{ "ml": { "v": "7", "id": 4, "lvl": 279, "conf": 80, "prob": 0.9599999785423279, "type": "tar.zst", "version": "v18.18", "analyzed_at": "2026-10-20T01:34:28Z" }, "path": "lsw-0.1.8-x86_64.tar.zst", "raw": { "rev": "17dc6", "files": [ { "id": 4, "mol": "K₂(LiTe₃)O₇(Er₂I₃P₂AlAs₂CDy)H₁₂(Cm₃₄Cr₆Db₂₂Ds₄F₄₁Hf₈Mg₆Os₄₅Po₄₆Ti₂U₄)Md₇(Bi₂₂Bk₂He₂Pa₅Pt₂Si)", "pid": 1, "rel": "fetched", "sha": "b42d4209ada01de9418f05a7d8e5d55159eede3d16f8836fc81c643ef59592c2", "via": "https://github.com/acceleration3/linux-subsystem-windows/releases/download/v0.1.8/lsw-0.1.8-x86_64.tar.zst", "path": "https://github.com/acceleration3/linux-subsystem-windows/releases/download/v0.1.8/lsw-0.1.8-x86_64.tar.zst", "risk": 234, "size": 18739188, "type": "tar.zst", "depth": 2, "facts": { "metrics": { "file": { "size": 18739188, "entropy": 8 }, "binary": { "peak_region_bytes": 18646004, "peak_region_entropy": 7.96 } } }, "traits": [ { "id": "objectives/evasion/security-bypass/policy/execution::pe-concealed-policy-override-profile", "atk": "T1059.001", "mbc": "E1027", "conf": 0.94, "crit": 4, "desc": "Concealed PowerShell policy override profile", "from": [ { "off": 2580008, "file": 61 } ], "uses": [ 499, 507, 508, 509 ] }, { "id": "objectives/impact/ransom/recovery-inhibition::bcdedit-ignore-failures", "atk": "T1490", "conf": 0.92, "crit": 4, "desc": "Disables Windows boot failure recovery", "from": [ { "file": 58 } ] }, { "id": "objectives/impact/ransom/recovery-inhibition::bcdedit-recovery", "atk": "T1490", "conf": 0.7, "crit": 4, "desc": "Disables Windows boot recovery with bcdedit", "from": [ { "file": 58 } ] }, { "id": "objectives/persistence/login/scheduled-task/masquerade::powershell-microsoft-taskpath-argument", "atk": "T1053.005,T1036.005", "mbc": "F0012", "conf": 0.96, "crit": 4, "desc": "PowerShell Microsoft task namespace argument", "from": [ { "file": 58 } ] }, { "id": "binary/embedded/elf", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": "Embedded ELF binary at file offset 0xc845a8 (~20208 bytes)" }, { "id": "metadata/binary/code/arguments::register-load-13-1-bytes", "conf": 0.97, "crit": 3, "desc": "13/1 argument-register loads before a call", "from": [ { "file": 13 } ] }, { "id": "metadata/binary/code/complexity::complex-control-flow", "conf": 0.85, "crit": 3, "desc": "Multiple measures indicate complex control flow", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 6 }, { "file": 12 }, { "file": 13 }, { "file": 34 } ], "uses": [ 613, 614 ] }, { "id": "metadata/binary/code/complexity::extreme-max-complexity", "conf": 0.7, "crit": 3, "desc": "Extremely high max function complexity", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/code/complexity::function-count-1000-plus", "conf": 0.5, "crit": 3, "desc": "Binary has at least 1000 functions", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/code/complexity::many-tiny-functions", "conf": 0.4, "crit": 3, "desc": "500+ functions contain one basic block", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/header/characteristics::pe-native-subsystem", "conf": 0.98, "crit": 3, "desc": "PE native subsystem image" }, { "id": "metadata/binary/header/program::compact-large-load-memory-image", "atk": "T1027.002", "mbc": "F0001", "conf": 0.72, "crit": 3, "desc": "Compact ELF reserves large memory image", "from": [ { "file": 12 } ] }, { "id": "metadata/binary/instruction::cpuid-feature-query-sequence", "conf": 0.82, "crit": 3, "desc": "CPUID feature-query instruction sequence", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/instruction::x86-add-esp-ret-sequences", "conf": 0.9, "crit": 3, "desc": "Many x86 add-esp-then-ret sequences", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/instruction::x86-deadbeef-immediate", "conf": 0.95, "crit": 3, "desc": "x86 code loads the DEADBEEF sentinel value", "from": [ { "file": 61 } ] }, { "id": "metadata/binary/instruction::x86-global-pointer-indirect-call", "conf": 0.9, "crit": 3, "desc": "x86 indirect call through a global pointer", "from": [ { "file": 46 } ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-zeroed", "conf": 0.9, "crit": 3, "desc": "PE checksum is zeroed", "from": [ { "file": 43 } ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/layout/overlay::large-overlay-64k", "conf": 0.95, "crit": 3, "desc": "Overlay size at least 64 KiB", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/layout/overlay::noncertificate-overlay-512", "conf": 0.9, "crit": 3, "desc": "PE overlay extends 512+ bytes past signature", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/layout/overlay::overlay-at-least-80k", "conf": 0.7, "crit": 3, "desc": "Appended data occupies at least 80 KiB", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/layout/tls::pe-multiple-tls-callbacks", "conf": 0.9, "crit": 3, "desc": "PE has multiple TLS callbacks", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/layout/tls::pe-tls-callback-table", "conf": 0.9, "crit": 3, "desc": "PE TLS callback table present", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::gnutls-needed", "conf": 0.99, "crit": 3, "desc": "ELF depends on GnuTLS" }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/provenance/build::debug-timestamp-post-2024", "conf": 0.7, "crit": 3, "desc": "Debug directory timestamp is 2025 or newer" }, { "id": "metadata/binary/provenance/build::header-timestamp-pre-2000", "conf": 0.78, "crit": 3, "desc": "PE header timestamp predates 2000", "from": [ { "file": 41 } ] }, { "id": "metadata/binary/provenance/build::header-timestamp-pre-2025", "conf": 0.7, "crit": 3, "desc": "PE header compile timestamp predates 2025", "from": [ { "file": 40 } ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/provenance/version-info::pe-non-architecture-filename-mismatch", "conf": 0.9, "crit": 3, "desc": "PE filename conflicts with OriginalFilename" }, { "id": "metadata/binary/resource/manifest::pe-version-and-manifest-only", "conf": 0.88, "crit": 3, "desc": "PE ships only RT_VERSION + RT_MANIFEST resources", "from": [ { "file": 59 }, { "file": 60 }, { "file": 61 }, { "file": 62 } ], "uses": [ 619, 620, 621 ] }, { "id": "metadata/binary/section/entropy::large-low-entropy-rodata-section", "conf": 0.95, "crit": 3, "desc": "Large low-entropy read-only data section", "from": [ { "file": 13 } ] }, { "id": "metadata/binary/section/entropy::low-entropy-pe-resource-section", "conf": 0.88, "crit": 3, "desc": "PE resource section has low entropy", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/section/header::elf-comment-section-absent", "conf": 1.0, "crit": 3, "desc": "ELF has no .comment section", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/section/label::multiple-nonstandard-section-names", "conf": 0.9, "crit": 3, "desc": "Multiple nonstandard PE section names", "from": [ { "file": 48 } ] }, { "id": "metadata/binary/section/ratio::data-section-1p5x-code", "conf": 0.7, "crit": 3, "desc": "Data section 1.5x larger than code", "from": [ { "file": 8 } ] }, { "id": "metadata/binary/section/ratio::dominant-section", "conf": 0.6, "crit": 3, "desc": "Single section dominates binary layout", "from": [ { "file": 8 } ] }, { "id": "metadata/binary/section/ratio::large-data-section", "conf": 0.75, "crit": 3, "desc": "Large .data section (\u003e70% of file)", "from": [ { "file": 8 } ] }, { "id": "metadata/binary/section/ratio::large-four-section-pe", "conf": 0.82, "crit": 3, "desc": "Large PE with four standard sections", "from": [ { "file": 44 } ], "uses": [ 617, 624 ] }, { "id": "metadata/binary/section/ratio::largest-section-at-least-90-percent", "conf": 0.6, "crit": 3, "desc": "Largest declared section is 90%+ of file", "from": [ { "file": 45 } ] }, { "id": "metadata/binary/section/ratio::pe-near-total-code-data", "conf": 0.94, "crit": 3, "desc": "PE code-to-data ratio at least 0.99", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/symbols/compiler::coff-import-pointer-prefix", "conf": 0.4, "crit": 3, "desc": "COFF import pointer prefix text", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/symbols/count::exports-at-least-256", "conf": 0.94, "crit": 3, "desc": "Binary has at least 256 exports", "from": [ { "file": 59 } ] }, { "id": "metadata/binary/symbols/count::imported-functions-under-80", "conf": 0.84, "crit": 3, "desc": "Large binary imports under 80 functions", "from": [ { "file": 48 } ] }, { "id": "metadata/binary/symbols/export-name-pattern::fifty-letters-only-export-names", "conf": 0.96, "crit": 3, "desc": "50+ letters-only mixed-case export names", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/symbols/export-name-pattern::short-mixed-case-export-name", "conf": 0.9, "crit": 3, "desc": "Short letters-only mixed-case export name", "from": [ { "file": 45 } ] }, { "id": "metadata/binary/symbols/exports::single-export", "conf": 0.75, "crit": 3, "desc": "Binary exports one symbol", "from": [ { "file": 55 } ] }, { "id": "metadata/binary/symbols/imports::graphics-api-import", "conf": 0.85, "crit": 3, "desc": "GL, EGL or Vulkan API imports", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/symbols/imports::imports-advapi32-dll", "conf": 0.95, "crit": 3, "desc": "Binary imports ADVAPI32.dll", "from": [ { "file": 39 } ] }, { "id": "metadata/binary/symbols/table::full-symbol-table-absent-or-empty", "conf": 0.8, "crit": 3, "desc": "Full symbol table absent or empty", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/vendor::media-stack-import-name", "conf": 0.93, "crit": 3, "desc": "Media-stack DLL import name", "from": [ { "file": 62 } ] }, { "id": "metadata/build/archive::archive-windows-executable-entry", "conf": 0.86, "crit": 3, "desc": "Windows executable archive member" }, { "id": "metadata/build/artifact::mixed-toolchain-comments", "conf": 1.0, "crit": 3, "desc": "Multiple distinct toolchain comment strings", "from": [ { "file": 8 } ] }, { "id": "metadata/file/data-blob::opaque-data-high-peak-entropy", "conf": 0.9, "crit": 3, "desc": "Opaque data peak-region entropy exceeds 7.5 bits", "from": [ { "file": 15 } ] }, { "id": "metadata/file/data-blob::opaque-data-peak-region-over-8k", "conf": 0.9, "crit": 3, "desc": "Opaque peak-entropy spans total at least 8KB", "from": [ { "file": 16 } ] }, { "id": "metadata/file/format/native-executable::dos-boot-sig-in-image", "conf": 0.85, "crit": 3, "desc": "DOS boot signature in the image", "from": [ { "file": 19 } ] }, { "id": "metadata/file/format/structured::desktop-terminal-hidden", "conf": 1.0, "crit": 3, "desc": "Desktop entry Terminal=false" }, { "id": "metadata/file/string/graphics::graphics-runtime-library-name", "conf": 0.85, "crit": 3, "desc": "GL, EGL or Vulkan library filename text", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/graphics::vulkan-rdata-reference", "conf": 0.85, "crit": 3, "desc": "Vulkan word in the read-only data section", "from": [ { "file": 49 } ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.85, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "from": [ { "file": 8 } ] }, { "id": "metadata/hardening/build::strcpy-chk", "conf": 0.85, "crit": 3, "desc": "FORTIFY_SOURCE strcpy bounds check", "from": [ { "file": 13 } ] }, { "id": "metadata/hardening/sandbox::linux-seccomp", "conf": 0.95, "crit": 3, "desc": "Linux seccomp sandbox enabled", "from": [ { "off": 849905, "file": 13 } ], "uses": [ 64, 65, 66 ] }, { "id": "metadata/hardening/sandbox::seccomp-init", "conf": 0.95, "crit": 3, "desc": "Linux seccomp sandbox initialization", "from": [ { "file": 13 } ] }, { "id": "metadata/hardening/sandbox::seccomp-load", "conf": 0.95, "crit": 3, "desc": "Linux seccomp profile loading", "from": [ { "file": 13 } ] }, { "id": "metadata/hardening/sandbox::seccomp-rule-add", "conf": 0.9, "crit": 3, "desc": "Linux seccomp rule addition", "from": [ { "file": 13 } ] }, { "id": "metadata/lang/compiler/native::gcc-dwarf-debug-section", "conf": 0.92, "crit": 3, "desc": "PE carries GCC DWARF debug sections", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/compiler/native::llvm-eh-frame-pe-section", "conf": 0.9, "crit": 3, "desc": "PE LLVM or GNU .eh_frame section", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/compiler/native::mingw-pseudo-reloc-error-message", "conf": 0.9, "crit": 3, "desc": "MinGW pseudo-relocation error diagnostic", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/compiler/native::mingw-pseudo-reloc-protocol-message", "conf": 0.95, "crit": 3, "desc": "MinGW pseudo-relocation protocol diagnostic", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/compiler/native::mingw-runtime-marker", "conf": 0.85, "crit": 3, "desc": "libgcc / libstdc++ runtime marker", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/compiler/native::mingw-winpthreads-runtime", "conf": 0.95, "crit": 3, "desc": "Links the mingw-w64 winpthreads runtime", "from": [ { "file": 59 } ] }, { "id": "metadata/lang/encoded/wide::shell-interpreter-encoded", "conf": 0.9, "crit": 3, "desc": "Encoded shell interpreter (wide strings)", "from": [ { "file": 61 } ], "uses": [ 716 ] }, { "id": "metadata/lang/runtime::libcxx-basic-string-symbol", "conf": 0.5, "crit": 3, "desc": "Links the C++ std::string runtime", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/runtime::stl-vector-symbol", "conf": 0.5, "crit": 3, "desc": "C++ std vector symbol", "from": [ { "file": 6 } ] }, { "id": "metadata/package/files/archive-member::archive-svg-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an SVG document" }, { "id": "metadata/package/files/archive-member::member-at-least-10mb", "conf": 0.95, "crit": 3, "desc": "Archive member size at least 10 MB" }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/name::archive-bin-member", "conf": 0.9, "crit": 3, "desc": "Archive member has a .bin extension" }, { "id": "metadata/package/files/runtime::javascript-family-lib-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript-family source file under lib" }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present" }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/communications/http/client/qt::qnetworkaccessmanager-get", "conf": 0.95, "crit": 3, "desc": "Qt QNetworkAccessManager GET request", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Close WinHTTP handle object", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Connect WinHTTP to remote host", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-crack-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.84, "crit": 3, "desc": "Parse URL with WinHTTP helper", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-dll-name-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "WinHTTP DLL name string reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Initialize WinHTTP session", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Create WinHTTP HTTP