fk$@Iv\u003eRXqB-8qx03%aoase\u0026#iw$}3b@)#baseHUaseHFaseHF3iiL7", "n": [ { "c": 3, "d": "Parse active mounts from /proc/mounts", "i": "micro-behaviors/fs/proc/mounts::mounts", "o": 512417, "z": 12, "cf": 0.6600000262260437 } ], "ln": 512401 }, { "b": "z/{1Oaz(4tzGDi=flQ=AflhhMfjOTnz/{1O07Hyhy?mc1Bz\u0026pgy\u0026131vru66zdNN5A^n^tz/M$g", "n": [ { "c": 1, "d": "Reference to /run", "i": "micro-behaviors/fs/path/system::system-run", "o": 514986, "z": 12, "cf": 0.6600000262260437 } ], "ln": 514970 }, { "b": "ay/58z/{1OayYQsnKJ)=fk$@Iv\u003eR[my?ttjwg]lt07Hyhy?mc1Bz\u0026pxwNP9(C42ifwGU]6aAI*BvSc6%", "n": [ { "c": 3, "d": "proc self fd format string", "i": "objectives/evasion/fileless/memory::proc-self-fd-format", "o": 515329, "z": 16, "cf": 0.8999999761581421 } ], "ln": 515313 }, { "b": "c37.XByxolA@X%zzdL:dfk$@Iv\u003ePcsfjO{qz2^yknKJLExl4N8B0aF2Byw/{wN\u003e^ssumMJy\u00261kpvG", "n": [ { "c": 3, "d": "/proc/%s/comm path template", "i": "objectives/discovery/process/attribute::pid-template-comm", "o": 515410, "z": 13, "cf": 0.699999988079071 } ], "ln": 515394 }, { "b": "xKL\u003e3ay/7@v@0ihx([2hA+eV\u0026wO+%3eNZ\u003cJ0184(mJ=kMvS=rawmoN*aAIa7BzkVhasw=", "n": [ { "c": 3, "d": "Invokes readelf", "i": "micro-behaviors/process/create/hcom::readelf-invocation", "o": 517273, "z": 7, "cf": 0.800000011920929 } ], "ln": 517257 }, { "b": "fkCctzE)SqBAg/1x(mL-flqzWfkCctzE)SqwmYj)xd[vEvpK1?x8\u003cPbA:-D?0aP?^0aP?NB8#5cx\u003eqq+y\u003cb", "n": [ { "c": 3, "d": "Root-only path access", "i": "micro-behaviors/os/privilege/paths::root-access", "o": 518908, "z": 18, "cf": 1.0 } ], "ln": 518892 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 613011, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 613003, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 612985, "z": 7, "cf": 0.8999999761581421 } ], "ln": 612969 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 613164, "z": 8, "cf": 0.8999999761581421 } ], "ln": 613148 } ], "depth": 1, "facts": { "exp": [ [ "rt_addr_n2a" ], [ "ipoib_link_util" ], [ "bridge_parse_xstats" ], [ "jsonw_u64_field" ], [ "get_cgroup2_path" ], [ "netns_get_fd" ], [ "addattr_nest_compat_end" ], [ "nl_proto_a2n" ], [ "oneline" ], [ "ip6gretap_link_util" ], [ "ll_remember_index" ], [ "amt_link_util" ], [ "print_rta_gateway" ], [ "str_map_lookup_str" ], [ "genl_add_mcast_grp" ], [ "check_altifname" ], [ "make_path" ], [ "bpf_dump_prog_info" ], [ "close_json_object" ], [ "jsonw_null_field" ], [ "rtnl_nexthopdump_req" ], [ "rtnl_addrprot_a2n" ], [ "bridge_print_mcast_querier_state" ], [ "jsonw_null" ], [ "nlmon_link_util" ], [ "rt_addr_n2a_r" ], [ "is_selinux_enabled" ], [ "jsonw_float" ], [ "protodown_reason_n2a" ], [ "get_ifname_rta" ], [ "do_ipstats" ], [ "print_color_hu" ], [ "bridge_link_util" ], [ "jsonw_s64_field" ], [ "ll_index_to_type" ], [ "bond_slave_link_util" ], [ "new_json_obj" ], [ "ip6gre_link_util" ], [ "parse_on_off" ], [ "ll_proto_a2n" ], [ "netns_foreach" ], [ "batadv_link_util" ], [ "proto_n2a" ], [ "ll_index_to_flags" ], [ "lwt_print_encap" ], [ "rtnl_addrlbldump_req" ], [ "tun_link_util" ], [ "ll_type_n2a" ], [ "ipstats_stat_desc_show_xstats" ], [ "rtnl_nexthop_bucket_dump_req" ], [ "vrf_link_util" ], [ "get_float" ], [ "start" ], [ "xfrm_link_util" ], [ "parse_mapping" ], [ "get_json_writer" ], [ "delete_json_obj" ], [ "dec_indent" ], [ "do_iptunnel" ], [ "br_dump_bridge_id" ], [ "jsonw_bool_field" ], [ "do_iplink" ], [ "print_nl" ], [ "rtnl_send_check" ], [ "get_ifname" ], [ "rtnl_addrdump_req" ], [ "xfrm_parse_mark" ], [ "do_seg6" ], [ "print_indent" ], [ "matches_color" ], [ "rtnl_routedump_req" ], [ "iproute2_hz_internal" ], [ "ll_init_map" ], [ "get_command_name" ], [ "print_timestamp" ], [ "wwan_link_util" ], [ "jsonw_string" ], [ "do_ipnetconf" ], [ "jsonw_luint" ], [ "parse_rtattr_one" ], [ "xdp_dump" ], [ "xfrm_encap_type_parse" ], [ "inc_indent" ], [ "jsonw_printf" ], [ "sprint_time64" ], [ "do_ipfou" ], [ "strxf_xfrmproto" ], [ "size_columns" ], [ "jsonw_uint_field" ], [ "nodev" ], [ "print_prefix" ], [ "xfrm_state_print" ], [ "protodown_reason_a2n" ], [ "print_nexthop_bucket" ], [ "brief" ], [ "do_ipmonitor" ], [ "parse_one_of_deprecated" ], [ "netns_switch" ], [ "rtnl_from_file" ], [ "strxf_proto" ], [ "strxf_ptype" ], [ "print_color_float" ], [ "open_fds_add" ], [ "rtnl_rttable_n2a" ], [ "netns_nsid_socket_init" ], [ "jsonw_float_field" ], [ "inet_addr_match" ], [ "vcan_link_util" ], [ "proto_a2n" ], [ "gretap_link_util" ], [ "netns_id_from_name" ], [ "getfilecon" ], [ "bpf_prog_attach_fd" ], [ "open_json_object" ], [ "tnl_prl_ioctl" ], [ "print_addrinfo" ], [ "print_color_on_off" ], [ "rtnl_open" ], [ "rtnl_group_n2a" ], [ "rtnl_dump_filter_nc" ], [ "jsonw_luint_field" ], [ "tnl_print_gre_flags" ], [ "incomplete_command" ], [ "get_unsigned" ], [ "print_name_and_link" ], [ "bpf_print_ops" ], [ "ip_link_list" ], [ "check_ifname" ], [ "ipaddr_get_vf_rate" ], [ "inet_proto_n2a" ], [ "do_iprule" ], [ "get_ip_lib_dir" ], [ "do_ipila" ], [ "tnl_print_endpoint" ], [ "jsonw_hhu_field" ], [ "veth_link_util" ], [ "rtnl_dsfield_n2a" ], [ "rtnl_neighdump_req" ], [ "bridge_print_vlan_stats_only" ], [ "bpf_parse_common" ], [ "xfrm_policy_print" ], [ "rtnl_rtntype_n2a" ], [ "do_monitor" ], [ "get_be16" ], [ "rtnl_listen" ], [ "jsonw_destroy" ], [ "batch_mode" ], [ "invarg" ], [ "xfrm_id_parse" ], [ "ipip_link_util" ], [ "free_indent_mem" ], [ "find_cgroup2_mount" ], [ "sprint_time" ], [ "matches" ], [ "open_fds_close" ], [ "print_cache_nexthop_id" ], [ "rtnl_dump_request_n" ], [ "freecon" ], [ "get_long" ], [ "rtnl_rtscope_n2a" ], [ "jsonw_lluint" ], [ "ipstats_stat_desc_pack_xstats" ], [ "sha1" ], [ "print_color_luint" ], [ "do_xfrm_state" ], [ "do_ipmacsec" ], [ "mpls_ntop" ], [ "bareudp_link_util" ], [ "jsonw_end_object" ], [ "addraw_l" ], [ "addattr16" ], [ "hexstring_n2a" ], [ "nl_dump_ext_ack_done" ], [ "tnl_6rd_ioctl" ], [ "family_name" ], [ "rtnl_rttable_a2n" ], [ "do_ipvrf" ], [ "rtnl_linkdump_req_filter_fn" ], [ "numeric" ], [ "oper_state_color" ], [ "rmnet_link_util" ], [ "parse_rtattr_nested_compat" ], [ "rtnl_listen_all_nsid" ], [ "get_be32" ], [ "get_user_hz" ], [ "do_ipneigh" ], [ "vxlan_link_util" ], [ "bond_print_xstats" ], [ "lwt_parse_encap" ], [ "netns_map_init" ], [ "rtnl_group_a2n" ], [ "get_cgroup2_id" ], [ "cmd_exec" ], [ "ipaddr_list_link" ], [ "ipvrf_get_table" ], [ "rta_addattr16" ], [ "genl_init_handle" ], [ "duparg2" ], [ "jsonw_int_field" ], [ "delete_json_obj_plain" ], [ "iplink_get" ], [ "get_guid" ], [ "addattr32" ], [ "xdp_parse" ], [ "xfrm_xfrmproto_is_ro" ], [ "rtnl_neightbldump_req" ], [ "inet_proto_a2n" ], [ "strxf_mask32" ], [ "geneve_link_util" ], [ "do_iptuntap" ], [ "rcvbuf" ], [ "do_mptcp" ], [ "do_multiaddr" ], [ "bridge_slave_link_util" ], [ "rtnl_dsfield_a2n" ], [ "print_nsid" ], [ "namehash" ], [ "xfrm_mode_parse" ], [ "xfrm_policy_default_print" ], [ "rtnl_rtntype_a2n" ], [ "ll_drop_by_index" ], [ "uint_to_str" ], [ "team_slave_link_util" ], [ "bpf_prog_detach_fd" ], [ "vti_link_util" ], [ "xfrm_xfrma_print" ], [ "getpidcon" ], [ "rtnl_dump_request" ], [ "get_addr32" ], [ "rta_addattr32" ], [ "rtnl_rtscope_a2n" ], [ "timestamp" ], [ "get_be64" ], [ "parse_rtattr" ], [ "read_prop" ], [ "format_host" ], [ "print_color_tv" ], [ "rtnl_dsfield_get_name" ], [ "str_map_lookup_u8" ], [ "hexstring_a2n" ], [ "rtnl_linkdump_req_filter" ], [ "iproute_reset_filter" ], [ "json" ], [ "set_netns_id_from_name" ], [ "free_nlmsg_chain" ], [ "setexecfilecon" ], [ "do_ioam6" ], [ "get_time_rtt" ], [ "addattr" ], [ "jsonw_hhu" ], [ "generic_proc_open" ], [ "ll_addr_n2a" ], [ "addattr64" ], [ "do_tcp_metrics" ], [ "str_map_lookup_uint" ], [ "ipvtap_link_util" ], [ "print_addrlabel" ], [ "stdout" ], [ "xfrm_lifetime_cfg_parse" ], [ "str_split_by_char" ], [ "get_prefix" ], [ "rtnl_nsiddump_req_filter_fn" ], [ "bpf_program_load" ], [ "print_num" ], [ "macvtap_link_util" ], [ "ipaddr_reset_filter" ], [ "iplink_ifla_xstats" ], [ "do_all" ], [ "do_xfrm_monitor" ], [ "rtnl_open_byproto" ], [ "bridge_print_xstats" ], [ "netkit_link_util" ], [ "listen_all_nsid" ], [ "xfrm_state_info_print" ], [ "print_rt_flags" ], [ "mask2bits" ], [ "rta_nest_end" ], [ "jsonw_hu_field" ], [ "open_json_array" ], [ "get_integer" ], [ "get_addr64" ], [ "print_color_hex" ], [ "rta_addattr64" ], [ "rtnl_close" ], [ "print_escape_buf" ], [ "missarg" ], [ "ipstats_print" ], [ "print_string_name_value" ], [ "jsonw_s64" ], [ "gre_link_util" ], [ "ll_name_to_index" ], [ "get_hz" ], [ "netdevsim_link_util" ], [ "do_batch" ], [ "resolve_hosts" ], [ "is_json_context" ], [ "jsonw_hu" ], [ "rtnl_rtprot_n2a" ], [ "ipnetconf_reset_filter" ], [ "addr64_n2a" ], [ "gtp_link_util" ], [ "alloc_indent_mem" ], [ "print_rule" ], [ "ipstats_stat_desc_xstats_bond_group" ], [ "rtnl_echo_talk" ], [ "ipmroute_reset_filter" ], [ "do_iproute" ], [ "init" ], [ "rtnl_fdb_linkdump_req_filter_fn" ], [ "xfrm_addr_match" ], [ "print_headers" ], [ "preferred_family" ], [ "print_color_rate" ], [ "print_neigh" ], [ "print_color_0xhex" ], [ "vti6_link_util" ], [ "rtnl_talk" ], [ "ipstats_stat_desc_xstats_slave_bond_group" ], [ "pretty" ], [ "do_ipl2tp" ], [ "vxcan_link_util" ], [ "SL_" ], [ "str_to_bool" ], [ "do_tunnels_list" ], [ "vrf_slave_link_util" ], [ "bpf_prog_load_dev" ], [ "rta_nest" ], [ "jsonw_start_object" ], [ "tnl_add_ioctl" ], [ "rtnl_talk_suppress_rtnl_errmsg" ], [ "ll_addr_a2n" ], [ "genl_resolve_family" ], [ "print_color_hhu" ], [ "get_task_name" ], [ "addattrstrz" ], [ "jsonw_xint" ], [ "print_color_string" ], [ "macsec_link_util" ], [ "do_ipntable" ], [ "print_color_uint" ], [ "xfrm_algotype_getbyname" ], [ "bpf" ], [ "filter" ], [ "iproute2_user_hz_internal" ], [ "duparg" ], [ "get_s32" ], [ "default_color_opt" ], [ "print_color_bool" ], [ "ip6erspan_link_util" ], [ "tnl_parse_key" ], [ "tnl_del_ioctl" ], [ "jsonw_pretty" ], [ "print_range" ], [ "do_multiroute" ], [ "rtnl_rtrealm_n2a" ], [ "get_str_char_count" ], [ "get_link_kind" ], [ "parse_rtattr_flags" ], [ "parse_one_of" ], [ "jsonw_u64" ], [ "rtnl_add_nl_group" ], [ "dummy_link_util" ], [ "xfrm_xfrmproto_is_ipsec" ], [ "print_color_s64" ], [ "jsonw_start_array" ], [ "fini" ], [ "get_addr" ], [ "get_time64" ], [ "team_link_util" ], [ "rtnl_send" ], [ "rtnl_rtprot_a2n" ], [ "ctrl_data" ], [ "rtnl_dscp_n2a" ], [ "force" ], [ "bridge_print_vlan_stats" ], [ "drop_cap" ], [ "int_to_str" ], [ "jsonw_end_array" ], [ "bpf_send_map_fds" ], [ "stderr" ], [ "bond_link_util" ], [ "jsonw_name" ], [ "color_fprintf" ], [ "print_stats64" ], [ "get_time" ], [ "af_bit_len" ], [ "security_get_initial_context" ], [ "print_netconf" ], [ "get_float_min_max" ], [ "get_u16" ], [ "get_name_from_nsid" ], [ "xfrm_reqid_parse" ], [ "read_family" ], [ "show_details" ], [ "print_rta_ifidx" ], [ "netns_name_from_id" ], [ "rtnl_ruledump_req" ], [ "get_operstate" ], [ "jsonw_int" ], [ "bridge_print_vlan_flags" ], [ "do_multirule" ], [ "get_libbpf_version" ], [ "do_ip6tunnel" ], [ "addattr8" ], [ "bpf_parse_and_load_common" ], [ "parse_mapping_gen" ], [ "get_s64" ], [ "do_iptoken" ], [ "main" ], [ "dsa_link_util" ], [ "print_color_bool_opt" ], [ "print_mroute" ], [ "print_color_null" ], [ "print_cache_nexthop" ], [ "xfrm_selector_parse" ], [ "mpls_pton" ], [ "use_iec" ], [ "print_color_lluint" ], [ "do_xfrm" ], [ "vrf_reset" ], [ "ipstats_stat_desc_xstats_slave_bridge_group" ], [ "get_addr_rta" ], [ "echo_request" ], [ "cmdlineno" ], [ "get_u32" ], [ "rtnl_tunneldump_req" ], [ "jsonw_lluint_field" ], [ "get_rtnl_link_stats_rta" ], [ "jsonw_new" ], [ "ipstats_stat_desc_xstats_bridge_group" ], [ "ifa_family_color" ], [ "iplink_usage" ], [ "stdin" ], [ "rtnl_rtrealm_a2n" ], [ "tnl_ioctl_get_6rd" ], [ "strxf_algotype" ], [ "print_route" ], [ "close_json_array" ], [ "iplink_parse" ], [ "hsr_link_util" ], [ "bpf_trace_pipe" ], [ "addattr_nest_compat" ], [ "virt_wifi_link_util" ], [ "print_color_u64" ], [ "ll_idx_n2a" ], [ "tnl_print_encap" ], [ "rtnl_linkdump_req" ], [ "rtnl_dscp_a2n" ], [ "do_ipnh" ], [ "get_prefix_1" ], [ "jsonw_string_field" ], [ "addattr_nest" ], [ "bpf_load_common" ], [ "xfrm_policy_info_print" ], [ "bond_parse_xstats" ], [ "nl_dump_ext_ack" ], [ "get_addr_1" ], [ "erspan_link_util" ], [ "timestamp_short" ], [ "rth" ], [ "addattr_l" ], [ "do_netns" ], [ "ifb_link_util" ], [ "ipvlan_link_util" ], [ "rta_addattr8" ], [ "parse_mapping_num_all" ], [ "rtnl_netconfdump_req" ], [ "xfrm_xfrmproto_getbyname" ], [ "do_ipaddrlabel" ], [ "get_real_family" ], [ "new_json_obj_plain" ], [ "macvlan_link_util" ], [ "print_color_int" ], [ "nl_proto_n2a" ], [ "get_u64" ], [ "format_host_r" ], [ "ip6tnl_link_util" ], [ "iplink_types_usage" ], [ "do_xfrm_policy" ], [ "sit_link_util" ], [ "rtnl_set_strict_dump" ], [ "rtnl_brvlandump_req" ], [ "rtnl_dump_filter_errhndlr_nc" ], [ "human_readable" ], [ "rtnl_mdbdump_req" ], [ "rtnl_addrprot_n2a" ], [ "print_mpls_link_stats" ], [ "max_flush_loops" ], [ "bpf_recv_map_fds" ], [ "print_linkinfo" ], [ "check_enable_color" ], [ "do_ipaddr" ], [ "get_u8" ], [ "rta_addattr_l" ], [ "show_stats" ], [ "inet_addr_match_rta" ], [ "print_uint_name_value" ], [ "get_rt_realms_or_raw" ], [ "jsonw_uint" ], [ "name_is_vrf" ], [ "bpf_prog_to_default_section" ], [ "str_map_lookup_u16" ], [ "print_nlmsg_timestamp" ], [ "netns_identify_pid" ], [ "ll_proto_n2a" ], [ "jsonw_bool" ], [ "bpf_graft_map" ], [ "ll_index_to_name" ], [ "hex2mem" ], [ "rtnl_statsdump_req_filter" ], [ "vlan_link_util" ], [ "can_link_util" ], [ "xfrm_selector_print" ], [ "xfrm_sctx_parse" ], [ "tnl_strproto" ], [ "ipneigh_reset_filter" ], [ "addattr_nest_end" ], [ "jsonw_xint_field" ], [ "tnl_get_ioctl" ], [ "bpf_program_attach" ] ], "imp": [ [ "", "opendir" ], [ "", "execvp" ], [ "", "memcmp" ], [ "", "qsort" ], [ "", "ioctl" ], [ "", "symlink" ], [ "", "flock" ], [ "", "sendmsg" ], [ "", "realloc" ], [ "", "connect" ], [ "", "write" ], [ "", "geteuid" ], [ "", "exit" ], [ "", "elf_kind" ], [ "", "sscanf" ], [ "", "umount2" ], [ "", "mnl_attr_get_type" ], [ "", "gettimeofday" ], [ "", "strcspn" ], [ "", "mnl_attr_get_u32" ], [ "", "snprintf" ], [ "", "deregister_frame_info" ], [ "", "asctime" ], [ "", "inotify_add_watch" ], [ "", "mnl_attr_validate" ], [ "", "recvmsg" ], [ "", "open_by_handle_at" ], [ "", "freopen" ], [ "", "getpid" ], [ "", "strcmp" ], [ "", "elf_begin" ], [ "", "readdir" ], [ "", "time" ], [ "", "unshare" ], [ "", "unlink" ], [ "", "strlcpy" ], [ "", "mnl_attr_type_valid" ], [ "", "malloc" ], [ "", "fork" ], [ "", "dlopen" ], [ "", "getprotobynumber" ], [ "", "strcat" ], [ "", "fflush" ], [ "", "strncmp" ], [ "", "recv" ], [ "", "strcpy" ], [ "", "getgrnam" ], [ "", "strrchr" ], [ "", "fstat" ], [ "", "gelf_getsym" ], [ "", "cap_get_flag" ], [ "", "glob" ], [ "", "lstat" ], [ "", "closedir" ], [ "", "strnlen" ], [ "", "fclose" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "mnl_attr_get_str" ], [ "", "strdup" ], [ "", "open" ], [ "", "globfree" ], [ "", "getgrgid" ], [ "", "strlcat" ], [ "", "strtoll" ], [ "", "if_indextoname" ], [ "", "strstr" ], [ "", "cap_set_proc" ], [ "", "vfprintf" ], [ "", "elf_getdata" ], [ "", "munmap" ], [ "", "getpwnam" ], [ "", "elf_version" ], [ "", "fscanf" ], [ "", "getsockname" ], [ "", "perror" ], [ "", "gelf_getshdr" ], [ "", "strchr" ], [ "", "inet_pton" ], [ "", "strspn" ], [ "", "mnl_attr_parse" ], [ "", "bind" ], [ "", "if_nametoindex" ], [ "", "ftell" ], [ "", "mount" ], [ "", "getpwuid" ], [ "", "printf" ], [ "", "fnmatch" ], [ "", "asprintf" ], [ "", "waitpid" ], [ "", "fwrite" ], [ "", "libc_start_main" ], [ "", "readlink" ], [ "", "strncpy" ], [ "", "fgetc" ], [ "", "putchar" ], [ "", "cxa_finalize" ], [ "", "setrlimit" ], [ "", "register_frame_info" ], [ "", "exit" ], [ "", "elf_getscn" ], [ "", "fprintf" ], [ "", "strchrnul" ], [ "", "send" ], [ "", "cap_get_proc" ], [ "", "fgets" ], [ "", "ferror" ], [ "", "strtoul" ], [ "", "fread" ], [ "", "socket" ], [ "", "close" ], [ "", "assert_fail" ], [ "", "ITM_registerTMCloneTable" ], [ "", "sysconf" ], [ "", "getpass" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "calloc" ], [ "", "cap_clear" ], [ "", "read" ], [ "", "gelf_getehdr" ], [ "", "cap_free" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "htons" ], [ "", "setns" ], [ "", "rmdir" ], [ "", "fputc" ], [ "", "sethostent" ], [ "", "htonl" ], [ "", "strtoull" ], [ "", "errno_location" ], [ "", "setsockopt" ], [ "", "basename" ], [ "", "mkdir" ], [ "", "gelf_getrel" ], [ "", "fputs" ], [ "", "atexit" ], [ "", "getprotobyname" ], [ "", "statfs" ], [ "", "localtime" ], [ "", "syscall" ], [ "", "feof" ], [ "", "elf_end" ], [ "", "statvfs" ], [ "", "free" ], [ "", "strftime" ], [ "", "dlsym" ], [ "", "atoi" ], [ "", "stat" ], [ "", "ether_ntoa_r" ], [ "", "isatty" ], [ "", "name_to_handle_at" ], [ "", "puts" ], [ "", "gethostbyaddr" ], [ "", "strerror" ], [ "", "fopen" ], [ "", "strtof" ], [ "", "ntohl" ], [ "", "strtok" ], [ "", "fileno" ], [ "", "ntohs" ], [ "", "inet_ntop" ], [ "", "putc" ], [ "", "sprintf" ], [ "", "getenv" ], [ "", "sigaction" ], [ "", "elf_strptr" ], [ "", "strtod" ], [ "", "strlen" ], [ "", "strtol" ], [ "", "stack_chk_fail" ], [ "", "inotify_init" ], [ "", "mmap" ], [ "", "fseek" ], [ "", "strcasecmp" ], [ "", "getuid" ], [ "", "strsep" ], [ "", "getline" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.14, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 6700, 4.75, "alloc" ], [ ".dynsym", 7608, 16800, 2.69, "alloc" ], [ ".dynstr", 24408, 9427, 4.42, "alloc" ], [ ".gnu.version", 33836, 1400, 1.1, "alloc" ], [ ".gnu.version_r", 35240, 64, 2.53, "alloc" ], [ ".rela.dyn", 35304, 4272, 1.81, "alloc" ], [ ".rela.plt", 39576, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 39600, 336, 5.13, "alloc" ], [ ".init", 40960, 3, 1.58, "alloc,executable" ], [ ".plt", 40976, 32, 3.34, "alloc,executable" ], [ ".text", 41008, 379122, 6.33, "alloc,executable" ], [ ".fini", 420130, 3, 1.58, "alloc,executable" ], [ ".rodata", 421888, 98512, 5.32, "alloc" ], [ ".eh_frame_hdr", 520400, 7732, 5.87, "alloc" ], [ ".eh_frame", 528136, 45296, 5.15, "alloc" ], [ ".init_array", 576560, 8, 1.06, "write,alloc" ], [ ".fini_array", 576568, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 576576, 7120, 2.43, "write,alloc" ], [ ".dynamic", 583696, 592, 1.55, "write,alloc" ], [ ".got", 584288, 1432, 0.04, "write,alloc" ], [ ".data", 585728, 27180, 0.51, "write,alloc" ], [ ".comment", 612908, 28, 3.99, "merge,strings" ], [ ".shstrtab", 612936, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 42758.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 700.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 178.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 700.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 379173.