Benign Download

objc-qnx.yaml

Hidden path prefix in /tmpComposite catalog requires rule references

SHA-256a55e3ea1d4fc5a3d7c9dca0c290cf191f58fc21c9c010f7f5be4cc422c1f82a5

Evidence

Top-level traits or composite_rules key lines 1–39

1defaults:
2  platforms: [qnx, unix]
3  for: [objc]
4  attack: T1027.009
5
6traits:
7  - id: qnx-objc-hidden-payload-b64
8    desc: QNX ObjC hidden payload b64
9    crit: suspicious
10    conf: 0.94
11    if:
⋯7 lines
19    if:
20      type: text
21      substr: /tmp/.svc_update_
22
23  - id: qnx-objc-cron-daemon-path
24    desc: QNX ObjC cron daemon path
25    crit: suspicious
26    conf: 0.94
27    if:
28      type: text
29      substr: /tmp/.cron_daemon_
30
31composite_rules:
⋯8 lines