request handle", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-query-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Query WinHTTP response headers", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "Read WinHTTP response body", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Receive WinHTTP server response", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WinHTTP request/response data flow", "from": [ { "file": 61 } ], "uses": [ 95, 96, 97, 98, 101 ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-request-response-flow", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Complete WinHTTP request and response flow", "from": [ { "file": 61 } ], "uses": [ 90, 99, 102 ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Send WinHTTP request to server", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/http/client/winhttp::winhttp-session-connect-flow", "atk": "T1071.001", "mbc": "C0002", "conf": 0.92, "crit": 3, "desc": "WinHTTP session with remote connection", "from": [ { "file": 61 } ], "uses": [ 91, 92, 94 ] }, { "id": "micro-behaviors/communications/http/content-length::content-length-zero", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length zero header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/cookies::ascii-cookie-header-binary", "conf": 0.75, "crit": 3, "desc": "Cookie header-form string in binary", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.7, "crit": 3, "desc": "curl command includes URL or option", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-embedded-text", "atk": "T1105", "conf": 0.86, "crit": 3, "desc": "Non-shell curl text contains quiet flags", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-length::content-length-header", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP Content-Length header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/message::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-elf", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "ELF embeds a cleartext http:// URL", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "conf": 0.7, "crit": 3, "desc": "References Mozilla/5.0 User-Agent prefix", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket connection upgrade header", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "WebSocket protocol headers", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-http-upgrade-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade handshake", "from": [ { "off": 12521478, "file": 13 } ], "uses": [ 113, 117 ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-subprotocol-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket subprotocol header", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade header", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/construct::tcp-header-struct", "conf": 0.62, "crit": 3, "desc": "References the TCP header structure", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-text", "conf": 0.82, "crit": 3, "desc": "Hardcoded external IPv4 with port", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/ip/literal::loopback-ipv4-binary", "conf": 0.78, "crit": 3, "desc": "Native binary contains a loopback IPv4 address", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/literal::private-10-http-url-text", "conf": 0.9, "crit": 3, "desc": "Text contains private 10.x HTTP URL", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.66, "crit": 3, "desc": "Converts host to network long", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.66, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-addr-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_addr", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-aton-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_aton", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.66, "crit": 3, "desc": "References inet_ntop IP-to-text API", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_pton", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.66, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ip/resolve::getnameinfo-symbol", "conf": 0.66, "crit": 3, "desc": "Binary references the getnameinfo API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.66, "crit": 3, "desc": "References getaddrinfo endpoint-resolution API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname", "conf": 0.66, "crit": 3, "desc": "Resolve hostname with gethostbyname", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ipc/dbus::dbus-core-interface", "conf": 0.85, "crit": 3, "desc": "References the core D-Bus interface", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "conf": 1.0, "crit": 3, "desc": "Uses named pipe IPC APIs", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "atk": "T1559", "conf": 0.7, "crit": 3, "desc": "Wait for named pipe server", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::create-pipe", "conf": 0.9, "crit": 3, "desc": "Imports the anonymous-pipe creation API", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "conf": 0.9, "crit": 3, "desc": "Pipe creation with handle or pipe inspection APIs", "from": [ { "file": 59 }, { "file": 60 }, { "file": 61 }, { "file": 62 } ], "uses": [ 135, 645 ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/configure::setsockopt-import", "conf": 0.95, "crit": 3, "desc": "Imports POSIX socket option configuration API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::connect", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Socket connection API surface", "from": [ { "off": 107085, "file": 1 }, { "off": 10217, "file": 8 }, { "off": 1503795, "file": 13 }, { "off": 33773, "file": 34 } ], "uses": [ 140, 141 ] }, { "id": "micro-behaviors/communications/socket/connect::connect-import", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Imports the POSIX connect API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "References connect socket API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::library-socket-client", "conf": 0.6, "crit": 3, "desc": "Shared library creates and connects sockets", "from": [ { "file": 1 }, { "file": 3 }, { "file": 6 }, { "file": 8 }, { "file": 11 }, { "file": 12 }, { "file": 13 }, { "file": 34 } ], "uses": [ 139, 145, 615 ] }, { "id": "micro-behaviors/communications/socket/connect::loopback-hostname", "atk": "T1071", "mbc": "C0001", "conf": 0.84, "crit": 3, "desc": "Connect-capable code references localhost", "from": [ { "file": 1 }, { "file": 8 }, { "file": 13 }, { "file": 34 } ], "uses": [ 141, 644 ] }, { "id": "micro-behaviors/communications/socket/connect::loopback-ipv4", "atk": "T1071", "mbc": "C0001", "conf": 0.84, "crit": 3, "desc": "Connect-capable code references IPv4 loopback", "from": [ { "off": 3502614, "file": 1 }, { "file": 8 }, { "file": 13 }, { "file": 34 } ], "uses": [ 120, 141 ] }, { "id": "micro-behaviors/communications/socket/create::create", "conf": 0.75, "crit": 3, "desc": "Create network socket", "from": [ { "off": 106804, "file": 1 }, { "off": 10199, "file": 8 }, { "off": 12200, "file": 12 }, { "off": 848600, "file": 13 }, { "off": 33623, "file": 34 } ], "uses": [ 146 ] }, { "id": "micro-behaviors/communications/socket/create::posix-socket-import", "conf": 0.95, "crit": 3, "desc": "Imports POSIX socket creation API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/family::can-protocol-selector", "conf": 0.9, "crit": 3, "desc": "SocketCAN protocol selector constant", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/init::accept-api", "conf": 0.9, "crit": 3, "desc": "Winsock accept import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::bind-api", "conf": 0.9, "crit": 3, "desc": "Winsock bind import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::connect-api", "conf": 0.9, "crit": 3, "desc": "Winsock outbound connect import", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/init::getpeername-api", "conf": 0.85, "crit": 3, "desc": "Query connected peer endpoint", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::listen-api", "conf": 0.9, "crit": 3, "desc": "Winsock listen import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::recv-api", "conf": 0.9, "crit": 3, "desc": "Winsock receive import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::select-api", "conf": 0.88, "crit": 3, "desc": "Winsock select import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::send-api", "conf": 0.9, "crit": 3, "desc": "Winsock send import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::socket-api", "conf": 0.9, "crit": 3, "desc": "Winsock socket creation import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-lifecycle", "conf": 0.9, "crit": 3, "desc": "Winsock client connection lifecycle", "from": [ { "off": 3020160, "file": 61 }, { "file": 62 } ], "uses": [ 158, 646 ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-symbol-lifecycle", "conf": 0.92, "crit": 3, "desc": "Winsock client symbol lifecycle", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 150, 153, 155, 156 ] }, { "id": "micro-behaviors/communications/socket/init::winsock-runtime-client-api-table", "conf": 0.86, "crit": 3, "desc": "Runtime-resolved Winsock client APIs", "from": [ { "off": 3020160, "file": 61 }, { "off": 1199543, "file": 62 } ], "uses": [ 646, 647, 648, 725 ] }, { "id": "micro-behaviors/communications/socket/init::winsock-server-symbol-lifecycle", "conf": 0.9, "crit": 3, "desc": "Winsock server socket lifecycle", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 148, 149, 152, 153, 155, 156 ] }, { "id": "micro-behaviors/communications/socket/init::wsa-startup", "conf": 0.9, "crit": 3, "desc": "Initialize Winsock library", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.7, "crit": 3, "desc": "Looks up index with if_nametoindex", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "References accept socket API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::accepting-server-api-surface", "mbc": "C0001", "conf": 0.84, "crit": 3, "desc": "POSIX accepting socket server API surface", "from": [ { "off": 107045, "file": 1 }, { "off": 10206, "file": 8 }, { "off": 12207, "file": 12 }, { "off": 1374344, "file": 13 } ], "uses": [ 163, 167 ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Socket listener with creation API", "from": [ { "off": 106804, "file": 1 }, { "off": 10199, "file": 8 }, { "off": 12200, "file": 12 }, { "off": 848600, "file": 13 }, { "off": 33623, "file": 34 } ], "uses": [ 146, 166 ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "References listen socket API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::server-api-surface", "mbc": "C0001", "conf": 0.8, "crit": 3, "desc": "POSIX socket server API surface", "from": [ { "off": 106804, "file": 1 }, { "off": 10199, "file": 8 }, { "off": 12200, "file": 12 }, { "off": 848600, "file": 13 }, { "off": 33623, "file": 34 } ], "uses": [ 137, 146, 166 ] }, { "id": "micro-behaviors/communications/socket/listen::winsock-listener-imports", "atk": "T1071", "mbc": "C0001", "conf": 0.92, "crit": 3, "desc": "Winsock server listener imports", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 148, 149, 152, 154, 161 ] }, { "id": "micro-behaviors/communications/socket/multiplex::multiplex", "conf": 0.66, "crit": 3, "desc": "Socket I/O with poll or select multiplexing", "from": [ { "off": 106804, "file": 1 }, { "off": 42501, "file": 6 }, { "off": 10199, "file": 8 }, { "off": 56445, "file": 11 }, { "off": 12200, "file": 12 }, { "off": 846537, "file": 13 }, { "off": 33623, "file": 34 } ], "uses": [ 146, 679, 680, 724 ] }, { "id": "micro-behaviors/communications/socket/multiplex::wsa-enum-network-events", "atk": "T1071", "mbc": "C0001", "conf": 0.92, "crit": 3, "desc": "Enumerate socket network events", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::wsa-event-select", "atk": "T1071", "mbc": "C0001", "conf": 0.92, "crit": 3, "desc": "Bind socket to event", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/options::options-get", "conf": 0.66, "crit": 3, "desc": "Get socket options", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.66, "crit": 3, "desc": "Set socket options", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/options::setsockopt-windows", "atk": "T1040", "conf": 0.92, "crit": 3, "desc": "Configures Windows socket options", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw", "atk": "T1011", "mbc": "C0001", "conf": 0.8, "crit": 3, "desc": "Create raw network sockets", "from": [ { "file": 13 } ], "uses": [ 726 ] }, { "id": "micro-behaviors/communications/socket/receive::receive", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Receive a message from a socket", "from": [ { "off": 106830, "file": 1 }, { "off": 8423, "file": 8 }, { "off": 12236, "file": 12 }, { "off": 852331, "file": 13 }, { "off": 33691, "file": 34 } ], "uses": [ 177, 178, 179 ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvmmsg-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmmsg socket call", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses recvmsg socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::send", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Send a message to a socket", "from": [ { "off": 106825, "file": 1 }, { "off": 8415, "file": 8 }, { "off": 12248, "file": 12 }, { "off": 852421, "file": 13 }, { "off": 33649, "file": 34 } ], "uses": [ 182, 183, 184 ] }, { "id": "micro-behaviors/communications/socket/send::send-data-reference", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "References a send_data send helper", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses send socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendmsg socket call", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/socket/send::sendto-symbol", "mbc": "C0001", "conf": 0.66, "crit": 3, "desc": "Uses sendto socket call", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/ssl::gnutls-record-send-recv-source", "conf": 0.9, "crit": 3, "desc": "GnuTLS record send or receive call", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/tcp::sock-stream", "conf": 0.5, "crit": 3, "desc": "SOCK_STREAM socket type", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/socket/udp::sock-dgram", "conf": 0.7, "crit": 3, "desc": "UDP socket type constant", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/transfer::native-snapshot-before-upload-language", "conf": 0.95, "crit": 3, "desc": "Snapshot/export wording before upload", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/websocket/library::websocket-class-reference", "conf": 0.5, "crit": 3, "desc": "WebSocket class reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 3, "desc": "References certificate terminology", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::powershell-self-signed-cert", "conf": 0.95, "crit": 