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 379173.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 614992.0, "entropy": 6.22, "size_bytes": 614992.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.33, "data_entropy": 0.89, "overlay_size": 1794.0, "string_count": 4312.0, "overlay_ratio": 0.0, "overall_entropy": 6.22, "overlay_entropy": 1.61, "entropy_variance": 3.17, "avg_string_length": 26.77, "max_string_length": 3074.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.91, "peak_region_entropy": 7.74, "string_length_stddev": 87.04, "largest_section_ratio": 0.62, "sentence_string_count": 1604.0, "sentence_string_ratio": 0.37, "high_entropy_string_count": 0.0 }, "exports": { "count": 520.0 }, "imports": { "count": 176.0 }, "sections": { "count": 28.0, "code_size": 379160.0, "entropy_max": 6.33, "entropy_mean": 2.99, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 4.0 } } }, "id": 1, "mol": "O₃(CoDy₃Er₂)H₆(Cm₁₀CrDsF₇Os₅Po₃)", "path": "iproute2-minimal-7.1.0-r0.apk!!sbin/ip", "risk": 21, "sha": "b3232d2ce147ac3c73fefa82432c8a4d38ec8e6886a630d91e7d02f9b3989618", "size": 614992, "traits": [ { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "spans": [ [ 25454, 14 ] ] }, { "id": "micro-behaviors/os/firewall/iptables::ip6tables", "conf": 0.8999999761581421, "crit": 3, "desc": "ip6tables command", "spans": [ [ 484781, 9 ], [ 484785, 9 ], [ 490671, 9 ], [ 492966, 9 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 24665, 6 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 25202, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 421888, 128 ], [ 423047, 128 ], [ 426527, 128 ], [ 432371, 119 ], [ 433572, 128 ], [ 434421, 128 ], [ 435250, 128 ], [ 440861, 128 ] ] }, { "id": "micro-behaviors/os/group/lookup::getgrnam", "conf": 0.800000011920929, "crit": 3, "desc": "Resolve group name to GID (getgrnam)", "spans": [ [ 25039, 8 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 24774, 7 ] ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-init", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "spans": [ [ 24826, 12 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "spans": [ [ 461166, 6 ] ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.8999999761581421, "crit": 2, "desc": "dlsym function symbol", "spans": [ [ 25000, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 24987, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "spans": [ [ 24782, 7 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 24968, 5 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 25652, 10 ] ] }, { "id": "objectives/discovery/process/attribute::pid-template-fd", "atk": "T1057", "mbc": "E1057", "conf": 0.699999988079071, "crit": 3, "desc": "/proc/%s/fd path template", "spans": [ [ 454731, 12 ], [ 454768, 11 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 25570, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 421888, 128 ], [ 423047, 128 ], [ 426527, 128 ], [ 432371, 119 ], [ 433572, 128 ], [ 434421, 128 ], [ 435250, 128 ], [ 440861, 128 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "spans": [ [ 24727, 5 ] ] }, { "id": "micro-behaviors/communications/proxy/tunnel::tunsetiff-ioctl", "atk": "T1090", "conf": 0.6000000238418579, "crit": 3, "desc": "TUN/TAP virtual NIC setup ioctl", "spans": [ [ 454831, 9 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve address with gethostbyaddr", "spans": [ [ 25425, 13 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 25562, 7 ] ] }, { "id": "micro-behaviors/communications/profinet::keyword", "conf": 0.8500000238418579, "crit": 3, "desc": "PROFINET protocol keyword reference", "spans": [ [ 510644, 8 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount2-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Unmount