{
  "ml": {
    "v": "7",
    "id": 80,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00001619259455765132,
    "type": "python",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T19:01:08Z"
  },
  "path": "iron-proxy-action@fa1fd82ec32396d044deba7040a6db576bec927a",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 115,
        "mol": "O₆(As₂C₂DyLaPrS)H₆(Cm₉Cr₅Db₆F₅Os₁₀Po₃)Md₅(Bk₂InPaPt)",
        "pid": 4,
        "rel": "fetched",
        "sha": "befc3e9692aab3dd8799a5ebc26d764b0a172a477b12ef729bf4e8078a59659c",
        "via": "https://codeload.github.com/ironsh/iron-proxy-action/tar.gz/fa1fd82ec32396d044deba7040a6db576bec927a",
        "path": "pkg:github/ironsh/iron-proxy-action@fa1fd82ec32396d044deba7040a6db576bec927a",
        "risk": 31,
        "size": 68873,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 68873,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 68608,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "References the toString conversion method",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/import/npm/fs::fs",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports fs",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-structured-file",
            "conf": 0.84,
            "crit": 3,
            "desc": "Structured file has curl/wget output path",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::action-main-entrypoint",
            "conf": 1.0,
            "crit": 3,
            "desc": "Action declares a main entrypoint"
          },
          {
            "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.92,
            "crit": 3,
            "desc": "Command-line usage text marker",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::read-node",
            "conf": 0.9,
            "crit": 3,
            "desc": "Reads files with Node.js",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "metadata/lang/encoded/unicode-escape::ansi-escape-sequence",
            "conf": 0.98,
            "crit": 3,
            "desc": "ANSI color escape sequence encoded",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/asymmetric/signature::gpg-verification-command",
            "conf": 0.95,
            "crit": 3,
            "desc": "GPG detached-signature verification command",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::chmod-exec-absolute-path",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.92,
            "crit": 3,
            "desc": "chmod makes an absolute path executable",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/file::pinned-artifact-digest-constant",
            "conf": 0.9,
            "crit": 3,
            "desc": "Pins an expected SHA-256 digest constant",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/package-manager/install::gha-apt-get-noninteractive-y",
            "conf": 0.85,
            "crit": 3,
            "desc": "GitHub Actions installs packages with apt-get",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::tmp-path-content",
            "conf": 1.0,
            "crit": 2,
            "desc": "Contains a /tmp/ or /var/tmp/ path",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/split::js-split-call",
            "conf": 0.8,
            "crit": 3,
            "desc": "Calls JavaScript split()",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::chmod-make-executable",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.85,
            "crit": 3,
            "desc": "chmod adds executable permissions",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/package-manager/apt::apt-package-install-command",
            "conf": 0.98,
            "crit": 3,
            "desc": "Runs an APT package install command",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::readfilesync-call",
            "conf": 0.9,
            "crit": 3,
            "desc": "Calls readFileSync",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::tostring-call",
            "conf": 0.94,
            "crit": 3,
            "desc": "Calls JavaScript toString conversion method",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::unix-temp",
            "conf": 0.7,
            "crit": 2,
            "desc": "Unix /tmp/ path reference",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest",
            "atk": "T1195.002",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Action action.yml manifest",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::composite-action-type",
            "conf": 1.0,
            "crit": 3,
            "desc": "GitHub Actions composite action definition"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call",
            "conf": 0.72,
            "crit": 3,
            "desc": "Sorts a JavaScript array",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/os/package-manager/install::build-npm-install",
            "conf": 0.9,
            "crit": 3,
            "desc": "Build installs local npm dependencies",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/asymmetric/signature::signable-artifact-name",
            "conf": 0.95,
            "crit": 3,
            "desc": "Checksum manifest or detached signature filename",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::workflow-curl-download",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "Workflow invokes curl download",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename",
            "conf": 0.96,
            "crit": 3,
            "desc": "Go fuzz corpus entry basename (sha1[-index])"
          },
          {
            "id": "metadata/build/ci/step::composite-action-step-script",
            "conf": 1.0,
            "crit": 3,
            "desc": "Composite action step script body",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/file/catalog/service::service-name-github",
            "conf": 0.6,
            "crit": 3,
            "desc": "GitHub service name",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/file/string/identity::multi-architecture-name-set--arm-mips",
            "conf": 0.9,
            "crit": 1,
            "desc": "ARM or MIPS architecture reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/file/string/identity::multi-architecture-name-set--other",