3, "desc": "Creates self-signed certificate", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6, "crit": 3, "desc": "References X.509 certificate terminology", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/crypto/cipher::cipher-keyword", "conf": 0.4, "crit": 3, "desc": "Generic cipher term", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5", "conf": 0.95, "crit": 3, "desc": "MD5 hashing functions", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-offset-basis", "conf": 0.8, "crit": 3, "desc": "FNV1a hash offset basis constant", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-prime-32bit-literal", "conf": 0.7, "crit": 3, "desc": "FNV-1a 32-bit prime constant (0x01000193)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-prime-64bit-literal", "conf": 0.85, "crit": 3, "desc": "FNV-1a 64-bit prime constant (0x100000001B3)", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-prime-64bit-movabs", "conf": 0.92, "crit": 3, "desc": "FNV-1a 64-bit prime loaded via movabs (x64)", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/crypto/hash/fnv::fnv1a-x86-prime-imul", "conf": 0.85, "crit": 3, "desc": "FNV1a prime multiply loop", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/crypto/library/keyword::openssl-evp-encrypt", "conf": 0.9, "crit": 3, "desc": "OpenSSL EVP encryption functions", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-dll-name", "mbc": "C0021", "conf": 0.9, "crit": 3, "desc": "Windows BCrypt DLL name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-open-algorithm-provider", "mbc": "C0021", "conf": 0.9, "crit": 3, "desc": "Windows BCrypt algorithm provider API", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::dos-register-byte-xor-loop", "conf": 0.9, "crit": 3, "desc": "DOS register byte XOR loop", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/data/codec::deflate-inflate", "conf": 0.9, "crit": 3, "desc": "Zlib deflate and inflate", "from": [ { "off": 43124, "file": 1 }, { "off": 839825, "file": 13 } ], "uses": [ 205, 211 ] }, { "id": "micro-behaviors/data/compress/zlib::deflate", "conf": 0.8, "crit": 3, "desc": "References the zlib deflate routine", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/compress/zstd::zstd-compress", "conf": 0.9, "crit": 3, "desc": "ZSTD_compress function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::indexed-function-table-indirect-call-x64", "conf": 0.9, "crit": 3, "desc": "x64 indexed indirect call through function table", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::repeated-stack-table-indirect-calls-x64", "conf": 0.97, "crit": 3, "desc": "Repeated x64 stack-table indirect calls", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::direct-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Invokes zero-argument function at module scope" }, { "id": "micro-behaviors/data/decode/charset::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode" }, { "id": "micro-behaviors/data/decompress/zlib::inflate", "conf": 0.8, "crit": 3, "desc": "References the zlib inflate routine", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/decompress/zstd::zstd-decompress", "conf": 0.9, "crit": 3, "desc": "ZSTD_decompress function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk-x64", "atk": "T1620", "mbc": "B0005", "conf": 0.9, "crit": 3, "desc": "x64 inline PE e_lfanew header walk", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::inline-pe-signature-check", "conf": 0.85, "crit": 3, "desc": "Inline PE signature validation constant", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::pe-e-lfanew-read-x64", "conf": 0.9, "crit": 3, "desc": "x64 reads the PE e_lfanew field", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::pe-mz-compare-x64", "conf": 0.94, "crit": 3, "desc": "x64 code compares PE MZ magic", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::x86-inline-e-lfanew-pe-walk", "atk": "T1620", "mbc": "B0005", "conf": 0.97, "crit": 3, "desc": "x86 e_lfanew to PE signature walk", "from": [ { "file": 60 } ] }, { "id": "micro-behaviors/data/embedded/runtime::zstd-core-support", "conf": 0.95, "crit": 3, "desc": "ZSTD core decompression support", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/embedded/script::embedded-shell-shebang", "conf": 0.8, "crit": 3, "desc": "POSIX shell shebang embedded in a file", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/encode/image/gdiplus::gdiplus-image-encode", "atk": "T1113", "conf": 0.9, "crit": 3, "desc": "GDI+ in-memory image encoding pipeline", "from": [ { "off": 3030968, "file": 61 } ], "uses": [ 221, 650 ] }, { "id": "micro-behaviors/data/encode/image/gdiplus::save-image-to-stream", "atk": "T1113", "conf": 0.9, "crit": 3, "desc": "GDI+ save image to memory stream", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/format/container::hdf5-external-reader-call", "conf": 0.95, "crit": 3, "desc": "HDF5 external storage reader call", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/data/format/json::command-field", "conf": 0.9, "crit": 3, "desc": "command field-name token", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/format/json::executed-field", "conf": 0.9, "crit": 3, "desc": "executed field-name token", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/format/pe-parser::pe-header-walk-x64", "conf": 0.75, "crit": 3, "desc": "Reads PE e_lfanew using x64 movsxd", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/llm/agent::native-ai-agent-identity", "conf": 0.95, "crit": 3, "desc": "Native AI coding-agent reference", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/property/write::powershell-remove-item-property-call", "conf": 0.98, "crit": 3, "desc": "Removes a PowerShell provider property", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/data/serialize/json::nlohmann-json-abi", "mbc": "C0018", "conf": 0.9, "crit": 3, "desc": "nlohmann JSON ABI runtime string", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/string/assembly::stack-immediate-byte-string-x64", "conf": 0.86, "crit": 3, "desc": "Native stack immediate byte-string fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias", "conf": 0.9, "crit": 3, "desc": "Aliases String.fromCharCode conversion function" }, { "id": "micro-behaviors/data/string/measure::sys-string-len", "conf": 0.85, "crit": 3, "desc": "SysStringLen OLE BSTR length import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/string/split::strtok-import", "conf": 0.85, "crit": 3, "desc": "Native strtok delimiter parser import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/dylib/library/libm::libm-cos-symbol", "conf": 0.85, "crit": 3, "desc": "libm cos import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/dylib/library/libm::libm-pow-symbol", "conf": 0.85, "crit": 3, "desc": "libm pow import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/dylib/library/libm::libm-sin-symbol", "conf": 0.85, "crit": 3, "desc": "libm sin import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/dylib/library/libm::libm-tan-symbol", "conf": 0.85, "crit": 3, "desc": "libm tan import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlerror", "atk": "T1574.006", "conf": 0.8, "crit": 3, "desc": "Dynamic linker error handling", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.9, "crit": 3, "desc": "Dynamic library loading via dlopen", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.85, "crit": 3, "desc": "Dynamic library loading and symbol lookup", "from": [ { "off": 106966, "file": 1 }, { "off": 5763, "file": 2 }, { "off": 9266, "file": 3 }, { "off": 11137, "file": 4 }, { "off": 2621, "file": 5 }, { "off": 41736, "file": 6 }, { "off": 11900, "file": 12 } ], "uses": [ 238, 248 ] }, { "id": "micro-behaviors/dylib/load/runtime::dlsym-with-cleanup", "atk": "T1574.006", "conf": 0.85, "crit": 3, "desc": "Dynamic symbol lookup with library cleanup", "from": [ { "off": 106966, "file": 1 }, { "off": 5770, "file": 2 }, { "off": 9273, "file": 3 }, { "off": 11144, "file": 4 }, { "off": 2628, "file": 5 }, { "off": 41743, "file": 6 }, { "off": 14965, "file": 12 } ], "uses": [ 237, 245, 248 ] }, { "id": "micro-behaviors/dylib/load/runtime::glib-gmodule-open", "atk": "T1574.006", "conf": 0.9, "crit": 3, "desc": "Dynamic library loading via GLib GModule", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/dylib/load/runtime::glib-gmodule-symbol", "atk": "T1574.006", "conf": 0.9, "crit": 3, "desc": "GLib GModule symbol lookup", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-a", "conf": 0.95, "crit": 3, "desc": "Dynamic library loading via LoadLibraryA", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-ex-a", "atk": "T1574.002", "conf": 0.95, "crit": 3, "desc": "Extended dynamic library loading (ANSI)", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/dylib/load/unload::dlclose", "atk": "T1574.006", "conf": 0.8, "crit": 3, "desc": "dlclose symbol reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/lookup::dladdr", "conf": 0.85, "crit": 3, "desc": "Address to symbol lookup", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/dylib/lookup::dladdr-import", "conf": 0.85, "crit": 3, "desc": "Imports dladdr address-to-symbol lookup", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.9, "crit": 3, "desc": "dlsym function symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/lookup::get-proc-address-import", "conf": 0.9, "crit": 3, "desc": "GetProcAddress import for export lookup", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/fs/attributes/xattr::lsetxattr-func", "conf": 0.66, "crit": 3, "desc": "Set extended attribute (no symlink)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/attributes/xattr::xattr-get-fgetxattr", "conf": 0.75, "crit": 3, "desc": "Read extended file attribute value by fd", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/attributes/xattr::xattr-get-lgetxattr", "conf": 0.75, "crit": 3, "desc": "Reads an extended attribute (no symlink)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/attributes/xattr::xattr-list-llistxattr", "conf": 0.75, "crit": 3, "desc": "llistxattr extended-attribute API reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/attributes/xattr::xattr-remove-lremovexattr", "conf": 0.66, "crit": 3, "desc": "Removes an extended attribute (no symlink)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/build-artifacts::build-output-prune-context", "conf": 0.85, "crit": 3, "desc": "Mentions build-output pruning", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-symbol", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "References chmod permission-change API", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/chmod/modify::fchmod-symbol", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "References fchmod permission-change API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4, "crit": 3, "desc": "References umask file-creation mask API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/chown::fchownat-fn", "conf": 0.66, "crit": 3, "desc": "Change file ownership by dirfd/path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/delete/directory::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Contains rm -rf directory-deletion command", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/delete/directory::windows-rd-recursive", "conf": 1.0, "crit": 3, "desc": "Recursive delete via rd/rmdir /s", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/delete/file/command::powershell-remove-item-force", "conf": 0.7, "crit": 3, "desc": "PowerShell Remove-Item with -Force", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/delete/file/library::deletefile-w", "conf": 0.66, "crit": 3, "desc": "DeleteFileW API symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/delete/file/library::remove", "conf": 0.3, "crit": 3, "desc": "Delete files", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/delete/file/library::static-unlink-symbol-text", "atk": "T1070.004", "mbc": "C0047", "conf": 0.72, "crit": 3, "desc": "Static executable contains unlink symbol", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/delete/file/library::unlink", "conf": 0.3, "crit": 3, "desc": "References unlink file-delete API", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/delete/file/syscall::unlinkat", "conf": 0.3, "crit": 3, "desc": "Delete files by fd/path", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/device/ioctl::ioctl", "conf": 0.66, "crit": 3, "desc": "Device control request via ioctl", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/device/mknod::mknodat", "conf": 0.66, "crit": 3, "desc": "Create device files", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::powershell-new-item-directory", "conf": 0.9, "crit": 3, "desc": "PowerShell creates a directory with New-Item", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "conf": 0.66, "crit": 3, "desc": "Uses fdopendir", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.66, "crit": 3, "desc": "Uses opendir", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.66, "crit": 3, "desc": "Uses readdir", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "conf": 0.66, "crit": 3, "desc": "Uses readdir64", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-rewinddir", "conf": 0.66, "crit": 3, "desc": "Uses rewinddir", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-seekdir", "conf": 0.66, "crit": 3, "desc": "Uses seekdir", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-telldir", "conf": 0.66, "crit": 3, "desc": "Uses telldir", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/directory/traverse::powershell-recursive-child-item", "conf": 0.9, "crit": 3, "desc": "PowerShell recursively enumerates files", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/directory/traverse::std-filesystem-runtime", "conf": 0.92, "crit": 3, "desc": "C++ filesystem runtime DLL reference", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/fs/disk/partition::partition-table-copy", "conf": 0.92, "crit": 3, "desc": "Partition info string reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::file-enumeration-with-access", "conf": 0.9, "crit": 3, "desc": "Directory enumeration with file-content access", "from": [ { "file": 61 } ], "uses": [ 289, 652, 654, 659, 666 ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-disk-free-space", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "GetDiskFreeSpace API import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-volume-info", "conf": 0.9, "crit": 3, "desc": "Windows volume-information API name reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/file/binary::file-position-api", "conf": 0.78, "crit": 3, "desc": "References a file-position API", "from": [ { "file": 3 }, { "file": 4 }, { "off": 42844, "file": 6 }, { "off": 