file system", "spans": [ [ 24799, 7 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 24721, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 25404, 9 ] ] }, { "id": "micro-behaviors/os/bpf/trace-frameworks::libbpf", "conf": 0.8500000238418579, "crit": 3, "desc": "libbpf library", "spans": [ [ 28157, 6 ] ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-add-watch", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "spans": [ [ 24839, 17 ] ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "spans": [ [ 25373, 7 ] ] }, { "id": "micro-behaviors/process/create/hcom::readelf-invocation", "conf": 0.800000011920929, "crit": 3, "desc": "Invokes readelf", "spans": [ [ 517273, 7 ] ] }, { "id": "micro-behaviors/os/network/interface::ip-link", "conf": 0.8999999761581421, "crit": 3, "desc": "ip link command", "spans": [ [ 442714, 11 ], [ 444376, 12 ], [ 462967, 11 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 25523, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.699999988079071, "crit": 2, "desc": "Short -h help flag", "spans": [ [ 422433, 3 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 24907, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 24790, 8 ] ] }, { "id": "micro-behaviors/os/privilege/paths::sys-kernel-debug", "conf": 0.8999999761581421, "crit": 3, "desc": "/sys/kernel/debug/ debugfs access", "spans": [ [ 518908, 18 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "spans": [ [ 26291, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "spans": [ [ 24920, 9 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "objectives/discovery/process/attribute::pid-template-comm", "atk": "T1057", "mbc": "E1057", "conf": 0.699999988079071, "crit": 3, "desc": "/proc/%s/comm path template", "spans": [ [ 515410, 13 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 25439, 14 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 25523, 4 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-underscore", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "spans": [ [ 26291, 5 ] ] }, { "id": "micro-behaviors/fs/proc/network::network-dev", "conf": 0.6600000262260437, "crit": 3, "desc": "Read network device statistics from", "spans": [ [ 444838, 13 ] ] }, { "id": "micro-behaviors/fs/proc/mounts::mounts", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse active mounts from /proc/mounts", "spans": [ [ 512417, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 24907, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "spans": [ [ 24754, 5 ] ] }, { "id": "micro-behaviors/process/user/query::getpwnam", "atk": "T1033", "mbc": "E1033", "conf": 0.4000000059604645, "crit": 2, "desc": "Resolve username to password entry", "spans": [ [ 25030, 8 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 24411, 12 ] ] }, { "id": "objectives/evasion/fileless/memory::proc-self-fd-format", "conf": 0.8999999761581421, "crit": 3, "desc": "proc self fd format string", "spans": [ [ 515329, 16 ] ] }, { "id": "micro-behaviors/os/group/lookup::getgrgid", "conf": 0.800000011920929, "crit": 3, "desc": "Resolve GID to group name (getgrgid)", "spans": [ [ 25065, 8 ] ] }, { "id": "objectives/evasion/fileless/staging::proc-self-fd", "conf": 0.699999988079071, "crit": 3, "desc": "Access /proc/self/fd for file descriptor", "spans": [ [ 515329, 14 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.8999999761581421, "crit": 3, "desc": "Dynamic library loading via dlopen", "spans": [ [ 24993, 6 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1", "conf": 0.949999988079071, "crit": 3, "desc": "SHA1 hashing functions", "spans": [ [ 33118, 4 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 25562, 7 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 