{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00006900231,
        "rte": "az",
        "prob": 0.00006900231
      },
      {
        "cls": 0,
        "raw": 0.00004541874,
        "rte": "az/scripts",
        "prob": 0.00004541874
      },
      {
        "cls": 0,
        "raw": 0.0020682216,
        "rte": "az/powershell",
        "prob": 0.0020682216
      }
    ],
    "prob": 0.00006900231,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006900230800965801
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-11T23:19:41Z"
  },
  "path": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908.ps1",
  "raw": {
    "v": "7",
    "tv": "2e83f",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 168,
            "l": 13,
            "t": "        $sec = ConvertTo-SecureString $pw -AsPlainText -Force"
          },
          {
            "a": 230,
            "l": 14,
            "t": "        $cred = New-Object System.Management.Automation.PSCredential(\"hackadmin\", $sec)"
          },
          {
            "a": 318,
            "l": 15,
            "n": [
              {
                "c": 3,
                "d": "Uses Start-Process cmdlet",
                "i": "micro-behaviors/process/create/exec::start-process-dup",
                "o": 326,
                "z": 13
              },
              {
                "c": 2,
                "d": "Windows directory path reference",
                "i": "micro-behaviors/fs/path/system::windows-dir",
                "o": 391,
                "z": 10
              },
              {
                "c": 2,
                "d": "Windows Temp directory path",
                "i": "micro-behaviors/fs/path/temp::win-temp-path",
                "o": 401,
                "z": 5
              }
            ],
            "t": "        Start-Process cmd -Credential $cred -ArgumentList \"/c echo $pw \u003e C:\\Windows\\Temp\\cred_ok_$pw.txt\" -NoNewWindow -…"
          },
          {
            "a": 461,
            "l": 16,
            "n": [
              {
                "c": 3,
                "d": "Uses Out-File",
                "i": "micro-behaviors/fs/write/file/direct::out-file",
                "o": 500,
                "z": 8
              }
            ],
            "t": "        \"SUCCESS with password: $pw\" | Out-File C:\\Windows\\Temp\\cred_found.txt -Append"
          },
          {
            "a": 548,
            "l": 17,
            "t": "    } catch {"
          },
          {
            "a": 562,
            "l": 18,
            "t": "        # failed - continue"
          }
        ],
        "mol": "H₂(FPo₂)",
        "sha": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908",
        "fact": {
          "id": "powershell",
          "met": {
            "ast": {
              "max_depth": 29.0,
              "call_count": 5.0,
              "node_count": 267.0,
              "identifier_count": 13.0,
              "string_literal_count": 11.0,
              "array_literal_max_length": 7.0
            },
            "file": {
              "size": 654.0,
              "entropy": 5.0,
              "size_bytes": 654.0
            },
            "text": {
              "digit_ratio": 0.05,
              "space_count": 126.0,
              "total_lines": 21.0,
              "char_entropy": 5.0,
              "unique_chars": 66.0,
              "string_density": 0.52,
              "avg_line_length": 30.14,
              "max_line_length": 142.0,
              "empty_line_ratio": 0.05,
              "last_line_length": 55.0,
              "whitespace_ratio": 0.22,
              "most_common_ratio": 0.06,
              "identifier_density": 1.0,
              "line_length_stddev": 35.46,
              "normalized_string_count": 2.4,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 2.96
            },
            "calls": {
              "count": 5.0
            },
            "binary": {
              "overall_entropy": 5.0
            },
            "strings": {
              "total": 11.0,
              "avg_length": 13.18,
              "max_length": 45.0,
              "path_count": 1.0,
              "avg_entropy": 2.97,
              "total_bytes": 145.0,
              "entropy_stddev": 0.7
            },
            "comments": {
              "chars": 18.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.05
            },
            "identifiers": {
              "count": 13.0,
              "total": 21.0,
              "avg_length": 14.0,
              "max_length": 41.0,
              "min_length": 3.0,
              "avg_entropy": 2.91,
              "reuse_ratio": 0.62,
              "unique_count": 13.0,
              "length_stddev": 11.98,
              "high_entropy_count": 4.0,
              "high_entropy_ratio": 0.31,
              "all_lowercase_ratio": 0.08
            }
          },
          "str": [
            [
              20,
              "u8",
              "tjchrn3004*"
            ],
            [
              20,
              "u8",
              "tjchrn3004*"
            ],
            [
              39,
              "u8",
              "rPdid3004*"
            ],
            [
              39,
              "u8",
              "rPdid3004*"
            ],
            [
              58,
              "u8",
              "akdrh2020*"
            ],
            [
              58,
              "u8",
              "akdrh2020*"
            ],