853217, "file": 13 } ], "uses": [ 655, 656, 657 ] }, { "id": "micro-behaviors/fs/file/binary::seek-and-descriptor-io", "conf": 0.8, "crit": 3, "desc": "Reads or writes a seeked file descriptor", "from": [ { "file": 3 } ], "uses": [ 285, 665, 667 ] }, { "id": "micro-behaviors/fs/file/copy::powershell-copy-item-command", "conf": 0.9, "crit": 3, "desc": "References the PowerShell Copy-Item command", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/file/handle::device-io-control-win", "conf": 0.85, "crit": 3, "desc": "DeviceIoControl API usage", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.66, "crit": 3, "desc": "References C fopen file-open API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/rename::any-rename", "conf": 0.9, "crit": 3, "desc": "Rename or move file on Windows", "from": [ { "file": 61 } ], "uses": [ 658 ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.8, "crit": 3, "desc": "References stat-family file-status API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-legacy64", "conf": 0.8, "crit": 3, "desc": "Read file status and metadata (legacy 64-bit)", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/timestamp::utimensat-symbol", "conf": 0.6, "crit": 3, "desc": "References utimensat timestamp API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 3, "desc": "Read symbolic link target path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/path/app-data::desktop-path-token", "conf": 0.85, "crit": 3, "desc": "Explicit Desktop path token in content", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/application/executable::cmd-exe-image-name", "conf": 0.9, "crit": 3, "desc": "References cmd.exe by image name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/application/executable::explorer-executable-reference", "conf": 0.94, "crit": 3, "desc": "References Windows Explorer executable name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/application/executable::powershell-executable-token", "conf": 0.98, "crit": 3, "desc": "PowerShell executable name reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/application/executable::windows-script-host-executable-reference", "conf": 0.8, "crit": 3, "desc": "Windows Script Host executable reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/filename-credential::windows-system-hive-path", "conf": 0.96, "crit": 3, "desc": "References Windows SYSTEM hive path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/library::windows-kernel-module-reference", "conf": 1.0, "crit": 3, "desc": "ntoskrnl or storport kernel module reference", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/fs/path/system::programdata-directory-path", "conf": 0.82, "crit": 3, "desc": "ProgramData directory path reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/path/system::system-boot", "conf": 0.66, "crit": 3, "desc": "Reference to /boot", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/system::windows-common-data-tree-path", "conf": 0.78, "crit": 3, "desc": "Windows ProgramData/Users/inetpub path", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/fs/path/system::windows-system32", "atk": "T1083", "mbc": "E1083", "conf": 0.66, "crit": 3, "desc": "Windows System32 directory reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::native-transient-staging-directory", "conf": 0.8, "crit": 3, "desc": "Native binary references transient staging path", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/proc/cmdline::process-pid-cmdline-format", "conf": 0.72, "crit": 3, "desc": "Process cmdline path format", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/cmdline::process-pid-cmdline-token", "conf": 0.72, "crit": 3, "desc": "Procfs process command-line path fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/exe::process-self-exe-path", "conf": 0.66, "crit": 3, "desc": "References own executable procfs path", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/proc/info/cmdline::native-proc-pid-cmdline-path", "conf": 0.7, "crit": 3, "desc": "Builds /proc/\u003cpid\u003e/cmdline path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/info/path::proc-exe-fragment-cluster", "conf": 0.78, "crit": 3, "desc": "Procfs executable path fragments", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-arbitrary", "conf": 0.66, "crit": 3, "desc": "Access /proc for arbitrary PIDs", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-fd-path", "conf": 0.7, "crit": 3, "desc": "References own file-descriptor procfs directory", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/info/pid::process-pid-cmdline-template", "conf": 0.7, "crit": 3, "desc": "Procfs process command-line path template", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/system::system-meminfo", "conf": 0.66, "crit": 3, "desc": "Get memory info from /proc/meminfo", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/read/file/full::get-content", "conf": 0.86, "crit": 3, "desc": "PowerShell reads file content", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/read/file/full::get-content-raw", "conf": 0.94, "crit": 3, "desc": "PowerShell reads a whole file", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/read/file/handle::ansi-module-path-file-io-import-set", "conf": 0.8, "crit": 3, "desc": "ANSI module-path and file-I/O import set", "from": [ { "file": 59 } ], "uses": [ 659, 660, 666, 682 ] }, { "id": "micro-behaviors/fs/search::dos-int21-find-first-near", "conf": 0.86, "crit": 3, "desc": "DOS find-first through a near call", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-import", "conf": 0.88, "crit": 3, "desc": "Imports GetTempPath temp-directory API", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "atk": "T1083", "mbc": "E1083", "conf": 0.75, "crit": 3, "desc": "References GetLogicalDrives API name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/watch::inotify-add-watch", "conf": 0.66, "crit": 3, "desc": "Adds an inotify watch on a path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/watch::inotify-init1", "conf": 0.66, "crit": 3, "desc": "Creates an inotify instance with flags", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/watch::inotify-rm-watch", "conf": 0.66, "crit": 3, "desc": "Remove an inotify filesystem watch", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/write/file/full::out-file", "conf": 0.9, "crit": 3, "desc": "Calls PowerShell Out-File", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/fs/write/file/full::powershell-set-content-call", "mbc": "C0047", "conf": 0.92, "crit": 3, "desc": "PowerShell writes file with Set-Content", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/hardware/block/device::sys-block-dup", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Access block device info via /sys/dev/block", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/hardware/display/directx/calls::directx-device-d3d11", "conf": 0.7, "crit": 3, "desc": "D3D11CreateDevice API", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/display/directx/calls::dxgi-output-duplication-iid", "conf": 0.9, "crit": 3, "desc": "IDXGIOutputDuplication interface IID", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/hardware/display/directx/calls::dxgi-output1-iid", "conf": 0.85, "crit": 3, "desc": "IDXGIOutput1 IID exposing DuplicateOutput", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/hardware/display/screen::gdi-getdibits", "atk": "T1113", "mbc": "C0014", "conf": 0.9, "crit": 3, "desc": "GDI GetDIBits pixel readback import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/hardware/display/screen::winrt-direct3d11-framepool", "atk": "T1113", "mbc": "C0014", "conf": 0.96, "crit": 3, "desc": "WinRT Direct3D11 frame pool", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/display/screenshot::winrt-graphics-capture-session", "atk": "T1113", "mbc": "C0014", "conf": 0.96, "crit": 3, "desc": "WinRT GraphicsCapture opens capture session", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/flash/device::flash-erase-command", "conf": 0.9, "crit": 3, "desc": "mtd-utils flash erase command", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/hardware/input/idle-time::get-last-input-info", "conf": 0.7, "crit": 3, "desc": "Windows GetLastInputInfo idle-state API", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/layout::map-virtual-key", "atk": "T1056.001", "mbc": "E1056.001", "conf": 0.85, "crit": 3, "desc": "Map virtual key code", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/layout::map-virtual-key-str", "conf": 0.8, "crit": 3, "desc": "MapVirtualKey API string reference", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/hardware/input/synthesize::sendinput-api-name", "conf": 0.9, "crit": 3, "desc": "SendInput input-synthesis API name", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/mem/alloc/virtual::virtual-alloc", "conf": 0.9, "crit": 3, "desc": "Imports VirtualAlloc memory allocation API", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/mem/anonymous/create::memfd-create", "atk": "T1055", "mbc": "C0007", "conf": 0.8, "crit": 3, "desc": "References the memfd_create anonymous-memory API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/mem/combined::pe-memory-management-api-set", "conf": 1.0, "crit": 3, "desc": "PE memory management API references", "from": [ { "file": 39 } ], "uses": [ 673, 674 ] }, { "id": "micro-behaviors/mem/fill::vectorized-zero-fill", "conf": 0.6, "crit": 3, "desc": "Vectorized zero-fill instruction sequence", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/mem/lock/pages::mlockall", "conf": 0.7, "crit": 3, "desc": "Lock all memory pages (mlockall)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/mem/protect/modify::mm-map-io-space", "atk": "T1055", "conf": 0.9, "crit": 3, "desc": "Map physical I/O space in kernel", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/mem/protect/modify::mprotect-import", "conf": 0.9, "crit": 3, "desc": "Imports mprotect memory protection", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect", "mbc": "C0021", "conf": 0.95, "crit": 3, "desc": "Modify memory page protection", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/mem/read/physical::physical-address-translation", "conf": 0.95, "crit": 3, "desc": "Resolve physical address from virtual pointer", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/network/interface::get-adapters-addresses", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Enumerate local network adapter addresses", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::get-proc-address-resolved-name", "atk": "T1574.002", "conf": 0.92, "crit": 3, "desc": "GetProcAddress API name absent from imports", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/os/api-resolution/hash-based::multiplicative-hash-loop-x64", "atk": "T1027.002", "mbc": "F0004", "conf": 0.85, "crit": 3, "desc": "Multiplicative hash inner loop", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/autorun/login-items::desktop-entry-header", "conf": 0.6, "crit": 3, "desc": "Embedded Desktop Entry header fragment", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::get-scheduledtask", "conf": 0.9, "crit": 3, "desc": "Queries Windows scheduled tasks", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::windows-update-scheduled-task-path", "conf": 0.98, "crit": 3, "desc": "Windows Update task namespace reference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/bpf/network-infra::has-bpf-infra", "conf": 0.6, "crit": 3, "desc": "Has BPF infrastructure components", "from": [ { "file": 1 }, { "file": 8 }, { "file": 12 }, { "off": 1354045, "file": 13 }, { "file": 34 } ], "uses": [ 176, 675 ] }, { "id": "micro-behaviors/os/bpf/program/icmp::cbpf-load-icmp-id-ethernet", "conf": 0.74, "crit": 3, "desc": "cBPF load ICMP identifier field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/bpf/program/loader::bpf-object-load", "conf": 0.8, "crit": 3, "desc": "Load BPF object into kernel", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/bpf/program/loader::bpf-object-open", "conf": 0.8, "crit": 3, "desc": "Load BPF object from file", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/bpf/program/maps::bpf-map-lookup", "conf": 0.7, "crit": 3, "desc": "BPF map lookup helper", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/bpf/program/network::xdp-data-end", "conf": 0.5, "crit": 3, "desc": "XDP data_end pointer", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/bpf/program/network::xdp-packet-inspection", "conf": 0.7, "crit": 3, "desc": "XDP packet header inspection primitives", "from": [ { "off": 13132779, "file": 13 } ], "uses": [ 118, 359, 643 ] }, { "id": "micro-behaviors/os/bpf/program/tracing::sk-buff-struct", "conf": 0.6, "crit": 3, "desc": "struct __sk_buff TC program context", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/bpf/trace-frameworks::libbpf", "conf": 0.85, "crit": 3, "desc": "libbpf library", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/com/session::wts-enumerate-sessions-api", "atk": "T1559.001", "conf": 0.86, "crit": 3, "desc": "Enumerate terminal sessions", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/env/block::create-environment-block", "conf": 0.8, "crit": 3, "desc": "Build user environment block", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/env/read::get-environment-variable", "conf": 0.85, "crit": 3, "desc": "Read a process env var (GetEnvironmentVariable)", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/env/read::get-environment-variable-name-reference", "conf": 0.86, "crit": 3, "desc": "References GetEnvironmentVariable API name", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/env/read::native-getenv", "conf": 0.8, "crit": 3, "desc": "References the getenv environment-query API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/secret-name::native-password-like-identifier", "conf": 0.82, "crit": 3, "desc": "Password-like identifier string in native code", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/event/epoll::epoll-usage", "conf": 0.65, "crit": 3, "desc": "Uses multiple epoll event APIs", "from": [ { "off": 851635, "file": 13 } ], "uses": [ 676, 677, 678 ] }, { "id": "micro-behaviors/os/event/log::get-winevent-command", "conf": 0.82, "crit": 3, "desc": "PowerShell Get-WinEvent command reference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/group/lookup::convert-sid-to-string", "conf": 0.8, "crit": 3, "desc": "Convert SID to string representation", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/group/lookup::lookup-account-sid", "conf": 0.8, "crit": 3, "desc": "Resolve SID to account/group name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/kernel/module::modprobe-cmd", "conf": 0.8, "crit": 3, "desc": "modprobe kernel module