25602, 6 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 496102, 7 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 25602, 6 ] ] }, { "id": "objectives/exfiltration/dns/tunnel::tun-device", "atk": "T1071.004", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "TUN device access for tunneling", "spans": [ [ 454755, 12 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 25562, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 24665, 6 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 25507, 7 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/discovery/network/enumeration::ip-route-show", "atk": "T1016", "conf": 0.75, "crit": 3, "desc": "ip route network discovery", "spans": [ [ 423150, 13 ] ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 2, "desc": "Get password file entry by UID", "spans": [ [ 25056, 8 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 25515, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 30039, 4 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 30039, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 24907, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 421888, 128 ], [ 423047, 128 ], [ 426527, 128 ], [ 432371, 119 ], [ 433572, 128 ], [ 434421, 128 ], [ 435250, 128 ], [ 440861, 128 ] ] }, { "id": "objectives/collection/network/ssl-intercept::tracing-frameworks", "conf": 0.8500000238418579, "crit": 3, "desc": "eBPF tracing frameworks", "spans": [ [ 28157, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 24411, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 24411, 12 ] ] }, { "id": "objectives/impact/degrade/firewall::firewall-tool-check", "crit": 3, "desc": "checking for firewall tool availability", "spans": [ [ 484781, 9 ], [ 484785, 9 ], [ 490671, 9 ], [ 492966, 9 ] ] }, { "id": "objectives/discovery/system/fingerprint/user::user-info", "atk": "T1033", "conf": 0.699999988079071, "crit": 3, "desc": "User information fingerprinting", "spans": [ [ 25030, 8 ], [ 25056, 8 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.8500000238418579, "crit": 3, "desc": "Core dlopen/dlsym pattern", "spans": [ [ 24993, 6 ], [ 25000, 5 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/Q^tuVGThePJJ", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[DTA=l8xwIL\u0026Ox(mT4vqC", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 26, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[Rau7]ce?!\u003e$fA", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 95, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 95 }, { "b": "Abf8%wPIu7jS)r)ax0c2BzkS9axrI$y?X09wPF$xflpPpzzbZyaA8dlC{@", "ln": 5, "addr": 113 }, { "b": "B-IpvjS[AWBz#pZfe4J-yItzqx(n6rw]z*fwmoN]z/dgCA+v4ywPScmA+/xbxd)$rA=l8xwIK", "ln": 6, "addr": 160 }, { "b": "B7]@iauZ\u00269f/y^Eir", "ln": 9, "addr": 300 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 314 }, { "b": "z/PM8x(k4RazC!nz/{ekg5", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 328, "z": 17, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 328 }, { "b": "v@Dj3x(\u003eEXaui*+h8O!%ggK:3i5rMJgg:@Lf/H$3iaVOWgby\u003cEhA0JJggs^8f-", "ln": 12, "addr": 346 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 396 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 729.0, "entropy": 5.16, "size_bytes": 729.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 729.0, "peak_region_entropy": 5.16 } } }, "id": 2, "path": "iproute2-minimal-7.1.0-r0.apk!!.PKGINFO", "risk": 1, "sha": "06119d38c246abc0f863374d5cc9d1a337477fc37e6138dbd5b01cc73c38c3d0", "size": 729, "traits": [ { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 328, 17 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 26 ], [ 95, 17 ], [ 328, 17 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }