Benign Download

solaris-python.yaml

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-2568fb844e55d80973319156b3837193120abbd71685c113319ce1c80807b9d356d
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–42
1defaults:
2 platforms: [solaris, unix]
3 for: [python, pyc]
4 attack: T1547.006
5
6traits:
7 - id: python-solaris-kmod-source
8 desc: Python Solaris kmod source
9 crit: suspicious
10 conf: 0.94
11 if:
12 type: text
13 substr: /tmp/.sysmon_kmod.c
14
15 - id: python-solaris-modload
⋯27 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.