loader", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/kernel/module::native-kernel-api-context", "conf": 0.98, "crit": 3, "desc": "Native PE using Windows kernel-driver APIs", "from": [ { "file": 48 } ], "uses": [ 10, 481 ] }, { "id": "micro-behaviors/os/kernel/module::sys-extension", "conf": 0.9, "crit": 3, "desc": "Windows .sys driver filename", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/kernel/module::zwload-driver-api-reference", "conf": 0.94, "crit": 3, "desc": "ZwLoadDriver named for kernel service load", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/kernel/routines::ob-open-object-by-pointer", "conf": 0.94, "crit": 3, "desc": "ObOpenObjectByPointer kernel API", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.7, "crit": 3, "desc": "Get module handle ANSI", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ex", "conf": 0.82, "crit": 3, "desc": "Get extended module handle", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.78, "crit": 3, "desc": "Get module handle Unicode", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/network/mac_address::qemu-kvm-prefix", "conf": 0.9, "crit": 3, "desc": "References QEMU/KVM MAC address prefix 52:54:00", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/network/tunnel::dev-net-tun", "atk": "T1090", "conf": 0.6, "crit": 3, "desc": "/dev/net/tun device", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/network/tunnel::dev-tap", "atk": "T1090", "conf": 0.5, "crit": 3, "desc": "/dev/tap device", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/pam/auth::libpam-so-string", "conf": 0.6, "crit": 3, "desc": "libpam.so library string", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/pam/auth::libpam-string", "conf": 0.5, "crit": 3, "desc": "libpam library reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/pam/auth::pam-acct-mgmt", "conf": 0.6, "crit": 3, "desc": "PAM account validation call", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/pam/auth::pam-api-functions", "conf": 0.7, "crit": 3, "desc": "PAM API function usage", "from": [ { "off": 850334, "file": 13 } ], "uses": [ 386, 684, 685 ] }, { "id": "micro-behaviors/os/pam/client::pam-start-api", "conf": 0.86, "crit": 3, "desc": "PAM start API usage", "from": [ { "file": 13 } ], "uses": [ 685 ] }, { "id": "micro-behaviors/os/privilege/check::localsystem-account-name", "atk": "T1033", "conf": 0.94, "crit": 3, "desc": "Names the Windows LocalSystem identity", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges", "conf": 0.8, "crit": 3, "desc": "AdjustTokenPrivileges API symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges-any", "conf": 0.82, "crit": 3, "desc": "AdjustTokenPrivileges API reference", "from": [ { "file": 61 } ], "uses": [ 390 ] }, { "id": "micro-behaviors/os/privilege/token::backup-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Backup privilege name string", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::duplicate-token-ex", "conf": 0.8, "crit": 3, "desc": "Duplicate a Windows token with extended options", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name", "conf": 0.9, "crit": 3, "desc": "References high-risk Windows token privilege", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name-beyond-debug", "conf": 0.9, "crit": 3, "desc": "High-risk privilege beyond SeDebug named", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-take-ownership-privilege-name", "conf": 0.9, "crit": 3, "desc": "References SeTakeOwnershipPrivilege token", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value", "conf": 0.75, "crit": 3, "desc": "LookupPrivilegeValue API symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value-any", "conf": 0.8, "crit": 3, "desc": "LookupPrivilegeValue API reference", "from": [ { "file": 61 } ], "uses": [ 397 ] }, { "id": "micro-behaviors/os/privilege/token::open-process-token", "conf": 0.75, "crit": 3, "desc": "OpenProcessToken API symbol", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/privilege/token::open-process-token-any", "conf": 0.8, "crit": 3, "desc": "Open process access token", "from": [ { "file": 39 }, { "file": 40 }, { "off": 624000, "file": 59 }, { "file": 60 }, { "file": 61 } ], "uses": [ 399 ] }, { "id": "micro-behaviors/os/privilege/token::privilege-adjustment-user-launch-api-set", "conf": 0.96, "crit": 3, "desc": "Token adjustment and user-launch API references", "from": [ { "file": 39 }, { "file": 40 }, { "off": 624000, "file": 59 }, { "file": 60 }, { "off": 2562851, "file": 61 } ], "uses": [ 390, 394, 397, 399, 527 ] }, { "id": "micro-behaviors/os/privilege/token::query-session-user-token", "conf": 0.9, "crit": 3, "desc": "Query interactive session access token", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::restore-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Restore privilege name string", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::sedebug-privilege-name", "conf": 0.9, "crit": 3, "desc": "SeDebugPrivilege privilege name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::set-token-information", "atk": "T1134", "conf": 0.86, "crit": 3, "desc": "Modify access-token attributes", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/privilege/token::token-privilege-adjustment-references", "conf": 0.88, "crit": 3, "desc": "Token privilege adjustment API references", "from": [ { "file": 39 }, { "file": 40 }, { "file": 59 }, { "file": 60 }, { "off": 2562851, "file": 61 } ], "uses": [ 391, 394, 398, 400 ] }, { "id": "micro-behaviors/os/registry/access::powershell-registry-read", "atk": "T1012,T1112", "conf": 0.9, "crit": 3, "desc": "PowerShell reads a registry value", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "atk": "T1112", "conf": 0.92, "crit": 3, "desc": "Create registry key via WinAPI", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "Enumerate registry values via import", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Open registry key via import symbol ANSI", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Open registry key via import symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "atk": "T1112", "conf": 0.85, "crit": 3, "desc": "Query registry value via import symbol", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Query registry value via import symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/access::registry-create-key-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key creation API", "from": [ { "off": 3030720, "file": 61 } ], "uses": [ 408 ] }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key open API", "from": [ { "file": 39 }, { "file": 40 }, { "off": 624024, "file": 59 }, { "off": 680760, "file": 60 }, { "off": 3030744, "file": 61 } ], "uses": [ 410, 411 ] }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "Registry value query API", "from": [ { "file": 39 }, { "file": 40 }, { "file": 59 }, { "file": 60 }, { "file": 61 } ], "uses": [ 412, 413 ] }, { "id": "micro-behaviors/os/registry/access::registry-read-api-chain", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key open and query chain", "from": [ { "file": 39 }, { "file": 40 }, { "file": 59 }, { "file": 60 }, { "file": 61 } ], "uses": [ 415, 416 ] }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry value write API", "from": [ { "file": 61 } ], "uses": [ 433 ] }, { "id": "micro-behaviors/os/registry/access::registry-write-api-chain", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key and value write chain", "from": [ { "file": 39 }, { "file": 40 }, { "file": 59 }, { "file": 60 }, { "file": 61 } ], "uses": [ 414, 415, 418 ] }, { "id": "micro-behaviors/os/registry/access::windows-uninstall-key-path", "conf": 0.9, "crit": 3, "desc": "Windows uninstall registry key path string", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/keys::ifeo-key-reference", "conf": 0.9, "crit": 3, "desc": "Image File Execution Options key reference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/keys::no-auto-update-policy-value", "conf": 0.97, "crit": 3, "desc": "NoAutoUpdate registry policy value name", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/keys::system-services-registry-path", "conf": 0.9, "crit": 3, "desc": "Windows system services registry path", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/registry/keys::task-scheduler-registry-path", "atk": "T1053.005", "conf": 0.94, "crit": 3, "desc": "Windows Task Scheduler registry path", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/keys::windows-update-policy-registry-path", "conf": 0.98, "crit": 3, "desc": "Windows Update machine-policy registry path", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/keys::winlogon-registry-path", "conf": 0.9, "crit": 3, "desc": "Windows Winlogon registry key path", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "RegDeleteValueW registry value deletion", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "atk": "T1112", "conf": 0.92, "crit": 3, "desc": "Registry open create and write APIs", "from": [ { "file": 39 }, { "file": 40 }, { "file": 59 }, { "file": 60 }, { "off": 3030720, "file": 61 } ], "uses": [ 408, 411, 413, 414, 415, 416, 417, 418, 419, 420 ] }, { "id": "micro-behaviors/os/registry/write::crash-control-registry-path", "atk": "T1112", "conf": 0.96, "crit": 3, "desc": "References the Windows CrashControl key", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/write::powershell-machine-registry-path", "atk": "T1112", "mbc": "C0036", "conf": 0.9, "crit": 3, "desc": "PowerShell HKLM registry path", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/write::powershell-new-itemproperty-variable-path", "atk": "T1112", "mbc": "C0036", "conf": 0.95, "crit": 3, "desc": "New-ItemProperty uses path variable", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/write::powershell-registry-property-cmd", "atk": "T1112", "mbc": "C0036", "conf": 0.92, "crit": 3, "desc": "PowerShell New or Set-ItemProperty command", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/registry/write::reg-set-value-ex-w", "atk": "T1112", "conf": 0.85, "crit": 3, "desc": "Set registry value via WinAPI", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/security/auth/passkey::windows-webauthn-event-query-call", "conf": 0.88, "crit": 3, "desc": "Queries a Windows event log result set", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-exclusion-command", "conf": 0.96, "crit": 3, "desc": "Defender exclusion mutation command text", "from": [ { "file": 58 } ], "uses": [ 439, 441 ] }, { "id": "micro-behaviors/os/security/defender::defender-exclusion-command-line", "conf": 0.97, "crit": 3, "desc": "Bare Defender exclusion mutation command line", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-exclusion-command-reference", "conf": 0.95, "crit": 3, "desc": "Defender exclusion mutation command text", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-exclusion-option-text", "conf": 0.95, "crit": 3, "desc": "Defender exclusion option reference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-exclusion-path-parameter", "conf": 0.92, "crit": 3, "desc": "Defender exclusion path parameter", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-preference-mutation-call", "conf": 0.99, "crit": 3, "desc": "Calls Set-MpPreference or Add-MpPreference", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::defender-preference-option-prefix", "conf": 0.96, "crit": 3, "desc": "Add-MpPreference command option prefix", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/security/defender::powershell-exclusion-assignment", "conf": 0.95, "crit": 3, "desc": "Defender exclusion mutation call or command", "from": [ { "off": 22157, "file": 58, "line": 443 } ], "uses": [ 436, 437, 440 ] }, { "id": "micro-behaviors/os/security/policy::powershell-policy-bypass-text", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "ExecutionPolicy Bypass command text", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/security/policy::powershell-policy-bypass-token-sequence", "atk": "T1059.001", "conf": 0.9, "crit": 3, "desc": "PowerShell policy and Bypass token sequence", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/security/sandbox::linux-seccomp", "conf": 0.95, "crit": 3, "desc": "Linux seccomp sandbox enabled", "from": [ { "file": 13 } ], "uses": [ 446, 447, 448 ] }, { "id": "micro-behaviors/os/security/sandbox::seccomp-init", "conf": 0.95, "crit": 3, "desc": "Linux seccomp sandbox initialization", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/security/sandbox::seccomp-load", "conf": 0.95, "crit": 3, "desc": "Linux seccomp profile loading", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/security/sandbox::seccomp-rule-add", "conf": 0.9, "crit": 3, "desc": "Linux seccomp rule addition", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/service/daemon::service-cli-flag", "conf": 0.6, "crit": 3, "desc": "Command line has a --service flag", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/service/dispatch::register-service-handler", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Register service control handler", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/service/dispatch::service-control-dispatch", "atk": "T1543.003", "conf": 0.92, "crit": 3, "desc": "Windows service control dispatch", "from": [ { "file": 61 } ], "uses": [ 450, 453, 454 ] }, { "id": "micro-behaviors/os/service/dispatch::service-dispatch-triad", "atk": "T1543.003", "conf": 0.95, "crit": 3, "desc": "Full Windows service dispatch triplet", "from": [ { "file": 61 } ], "uses": [ 450, 453, 454 ] }, { "id": "micro-behaviors/os/service/dispatch::set-service-status", "atk": "T1543.003", "conf": 0.88, "crit": 3, "desc": "Report service status updates", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/service/dispatch::start-service-dispatcher", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Start service control dispatcher", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/service/host::service-imagepath-value-name", "conf": 0.88, "crit": 3, "desc": "Service ImagePath registry value marker", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/service/stop::powershell-stop-service-command", "conf": 0.95, "crit": 3, "desc": "PowerShell stops a named service", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/syscall/invoke::syscall-wrapper-import", "conf": 0.99, "crit": 3, "desc": "Imports the Unix syscall wrapper API", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/sysinfo/config::set-system-time-api", "conf": 0.86, "crit": 3, "desc": "Windows API that sets system time", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/os/sysinfo/cpu::sys-devices", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Access CPU info via /sys/devices", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/device-enum::cm-locate-devnode-w", "conf": 0.9, "crit": 3, "desc": "Locate hardware device node", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/sysinfo/device-enum::setupdi-get-class-devs-w", "conf": 0.9, "crit": 3, "desc": "Enumerate device classes via SetupAPI wide API", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/sysinfo/device-enum::setupdi-get-device-registry-property", "conf": 0.9, "crit": 3, "desc": "Query device registry property via SetupAPI", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Query computer/host name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/sysinfo/machine-id::hardware-id-string", "conf": 0.7, "crit": 3, "desc": "hardware_id string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/machine-id::python-device-id-getter", "conf": 0.9, "crit": 3, "desc": "Python device identifier getter reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/kernel::uname", "atk": "T1082", "mbc": "E1082", "conf": 0.6, "crit": 3, "desc": "Query system name and information", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::mips64-architecture-string", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "MIPS64 architecture target string", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::mipsel-architecture-target-string", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "MIPS little-endian target string", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::multi-architecture-target-list", "atk": "T1082", "mbc": "E1082", "conf": 0.92, "crit": 3, "desc": "Multi-architecture executable target list", "from": [ { "off": 3592376, "file": 1 }, { "off": 5864604, "file": 2 }, { "off": 5263920, "file": 3 }, { "off": 3959237, "file": 4 }, { "off": 12863572, "file": 13 } ], "uses": [ 467, 468, 471, 686 ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::repeated-architecture-suffixed-payload-names", "atk": "T1082", "mbc": "E1082", "conf": 0.96, "crit": 3, "desc": "Payload names span three processor families", "from": [ { "file": 1 }, { "off": 5970539, "file": 2 }, { "off": 5418875, "file": 3 }, { "off": 4082091, "file": 4 }, { "off": 1484941, "file": 13 } ], "uses": [ 727, 728, 729 ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::riscv32-architecture-string", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "RISC-V32 architecture target string", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/profile::win32-system-info-api-set", "conf": 0.85, "crit": 3, "desc": "Multiple Windows host-information API references", "from": [ { "off": 3014024, "file": 61 } ], "uses": [ 284, 463 ] }, { "id": "micro-behaviors/os/sysinfo/virtualization::virtio-reference", "conf": 0.5, "crit": 3, "desc": "Virtio device identifier reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/user/lookup::getpwuid", "atk": "T1033", "mbc": "E1033", "conf": 0.5, "crit": 3, "desc": "Imports UID password-entry lookup API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/user/lookup::sid-string-conversion", "conf": 0.85, "crit": 3, "desc": "ConvertSidToStringSidW API symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/user/lookup::wts-query-session-information", "conf": 0.92, "crit": 3, "desc": "Query terminal session metadata", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/os/virtualization/hypervisor::qemu-vendor-string", "conf": 0.75, "crit": 3, "desc": "References QEMU vendor string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/virtualization/hypervisor::vmware-vendor-name", "conf": 0.75, "crit": 3, "desc": "References the VMware vendor name", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/wmi/query::cim-instance-cmdlet", "conf": 0.8, "crit": 3, "desc": "Uses Get-CimInstance cmdlet", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/wmi/query::wmi-moniker-string", "conf": 0.8, "crit": 3, "desc": "WMI moniker string reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/attach/address-space::attach-process-address-space", "atk": "T1055", "conf": 0.97, "crit": 3, "desc": "Attach to foreign process address space", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/process/attach/address-space::detach-process-address-space", "conf": 0.92, "crit": 3, "desc": "Detach from foreign process address space", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/process/attach/rights::open-process", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Open process handle", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/control/affinity::set-process-affinity-mask", "conf": 0.9, "crit": 3, "desc": "Set process CPU affinity", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/control/info::process-info-class-30-constant", "atk": "T1562", "conf": 0.8, "crit": 3, "desc": "Immediate process-information class value 30", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/process/control/prctl::prctl-symbol", "conf": 0.9, "crit": 3, "desc": "prctl process-control syscall symbol", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/api-system::elf-function", "conf": 0.95, "crit": 3, "desc": "ELF dynamic function symbol named system" }, { "id": "micro-behaviors/process/create/api-system::native-import", "conf": 0.95, "crit": 3, "desc": "Native binary imports the C system function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/command-handler::execute-command-label", "conf": 0.86, "crit": 3, "desc": "Execute-command handler label", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/process/create/direct::fork-shell-operations", "atk": "T1106", "conf": 0.75, "crit": 3, "desc": "Fork and shell process operations", "from": [ { "off": 1223963, "file": 13 } ], "uses": [ 506, 512, 519 ] }, { "id": "micro-behaviors/process/create/direct::glib-child-spawn-import", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "GLib child-process spawn API import", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/direct::native-process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "References a native child-process launch call", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-attr-control", "atk": "T1106", "conf": 0.82, "crit": 3, "desc": "POSIX spawn attribute control", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-file-actions", "atk": "T1106", "conf": 0.86, "crit": 3, "desc": "POSIX spawn file actions", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-import", "atk": "T1106", "conf": 0.88, "crit": 3, "desc": "POSIX spawn process execution", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/create/direct::posix-spawn-with-fd-actions", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "POSIX spawn with FD actions", "from": [ { "off": 10503, "file": 8 } ], "uses": [ 494, 495 ] }, { "id": "micro-behaviors/process/create/exec::cmd-shell-via-createprocess", "conf": 0.95, "crit": 3, "desc": "cmd.exe /c executed via CreateProcess", "from": [ { "off": 3031104, "file": 61 } ], "uses": [ 517, 523 ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/flags::execution-policy-bypass", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "PowerShell execution-policy override options", "from": [ { "file": 61 } ], "uses": [ 443, 500, 501, 513 ] }, { "id": "micro-behaviors/process/create/flags::execution-policy-bypass-abbrev-flag", "atk": "T1059.001", "conf": 0.92, "crit": 3, "desc": "Abbreviated Exec Bypass flag", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/flags::execution-policy-bypass-spellings", "atk": "T1059.001", "conf": 0.9, "crit": 3, "desc": "PowerShell policy Bypass token patterns", "from": [ { "file": 61 } ], "uses": [ 444 ] }, { "id": "micro-behaviors/process/create/flags::powershell-no-profile-flag", "conf": 0.96, "crit": 3, "desc": "PowerShell disables profile loading", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/flags::powershell-noninteractive-flag", "conf": 0.96, "crit": 3, "desc": "PowerShell disables interactive prompts", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/flags::powershell-policy-bypass-argument", "atk": "T1059.001,T1562.001", "conf": 0.9, "crit": 3, "desc": "PowerShell execution-policy bypass argument", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/flags::powershell-policy-bypass-flag", "conf": 0.96, "crit": 3, "desc": "PowerShell execution-policy bypass option", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/fork::fork", "conf": 0.86, "crit": 3, "desc": "Process creation via fork or clone", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/hidden::hidden-console-execution", "atk": "T1564.003", "conf": 0.9, "crit": 3, "desc": "Hidden console/window execution", "from": [ { "file": 61 } ], "uses": [ 508 ] }, { "id": "micro-behaviors/process/create/hidden::powershell-windowstyle-hidden", "atk": "T1564.003", "conf": 0.86, "crit": 3, "desc": "PowerShell WindowStyle Hidden flag", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/hidden::powershell-windowstyle-hidden-option", "atk": "T1564.003", "conf": 0.9, "crit": 3, "desc": "PowerShell WindowStyle Hidden option", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/script/file::powershell-script-execution", "atk": "T1059.001", "conf": 0.7, "crit": 3, "desc": "Executes a PowerShell script file (.ps1)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.003", "conf": 0.94, "crit": 3, "desc": "cmd command-text invocation syntax", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/shell/guard::command-security-test-fixture", "conf": 0.95, "crit": 3, "desc": "Defensive command security test fixture", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "PowerShell command text with options", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/shell/path::cmd-reference-create-process-w", "atk": "T1059.003", "conf": 0.93, "crit": 3, "desc": "cmd.exe reference with CreateProcessW capability", "from": [ { "off": 2571065, "file": 61 } ], "uses": [ 296, 523 ] }, { "id": "micro-behaviors/process/create/shell/remote-powershell::powershell-policy-bypass", "atk": "T1059.001", "conf": 0.98, "crit": 3, "desc": "PowerShell execution-policy bypass option", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/shell/remote-powershell::powershell-policy-bypass-hidden", "atk": "T1059.001", "conf": 0.99, "crit": 3, "desc": "PowerShell policy bypass with hidden window", "from": [ { "off": 2571169, "file": 61 } ], "uses": [ 298, 509, 515 ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "from": [ { "file": 61 } ], "uses": [ 518 ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command-text", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh-binary-text", "conf": 0.65, "crit": 3, "desc": "References the /bin/sh shell path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/shell/target::sh-reconstructed-command-target-shape", "conf": 0.9, "crit": 3, "desc": "Dynamic shell call target shape" }, { "id": "micro-behaviors/process/create/shellexec::shell-execute-ex", "conf": 0.75, "crit": 3, "desc": "Opens a target via ShellExecuteExW", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/shellexec::shell-executeex-call", "atk": "T1059.001", "conf": 0.85, "crit": 3, "desc": "ShellExecuteEx API call", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/spawn::create-process-w", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "CreateProcessW API symbol", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/spawn::init-proc-thread-attribute-list", "atk": "T1134", "conf": 0.95, "crit": 3, "desc": "Initialize process attribute list", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/spawn::proc-thread-attribute-list", "conf": 0.96, "crit": 3, "desc": "Extended process startup attributes", "from": [ { "file": 61 } ], "uses": [ 524, 526 ] }, { "id": "micro-behaviors/process/create/spawn::update-proc-thread-attribute", "atk": "T1134", "conf": 0.95, "crit": 3, "desc": "Update process attribute list", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/sudo::create-process-as-user", "atk": "T1134", "conf": 1.0, "crit": 3, "desc": "CreateProcessAsUser API reference", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/create/thread::create-thread", "atk": "T1129", "conf": 0.95, "crit": 3, "desc": "Create thread in current process", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/process/create/thread::thread-start-api-x64", "conf": 0.92, "crit": 3, "desc": "x64 thread-start API (imported or resolved)", "from": [ { "off": 924520, "file": 43 }, { "off": 849728, "file": 44 }, { "off": 4953480, "file": 45 }, { "off": 4551320, "file": 46 }, { "off": 1056248, "file": 49 }, { "off": 933804, "file": 50 }, { "off": 1605136, "file": 51 }, { "off": 1383896, "file": 53 } ], "uses": [ 528 ] }, { "id": "micro-behaviors/process/daemonize/detach::fork-new-session", "conf": 0.75, "crit": 3, "desc": "Fork and setsid API references co-occur", "from": [ { "off": 850886, "file": 13 } ], "uses": [ 506, 532 ] }, { "id": "micro-behaviors/process/daemonize/detach::self-exe-session-detach", "conf": 0.75, "crit": 3, "desc": "Reads own executable while detaching process session", "from": [ { "off": 5868637, "file": 2 }, { "off": 5267900, "file": 3 }, { "off": 3964188, "file": 4 }, { "file": 5 }, { "off": 4714364, "file": 6 }, { "off": 850886, "file": 13 } ], "uses": [ 309, 506, 532 ] }, { "id": "micro-behaviors/process/daemonize/detach::setsid-import", "mbc": "F0003", "conf": 0.95, "crit": 3, "desc": "Imports POSIX setsid API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/debug/event::output-debug-string", "conf": 0.82, "crit": 3, "desc": "References the Windows debugger output API", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/debug/tool-markers::gdb-name-reference", "conf": 0.7, "crit": 3, "desc": "GDB executable path or branded reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/debug/tool-markers::org-gnu-gdb-marker", "conf": 0.9, "crit": 3, "desc": "org.gnu.gdb bundle identifier", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/enumerate/psapi::query-full-process-image-name-w", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Query full process image path", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/shell::get-process-by-name", "conf": 0.9, "crit": 3, "desc": "PowerShell selects a process by name", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Create process or module snapshot", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-first", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32First API name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-next", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32Next API name", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-toolhelp-process-traversal", "atk": "T1057", "mbc": "E1057", "conf": 0.97, "crit": 3, "desc": "Runtime Toolhelp process traversal", "from": [ { "off": 3014328, "file": 