            [
              76,
              "u8",
              "inok7"
            ],
            [
              76,
              "u8",
              "inok7"
            ],
            [
              89,
              "u8",
              "1028"
            ],
            [
              89,
              "u8",
              "1028"
            ],
            [
              101,
              "u8",
              "wjddnr1"
            ],
            [
              101,
              "u8",
              "wjddnr1"
            ],
            [
              116,
              "u8",
              "tjch77"
            ],
            [
              116,
              "u8",
              "tjch77"
            ],
            [
              299,
              "u8",
              "hackadmin"
            ],
            [
              299,
              "u8",
              "hackadmin"
            ],
            [
              376,
              "u8",
              "/c echo $pw \u003e C:\\Windows\\Temp\\cred_ok_$pw.txt"
            ],
            [
              376,
              "u8",
              "/c echo $pw \u003e C:\\Windows\\Temp\\cred_ok_$pw.txt"
            ],
            [
              469,
              "u8",
              "SUCCESS with password: $pw"
            ],
            [
              469,
              "u8",
              "SUCCESS with password: $pw"
            ],
            [
              598,
              "u8",
              "Done testing"
            ],
            [
              598,
              "u8",
              "Done testing"
            ]
          ],
          "tgt": [
            "ConvertTo-SecureString",
            "New-Object",
            "Out-File",
            "Start-Process"
          ],
          "val": {
            "file.stem": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908",
            "file.basename": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908.ps1",
            "source.language": "powershell",
            "source.strings[0]": "/c echo $pw \u003e C:\\Windows\\Temp\\cred_ok_$pw.txt",
            "source.strings[1]": "Done testing",
            "source.strings[2]": "SUCCESS with password: $pw",
            "source.strings[3]": "akdrh2020*",
            "source.strings[4]": "hackadmin",
            "source.strings[5]": "rPdid3004*",
            "source.strings[6]": "tjch77",
            "source.strings[7]": "tjchrn3004*",
            "source.strings[8]": "wjddnr1"
          }
        },
        "find": [
          {
            "id": "micro-behaviors/fs/path/system::windows-dir",
            "crit": 2,
            "desc": "Windows directory path reference"
          },
          {
            "id": "micro-behaviors/process/create/start-process::start-process-dup",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Start-Process call"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::credential",
            "conf": 0.30000001192092896,
            "crit": 1,
            "desc": "credential keyword"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::command-result-word",
            "conf": 0.4000000059604645,
            "crit": 1,
            "desc": "cmd/command/result vocabulary word"
          },
          {
            "id": "objectives/command-and-control/dropper/execution/fileless::hidden-powershell-getcontent-iex--rx-22",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "metadata/file/text/metrics::few-comment-lines",
            "crit": 1,
            "desc": "Five or fewer comment lines in file"
          },
          {
            "id": "micro-behaviors/fs/path/system::windows-root",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "C:\\\\Windows\\\\ directory path"
          },
          {
            "id": "objectives/command-and-control/dropper/staging/archive::powershell-archive-execute",
            "atk": "T1204.002",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PowerShell executes archive payload command"
          },
          {
            "id": "micro-behaviors/process/create/exec::start-process-dup",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Uses Start-Process cmdlet"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::password",
            "crit": 1,
            "desc": "password keyword"
          },
          {
            "id": "micro-behaviors/fs/path/temp::win-temp-path",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Windows Temp directory path"
          },
          {
            "id": "micro-behaviors/data/text/keywords/credential::credential-field",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "password/token/api_key field keyword"
          },
          {
            "id": "micro-behaviors/fs/write/file/direct::out-file",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Uses Out-File"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows",
            "conf": 0.4000000059604645,
            "crit": 2,
            "desc": "Windows platform string"
          },
          {
            "id": "objectives/execution/condition/platform::os-specific-execution",
            "atk": "T1204.002",
            "conf": 0.8500000238418579,
            "crit": 1,
            "desc": "Executes different commands based on OS platform"
          }
        ],
        "path": "9f0a17d4e1c836ae29055d2f401139207d3ba81f4c69507a5f7914d184a54908.ps1",
        "risk": 3,
        "size": 654,
        "type": "powershell"
      }
    ]
  }
}