Benign Download

linux.yaml

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-256aa14b4b71d0a2f539c1a53db086e7f5656bf26a5f1f4c3132fc01fce5137bdc3
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 5–16
⋯4 lines
9 - linux
10 - macos
11traits:
12- id: tmp-path-content
13 desc: Contains a /tmp/ or /var/tmp/ path
14 if:
15 type: text
16 regex: '(^|[^A-Za-z0-9_./-])(/tmp/|/ …
Hidden path prefix in /tmp lines 18–26
18:13… .
19 - /tmp/out.zip
20 - /tmp/analysis
21 - /tmp/autosymbiontic
22 - /tmp/.X11-unix
23 - /var/tmp/.
24 # Docstring / tutorial placeholders embedded in native extension help text.
25 - /tmp/file.txt
26- id: hid …
Trait criticality field lines 32–46
32:37… fter the dot so comment placeholders
33 # like `/tmp/...` are not treated as hidden staging paths.
34 regex: '(^|[^A-Za-z0-9_./-])/tmp/\.[A-Za-z0-9_]'
35 not:
36 - substr: /tmp/.X
37 - substr: /tmp/.gocache
38- id: native-hidden-numeric-file-template
39 desc: Native hidden numeric filename template
40 crit: notable
41 conf: 0.9
42 platforms: [linux, android]
⋯4 lines
References a /tmp/sync-prefixed path lines 55–67
55:52… Za-z0-9._-]+'
56- id: tmp-sync-prefixed-path
57 desc: References a /tmp/sync-prefixed path
58 crit: notable
59 conf: 0.9
60 if:
61 type: text
62 regex: '(?i)/tmp/sync[^/\n''"]{0,80}'
63- id: var-tmp-hidden
64 desc: Hidden file in /var/tmp
65 crit: notable
66 conf: 0.7
67 # Capture the full hidden file …
/dev/shm/rootf path reference lines 94–104
94:5… nf: 0.7
95 platforms:
96 - linux
97 if:
98 type: text
99 regex: '/dev/shm/rootf\b'
100- id: apparmor-denies-hidden-dev-shm
101 desc: AppArmor denies hidden shared-memory path
102 crit: notable
103 conf: 0.95
104 platfo …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.