61 }, { "off": 1549378, "file": 62 } ], "uses": [ 539, 540, 730 ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-first", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Get first process from snapshot", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-next", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Enumerate next process in snapshot", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-traversal-text", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Process32 snapshot traversal API text", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-api-name-triplet-forward", "conf": 0.84, "crit": 3, "desc": "Forward-ordered Toolhelp API string cluster", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 689 ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-enumeration-with-access", "conf": 0.9, "crit": 3, "desc": "ToolHelp enumeration and process access API references", "from": [ { "off": 624448, "file": 59 }, { "off": 680972, "file": 60 }, { "file": 61 }, { "file": 62 } ], "uses": [ 483, 538, 542, 543 ] }, { "id": "micro-behaviors/process/fd/dup::dup", "conf": 0.5, "crit": 3, "desc": "Duplicate file descriptor", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "conf": 0.5, "crit": 3, "desc": "Duplicate file descriptor (I/O redirection)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/fork/clone::daemon-dup", "conf": 0.66, "crit": 3, "desc": "Daemonize process", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/identity/setuid::setgid-symbol", "conf": 0.8, "crit": 3, "desc": "References setgid identity API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/identity/setuid::setuid-symbol", "conf": 0.8, "crit": 3, "desc": "References setuid identity API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/info/commandline::daemon-helper-name-cluster", "conf": 0.9, "crit": 3, "desc": "Cluster of daemon-like process names", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/info/thread::get-thread-context-import", "conf": 0.95, "crit": 3, "desc": "Imports the Windows thread-context read API", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/info/thread::resume-thread-import", "conf": 0.9, "crit": 3, "desc": "ResumeThread API import", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/info/thread::set-thread-context-import", "conf": 0.95, "crit": 3, "desc": "Imports Windows thread-context write API", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/info/thread::suspend-thread-import", "atk": "T1055.003", "conf": 0.9, "crit": 3, "desc": "Suspend a Windows thread via imported API", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/info/thread::thread-quiescence-for-code-patch", "atk": "T1055.003", "conf": 0.95, "crit": 3, "desc": "Enumerates, suspends, and resumes threads around memory work", "from": [ { "off": 624344, "file": 59 }, { "off": 680920, "file": 60 }, { "off": 3031496, "file": 61 }, { "file": 62 } ], "uses": [ 538, 553, 554, 556 ] }, { "id": "micro-behaviors/process/info/timing::get-process-times", "conf": 0.85, "crit": 3, "desc": "GetProcessTimes process timing query", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::powershell-add-type", "atk": "T1059.001", "mbc": "E1059", "conf": 0.75, "crit": 3, "desc": "PowerShell Add-Type compilation", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/process/interpreter/powershell/command::encoded-command-line", "atk": "T1059.001,T1027", "conf": 0.94, "crit": 3, "desc": "PowerShell encoded-command launch", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/interpreter/reflection/runtime::create-instance-token", "conf": 0.8, "crit": 3, "desc": "CreateInstance member-name token", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/lifecycle/supervise::powershell-get-process-query", "conf": 0.88, "crit": 3, "desc": "Queries processes with Get-Process", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/process/resources/limits::assign-process-job-object", "conf": 0.92, "crit": 3, "desc": "Assign process to job object", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/resources/limits::create-job-object", "conf": 0.9, "crit": 3, "desc": "Create Windows job object", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/resources/limits::terminate-job-object", "conf": 0.9, "crit": 3, "desc": "Terminate processes in job object", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "C0018", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source", "conf": 0.98, "crit": 3, "desc": "Toolhelp process termination API cluster", "from": [ { "off": 624448, "file": 59 }, { "off": 680972, "file": 60 }, { "file": 61 }, { "file": 62 } ], "uses": [ 483, 566, 689 ] }, { "id": "micro-behaviors/process/thread/priority::set-thread-priority", "conf": 0.85, "crit": 3, "desc": "SetThreadPriority API symbol", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/process/tty/pty::openpty", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Open pseudoterminal", "from": [ { "off": 851033, "file": 13 } ], "uses": [ 570 ] }, { "id": "micro-behaviors/process/tty/pty::openpty-call", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "openpty() call", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/pty::ptsname", "atk": "T1059", "conf": 0.8, "crit": 3, "desc": "Get slave pseudoterminal name", "from": [ { "file": 13 } ], "uses": [ 572 ] }, { "id": "micro-behaviors/process/tty/pty::ptsname-symbol", "atk": "T1059", "conf": 0.6, "crit": 3, "desc": "ptsname symbol", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/pty::pty-network-backdoor", "atk": "T1059", "mbc": "B0022", "conf": 0.95, "crit": 3, "desc": "PTY with socket and fork operations", "from": [ { "file": 1 }, { "file": 8 }, { "file": 12 }, { "off": 1223963, "file": 13 }, { "file": 34 } ], "uses": [ 139, 145, 176, 180, 506, 700 ] }, { "id": "micro-behaviors/process/tty/terminal::cfmakeraw", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Make terminal attributes raw-mode", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/terminal::cfsetispeed", "atk": "T1059", "conf": 0.8, "crit": 3, "desc": "Set terminal input baud rate attribute", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/terminal::cfsetospeed", "atk": "T1059", "conf": 0.8, "crit": 3, "desc": "Set terminal output baud rate attribute", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/terminal::pty-terminal-setup", "conf": 0.78, "crit": 3, "desc": "PTY terminal setup", "from": [ { "off": 851213, "file": 13 } ], "uses": [ 573, 580 ] }, { "id": "micro-behaviors/process/tty/terminal::tcgetattr", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Get terminal attributes", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/terminal::tcsetattr", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Set terminal attributes", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/tty/terminal::vt100-ref", "conf": 0.65, "crit": 3, "desc": "vt100 terminal reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/work/pool::worker-pool", "conf": 0.6, "crit": 3, "desc": "References a worker, thread, or goroutine pool", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/time/query::cpp-steady-clock-now", "conf": 0.95, "crit": 3, "desc": "C++ steady clock query", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.9, "crit": 3, "desc": "Get tick count", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "conf": 0.9, "crit": 3, "desc": "Create extended waitable timer", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "conf": 1.0, "crit": 3, "desc": "Query/set system parameters (string)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "conf": 1.0, "crit": 3, "desc": "Query/set system parameters (symbol)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/help::bracketed-parameter-usage", "conf": 0.96, "crit": 3, "desc": "Usage text lists command-line parameters", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 2 } ], "uses": [ 701, 702, 703 ] }, { "id": "micro-behaviors/ui/window/enumerate::enum-windows", "conf": 0.85, "crit": 3, "desc": "Enumerate top-level windows", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/ui/window/station::get-shell-window", "conf": 0.85, "crit": 3, "desc": "Query the system shell window", "from": [ { "file": 61 } ] }, { "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence", "mbc": "B0001", "conf": 0.9, "crit": 3, "desc": "Contains virtual-machine detection evidence", "from": [ { "file": 1 }, { "file": 13 } ], "uses": [ 732 ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "PE imports module-path and file-I/O APIs and has appended data", "from": [ { "file": 59 }, { "file": 60 } ], "uses": [ 18, 733 ] }, { "id": "objectives/anti-static/pack/loader-noise::reset-write-watch-import", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 3, "desc": "Clear the dirty-page write-watch bitmap", "from": [ { "file": 49 } ] }, { "id": "objectives/command-and-control/dropper/staging/native/payload::hidden-powershell-launch", "atk": "T1105", "mbc": "B0024", "conf": 0.92, "crit": 3, "desc": "Hidden PowerShell launcher string", "from": [ { "file": 61 } ] }, { "id": "objectives/discovery/system/fingerprint/machine-id::hardware-uuid", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Hardware-based UUID generation", "from": [ { "file": 1 }, { "file": 13 }, { "file": 43 }, { "file": 44 }, { "file": 61 } ], "uses": [ 736, 737 ] }, { "id": "objectives/evasion/process/injection/hollowing/process::zw-unmap-section", "atk": "T1055.012", "mbc": "E1055.012", "conf": 0.85, "crit": 3, "desc": "Unmaps host image (native unmap variant)", "from": [ { "file": 48 } ] }, { "id": "objectives/impact/degrade/calculation::wildcard-or-state-rule", "atk": "T1565.002", "conf": 0.85, "crit": 3, "desc": "Rule-engine wildcard/state config identifier", "from": [ { "file": 49 } ] }, { "id": "objectives/impact/degrade/update::update-medic-service-name", "atk": "T1562.001", "conf": 0.94, "crit": 3, "desc": "Windows Update Medic remediation service name", "from": [ { "file": 58 } ] }, { "id": "objectives/impact/degrade/update::windows-update-service-targeting", "atk": "T1562.001", "conf": 0.92, "crit": 3, "desc": "Names multiple Windows servicing services", "from": [ { "off": 7053, "file": 58, "line": 130 } ], "uses": [ 598, 600, 738, 739 ] }, { "id": "objectives/impact/degrade/update::windows-update-services-command-text", "atk": "T1562.001", "conf": 0.92, "crit": 3, "desc": "Repeats Windows servicing service names", "from": [ { "file": 58 } ] }, { "id": "objectives/impact/wipe/disk/term::secure-erase", "conf": 0.6, "crit": 3, "desc": "secure erase phrase", "from": [ { "file": 13 } ] }, { "id": "objectives/impact/wipe/disk/term::wipe-disk", "conf": 0.6, "crit": 3, "desc": "wipe disk phrase", "from": [ { "file": 1 } ] }, { "id": "objectives/persistence/login/ifeo/debugger::ifeo-full-path", "atk": "T1546.012", "mbc": "F0012", "conf": 0.95, "crit": 3, "desc": "Full IFEO registry key path", "from": [ { "file": 58 } ] }, { "id": "well-known/lib/format/nlohmann-json::nlohmann-json-v3-symbol", "conf": 0.88, "crit": 3, "desc": "Embedded nlohmann::json v3 C++ library", "from": [ { "file": 1 } ] }, { "id": "well-known/tool/development/runtime/qemu::qemu-core-system-export", "conf": 0.95, "crit": 3, "desc": "QEMU core system export", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/development/runtime/qemu::qemu-options-parser-export", "conf": 0.95, "crit": 3, "desc": "QEMU options parser export", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/development/runtime/qemu::qemu-plugin-abi-read-register", "conf": 0.95, "crit": 3, "desc": "QEMU TCG plugin register read export", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/development/runtime/qemu::qemu-plugin-abi-scoreboard", "conf": 0.95, "crit": 3, "desc": "QEMU TCG plugin scoreboard export", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/development/runtime/qemu::qemu-qmp-export", "conf": 0.95, "crit": 3, "desc": "QEMU QMP command export", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/reverse-engineering/gdb::gdb-source-marker", "conf": 0.98, "crit": 3, "desc": "GNU GDB source and target markers", "from": [ { "file": 13 } ] }, { "id": "well-known/tool/sysadmin/shared-mime-info::shared-mime-info-source-marker", "conf": 0.99, "crit": 3, "desc": "shared-mime-info source marker", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/code/complexity::high-function-count-200", "conf": 0.7, "crit": 2, "desc": "High function count over 200", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/code/complexity::many-basic-blocks", "conf": 0.55, "crit": 2, "desc": "Functions average at least 50 basic blocks", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/code/complexity::many-complex-functions", "conf": 0.6, "crit": 2, "desc": "80+ functions have 50+ basic blocks", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/header/identity::elf-shared-library-with-exports", "conf": 0.95, "crit": 2, "desc": "ELF shared library with export surface", "from": [ { "file": 3 } ], "uses": [ 616, 625 ] }, { "id": "metadata/binary/header/identity::shared-object-type", "conf": 1.0, "crit": 2, "desc": "ELF uses ET_DYN object type" }, { "id": "metadata/binary/layout/size::large-file-1mb", "conf": 1.0, "crit": 2, "desc": "File larger than 1MB", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/dynamic::elf-needed-libs-zero", "conf": 0.9, "crit": 2, "desc": "ELF lists zero needed libraries", "from": [ { "file": 10 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-count-two", "conf": 1.0, "crit": 2, "desc": "PE has exactly two resource entries", "from": [ { "file": 61 } ] }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/manifest::pe-resource-manifest-second", "conf": 1.0, "crit": 2, "desc": "PE second resource is RT_MANIFEST" }, { "id": "metadata/binary/section/prose::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/section/ratio::four-section-pe", "conf": 0.8, "crit": 2, "desc": "PE with exactly four sections", "from": [ { "file": 40 } ] }, { "id": "metadata/binary/symbols/count::many-exports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ exports", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/symbols/count::pe-coff-symbol-table-present", "conf": 0.95, "crit": 2, "desc": "PE carries COFF symbol-table records" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/extension/executable::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension", "from": [ { "file": 61 } ] }, { "id": "metadata/file/format/checksum::sha256-checksum-record", "conf": 0.99, "crit": 2, "desc": "SHA-256 checksum file record", "from": [ { "file": 57 } ] }, { "id": "metadata/file/format/checksum::sha256-manifest-filename", "conf": 0.99, "crit": 2, "desc": "SHA-256 checksum manifest filename", "from": [ { "file": 57 } ] }, { "id": "metadata/file/magic/identity::elf-header", "conf": 1.0, "crit": 2, "desc": "ELF binary magic at file start", "from": [ { "file": 1 } ] }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "from": [ { "file": 39 } ] }, { "id": "metadata/lang/embedded::javascript", "conf": 1.0, "crit": 2, "desc": "javascript code embedded in string" }, { "id": "metadata/lang/scripted::add-type-definition", "conf": 0.85, "crit": 2, "desc": "PowerShell Add-Type TypeDefinition syntax marker", "from": [ { "file": 58 } ] }, { "id": "metadata/lang/scripted::function-blocks", "conf": 0.82, "crit": 2, "desc": "PowerShell function block syntax", "from": [ { "file": 58 } ] }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "from": [ { "file": 58 } ] }, { "id": "metadata/package/versioning/scheme::pe-file-description-present", "conf": 0.95, "crit": 2, "desc": "PE FileDescription field is populated" }, { "id": "metadata/package/versioning/scheme::pe-legal-copyright-present", "conf": 0.95, "crit": 2, "desc": "PE LegalCopyright field is populated" }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 59 } ] }, { "id": "metadata/package/versioning/scheme::version-resource-metadata", "conf": 0.9, "crit": 2, "desc": "PE version resource metadata", "from": [ { "off": 606066, "file": 59 }, { "off": 666994, "file": 60 }, { "off": 3021218, "file": 61 }, { "off": 1554778, "file": 62 } ], "uses": [ 83, 86, 641 ] }, { "id": "micro-behaviors/communications/ip/construct::ip-header-struct", "conf": 0.5, "crit": 2, "desc": "References the IP header structure", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/ip/literal::localhost-binary", "conf": 0.78, "crit": 2, "desc": "Binary contains the localhost hostname", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "conf": 0.8, "crit": 2, "desc": "Duplicate object handle", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "conf": 0.7, "crit": 2, "desc": "WS2_32 Winsock DLL import", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "conf": 0.72, "crit": 2, "desc": "Winsock connect API string", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "conf": 0.76, "crit": 2, "desc": "Winsock startup API string", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-prefix", "conf": 0.7, "crit": 2, "desc": "X509_ function prefix", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/encode/image/gdiplus::startup", "atk": "T1113", "conf": 0.85, "crit": 2, "desc": "GDI+ library initialization", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-close", "conf": 0.9, "crit": 2, "desc": "Close directory enumeration handle", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file", "conf": 0.9, "crit": 2, "desc": "Begin directory enumeration", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "conf": 0.9, "crit": 2, "desc": "Extended directory enumeration", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file", "conf": 0.9, "crit": 2, "desc": "Directory enumeration", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "conf": 0.4, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "conf": 0.5, "crit": 2, "desc": "References the CRT fseek file-position routine", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/binary::ftell-import", "conf": 0.7, "crit": 2, "desc": "References the CRT ftell position routine", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.9, "crit": 2, "desc": "Move or rename file with options", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.9, "crit": 2, "desc": "Windows file creation/open API", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/fs/file/stat::get-file-size", "conf": 0.65, "crit": 2, "desc": "Get file size", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/proc/exe::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/read/file/descriptor::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/read/file/handle::read-file", "conf": 0.9, "crit": 2, "desc": "Read data from file handle", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write", "conf": 0.66, "crit": 2, "desc": "CRT or POSIX file-write capability", "from": [ { "file": 1 } ], "uses": [ 668, 669, 670 ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write--pwrite64", "conf": 0.66, "crit": 2, "desc": "References POSIX pwrite64 API", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write--write", "conf": 0.66, "crit": 2, "desc": "References POSIX write API", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/write/file/handle::write--fwrite", "conf": 0.66, "crit": 2, "desc": "References fwrite file-write API", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/hardware/input/mouse/position::get-cursor-pos", "conf": 0.85, "crit": 2, "desc": "Windows cursor-position API import", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc", "atk": "T1055", "conf": 0.9, "crit": 2, "desc": "Kernel pool memory allocation", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/mem/alloc/heap::heap-alloc", "conf": 0.9, "crit": 2, "desc": "Heap memory allocation", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/mem/free::heap-free", "conf": 0.9, "crit": 2, "desc": "Heap memory deallocation", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/bpf/network-infra::pcap-api-symbol", "conf": 0.5, "crit": 2, "desc": "References a libpcap API symbol", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/event/epoll::epoll-create", "conf": 0.4, "crit": 2, "desc": "epoll_create function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/event/epoll::epoll-ctl", "conf": 0.4, "crit": 2, "desc": "epoll_ctl function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/event/epoll::epoll-wait", "conf": 0.4, "crit": 2, "desc": "epoll_wait function", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/event/poll::poll-multiplex", "conf": 0.5, "crit": 2, "desc": "poll() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/event/select::select-multiplex", "conf": 0.5, "crit": 2, "desc": "select() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/message/queue::get-message-w", "conf": 0.85, "crit": 2, "desc": "Get message (Unicode)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-ansi", "conf": 0.7, "crit": 2, "desc": "Get module file path (ANSI)", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-dup", "conf": 0.7, "crit": 2, "desc": "Get module file path (Unicode)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/pam/auth::pam-end-symbol", "conf": 0.6, "crit": 2, "desc": "pam_end function symbol", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/pam/auth::pam-start-symbol", "conf": 0.6, "crit": 2, "desc": "pam_start function symbol", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "atk": "T1082", "mbc": "E1082", "conf": 0.3, "crit": 2, "desc": "x86_64 architecture string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::close-handle-dup", "conf": 0.9, "crit": 2, "desc": "Close handle", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.9, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "from": [ { "off": 850886, "file": 13 } ], "uses": [ 506, 532, 661 ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration", "atk": "T1057", "conf": 0.9, "crit": 2, "desc": "Toolhelp snapshot process enumeration", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 690 ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol", "atk": "T1057", "conf": 0.9, "crit": 2, "desc": "Toolhelp process enumeration via imports", "from": [ { "file": 61 }, { "file": 62 } ], "uses": [ 538, 542, 543 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::advanced-sync-primitives", "atk": "T1129", "conf": 0.75, "crit": 2, "desc": "Advanced sync primitives", "from": [ { "file": 43 } ], "uses": [ 692, 698 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-ops", "atk": "T1129", "conf": 0.7, "crit": 2, "desc": "Condition variable ops", "from": [ { "file": 43 }, { "file": 44 }, { "file": 45 }, { "file": 46 } ], "uses": [ 693, 695 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable signal", "from": [ { "file": 43 }, { "file": 44 }, { "file": 45 }, { "file": 46 } ], "uses": [ 694 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-signal--wakeallconditionvariable", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (WakeAllConditionVariable)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable wait", "from": [ { "file": 43 }, { "file": 44 }, { "file": 45 }, { "file": 46 } ], "uses": [ 696 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::condition-variable-wait--sleepconditionvariablesrw", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "Condition variable (SleepConditionVariableSRW)", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::srw-lock-acquire", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "SRW lock acquisition", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/process/threading/advanced-sync::srw-lock-ops", "atk": "T1129", "conf": 0.7, "crit": 2, "desc": "SRW lock operations", "from": [ { "file": 41 } ], "uses": [ 697, 699 ] }, { "id": "micro-behaviors/process/threading/advanced-sync::srw-lock-release", "atk": "T1129", "conf": 0.65, "crit": 2, "desc": "SRW lock release", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/process/tty/pty::interactive-shell", "atk": "T1059", "mbc": "B0022", "conf": 0.8, "crit": 2, "desc": "Interactive shell via PTY", "from": [ { "off": 5012032, "file": 13 } ], "uses": [ 569, 571 ] }, { "id": "micro-behaviors/ui/help::options-title", "conf": 0.5, "crit": 2, "desc": "Options: label", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/help::usage-lower", "conf": 0.5, "crit": 2, "desc": "usage: label (lowercase)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "conf": 0.5, "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/window/control::create-window-ex", "conf": 0.85, "crit": 2, "desc": "Create window (extended)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/control::register-class", "conf": 0.7, "crit": 2, "desc": "Register window class", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/enumerate::get-window-text", "conf": 0.8, "crit": 2, "desc": "Read active window title text", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/ui/window/enumerate::get-window-thread-process-id", "conf": 0.85, "crit": 2, "desc": "Map window handle to owning process", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/ui/window/message::def-window-proc", "conf": 0.7, "crit": 2, "desc": "Default window procedure", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/message::dispatch-message", "conf": 0.7, "crit": 2, "desc": "Dispatch window message", "from": [ { "file": 62 } ] }, { "id": "objectives/discovery/process/window::window-process-discovery", "atk": "T1010", "conf": 0.85, "crit": 2, "desc": "Process discovery via window enumeration", "from": [ { "off": 3017174, "file": 61 }, { "off": 1551236, "file": 62 } ], "uses": [ 589, 706, 707 ] }, { "id": "metadata/arch/x86::elf-machine-x86-64-value", "conf": 0.97, "crit": 1, "desc": "x86_64 ELF machine field from metadata" }, { "id": "metadata/build/archive::archive-elf-shared-library-entry", "conf": 0.84, "crit": 1, "desc": "ELF shared library archive member" }, { "id": "metadata/build/archive::archive-native-bin-dir-entry", "conf": 0.84, "crit": 1, "desc": "Member under possible native staging directory" }, { "id": "metadata/build/archive::archive-native-binary-entry", "conf": 0.86, "crit": 1, "desc": "Archive bundles a native binary", "uses": [ 53, 712, 715 ] }, { "id": "metadata/build/archive::archive-windows-library-entry", "conf": 0.86, "crit": 1, "desc": "Windows DLL archive member" }, { "id": "metadata/lang/encoded/wide::shell-interpreter-script-host", "conf": 0.95, "crit": 1, "desc": "script host marker encoded", "from": [ { "file": 61 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/create::elf-socket-word", "conf": 0.8, "crit": 1, "desc": "Socket word in ELF strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "conf": 0.72, "crit": 1, "desc": "Winsock socket API string", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw-socket-ref", "atk": "T1011", "mbc": "C0001", "conf": 0.7, "crit": 1, "desc": "Raw socket terminology", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::architecture-payload-arm-suffix", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 1, "desc": "Architecture-suffixed ARM payload name", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::architecture-payload-risc-suffix", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 1, "desc": "RISC payload name with architecture suffix", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::architecture-payload-x86-suffix", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 1, "desc": "Architecture-suffixed x86 payload name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot-string", "atk": "T1057", "conf": 0.85, "crit": 1, "desc": "CreateToolhelp32Snapshot API string", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 } ], "uses": [ 701, 702, 703 ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-qemu", "atk": "T1497.001", "conf": 0.7, "crit": 1, "desc": "QEMU hypervisor vendor string", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 1, "desc": "Module-path and file-I/O import chain", "from": [ { "off": 624144, "file": 59 }, { "off": 680820, "file": 60 } ], "uses": [ 318, 734 ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain-wide", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 1, "desc": "Unicode module-path and file-I/O import chain", "from": [ { "file": 59 } ], "uses": [ 659, 660, 666, 683 ] }, { "id": "objectives/anti-static/pack/detect::unnamed-temp-storage-api", "conf": 0.9, "crit": 1, "desc": "ELF uses anonymous or unnamed temporary storage API", "from": [ { "off": 855877, "file": 13 } ], "uses": [ 340 ] }, { "id": "objectives/discovery/system/fingerprint/machine-id::hardware-id-helper", "atk": "T1082", "conf": 0.7, "crit": 1, "desc": "Hardware ID helper strings", "from": [ { "file": 1 }, { "file": 61 } ], "uses": [ 464 ] }, { "id": "objectives/discovery/system/fingerprint/machine-id::hardware-id-source", "atk": "T1082", "conf": 0.7, "crit": 1, "desc": "Hardware identifier source", "from": [ { "file": 1 }, { "off": 12384632, "file": 13 }, { "off": 886288, "file": 43 }, { "off": 819340, "file": 44 }, { "file": 61 } ], "uses": [ 464, 465 ] }, { "id": "objectives/impact/degrade/update::update-orchestrator-service-name", "atk": "T1562.001", "conf": 0.92, "crit": 1, "desc": "Update Orchestrator service name", "from": [ { "file": 58 } ] }, { "id": "objectives/impact/degrade/update::windows-update-agent-service-name", "atk": "T1562.001", "conf": 0.92, "crit": 1, "desc": "Windows Update agent service name", "from": [ { "file": 58 } ] } ] } ] } }