            "conf": 0.9,
            "crit": 1,
            "desc": "x86, ARC, or MPSL architecture reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/curl::curl-command-remote-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "curl command names a remote HTTP(S) URL",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::curl-command-call",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes the curl command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-command-position-script",
            "conf": 0.9,
            "crit": 1,
            "desc": "curl/wget in shell command position",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-download-tmp-file",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "Curl downloads file into /tmp",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file-command",
            "atk": "T1105",
            "conf": 0.94,
            "crit": 3,
            "desc": "Executes curl with output-path option",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::source-curl-output-option",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl output file source",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/release::forge-release-download-url",
            "conf": 0.95,
            "crit": 3,
            "desc": "References a release download URL path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl or wget references shell variable",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::shell-curl-url-call",
            "atk": "T1105",
            "conf": 0.8,
            "crit": 3,
            "desc": "curl call names an HTTP URL",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/github::github-api-host",
            "conf": 0.86,
            "crit": 3,
            "desc": "GitHub API host reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/build::arch-variable-in-url",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Architecture variable appears in URL",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/install::ca-certificates-path",
            "conf": 0.85,
            "crit": 3,
            "desc": "System CA certificate store path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/install::update-ca-certificates",
            "conf": 0.85,
            "crit": 3,
            "desc": "update-ca-certificates command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::ca-certificates",
            "conf": 0.8,
            "crit": 2,
            "desc": "References a CA certificate bundle",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::openssl-ca-signing-profile",
            "atk": "T1587.003",
            "conf": 0.9,
            "crit": 3,
            "desc": "OpenSSL config marks certificate as signing CA",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/hash/digest::shell-sha256-checksum-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell SHA-256 checksum command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extension::tar-gz-or-zip-text",
            "conf": 0.9,
            "crit": 1,
            "desc": "References a .tar.gz or .zip archive",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/encode/base64::repeated-base64-literals",
            "conf": 0.85,
            "crit": 3,
            "desc": "Repeated long Base64-looking literals",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::chmod-exec-tmp-file",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.9,
            "crit": 3,
            "desc": "chmod marks /tmp file executable",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/copy::copy-to-executable-directory",
            "conf": 0.88,
            "crit": 3,
            "desc": "Copies a file into executable directory",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/config/privesc::etc-sudoers",
            "atk": "T1548",
            "conf": 0.85,
            "crit": 3,
            "desc": "References /etc/sudoers configuration",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/config/privesc::etc-sudoers-d",
            "atk": "T1548",
            "conf": 0.85,
            "crit": 3,
            "desc": "References /etc/sudoers.d directory",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/private-key::private-key-suffix",
            "atk": "T1552.001",
            "conf": 0.8,
            "crit": 1,
            "desc": "Private key file suffix",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/container/runtime::docker-sock",
            "conf": 0.7,
            "crit": 3,
            "desc": "Docker socket path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/cicd::github-env-file",
            "conf": 0.85,
            "crit": 3,
            "desc": "GITHUB_ENV environment file",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/privilege/elevation::sudo-chmod-executable",
            "conf": 0.86,
            "crit": 3,
            "desc": "sudo chmod grants executable permissions",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/privilege/elevation::sudo-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command invokes sudo",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "conf": 1.0,
            "crit": 3,
            "desc": "AArch64 (ARM64) architecture string",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-arm64",
            "conf": 1.0,
            "crit": 3,
            "desc": "arm64 architecture string",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-parameter-assignment",
            "conf": 0.94,
            "crit": 2,
            "desc": "Architecture parameter assignment",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64",
            "conf": 0.94,
            "crit": 3,
            "desc": "x86 or AMD64 architecture reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-arm",
            "conf": 0.94,
            "crit": 1,
            "desc": "x86 or ARM architecture reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--arc-or-arm",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell ARC or ARM architecture selector",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/tmp-exec::tmp-rust-text-file-context",
            "conf": 0.86,
            "crit": 3,
            "desc": "Temporary Rust or text file context",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/shell::shell-host-key-assignment",
            "atk": "T1027,T1059.004,T1140",
            "mbc": "B0032",
            "conf": 0.94,
            "crit": 3,
            "desc": "Host-derived key assignment",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/fetch-exec::uname-m-arch-var",
            "atk": "T1105",
            "mbc": "B0030",
            "conf": 0.95,
            "crit": 3,
            "desc": "uname architecture variable",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-2",
            "atk": "T1105",
            "mbc": "B0024",
            "conf": 0.86,
            "crit": 3,
            "desc": "Azure Blob Storage domain reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-case-uname-normalization",
            "conf": 0.92,
            "crit": 3,
            "desc": "uname -m mapped in a case statement",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-variable-in-artifact-name",
            "conf": 0.9,
            "crit": 3,
            "desc": "Arch variable in downloaded artifact name",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-variable-in-filename",
            "conf": 0.9,
            "crit": 3,
            "desc": "Arch variable spliced into a filename",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-option-script",
            "conf": 0.85,
            "crit": 3,
            "desc": "curl/wget text includes output option",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 2,
            "desc": "curl command includes URL or option",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "atk": "T1105",
            "conf": 0.7,
            "crit": 3,
            "desc": "References curl file-output option",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent-fail-flags-text",
            "atk": "T1105",
            "conf": 0.86,
            "crit": 3,
            "desc": "curl text contains silent or fail flags",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-download",
            "atk": "T1105",
            "conf": 0.85,
            "crit": 3,
            "desc": "GitHub release asset URL template",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::openssl-self-signed-cert",
            "atk": "T1587.003",
            "conf": 0.85,
            "crit": 3,
            "desc": "Generates self-signed TLS certificate",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/certificate/usage::x509-string",
            "conf": 0.6,
            "crit": 2,
            "desc": "References X.509 certificate terminology",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/tar::tar-extract",
            "atk": "T1560.001",
            "conf": 0.78,
            "crit": 3,
            "desc": "tar extraction command usage",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract",
            "atk": "T1560.001",
            "conf": 0.84,
            "crit": 3,
            "desc": "tar gzip extraction command usage",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/assembly::sh-template-opening-delimiter",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell contains a template delimiter",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.75,
            "crit": 3,
            "desc": "chmod +x (make executable)",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::chmod-command",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.6,
            "crit": 3,
            "desc": "chmod shell command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::mkdir-command",
            "conf": 0.8,
            "crit": 3,
            "desc": "Shell invokes mkdir command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/container/runtime::docker-var-run-sock",
            "conf": 0.75,
            "crit": 3,
            "desc": "Docker socket path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/firewall/iptables::iptables",
            "conf": 0.9,
            "crit": 3,
            "desc": "iptables command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/package-manager/install::apt-get-install-cmd",
            "conf": 0.75,
            "crit": 3,
            "desc": "apt-get install command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/service/control::systemctl-word",
            "conf": 0.7,
            "crit": 3,
            "desc": "References systemctl service manager",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/service/stop::systemctl-stop",
            "conf": 0.8,
            "crit": 3,
            "desc": "systemctl stops a service",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::sh-uname-fingerprint",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.8,
            "crit": 3,
            "desc": "Captures uname output in a shell substitution",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/command-string::shell-direct-sh-c",
            "conf": 0.8,
            "crit": 3,
            "desc": "Direct shell command-string execution with -c",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::bash-exec",
            "conf": 0.7,
            "crit": 3,
            "desc": "References the Bash shell",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-shell",
            "conf": 0.7,
            "crit": 3,
            "desc": "Bash shell reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "objectives/lateral-movement/brute-force/password::common-account-root-password-pair",
            "atk": "T1110.001",
            "conf": 0.86,
            "crit": 3,
            "desc": "Common account paired with root password",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::curl-wget-command",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes curl or wget",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              42
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl",
            "atk": "T1105",
            "conf": 0.66,
            "crit": 3,
            "desc": "Download via curl",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              82
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent",
            "atk": "T1105",
            "conf": 0.92,
            "crit": 3,
            "desc": "curl command uses silent or fail flags",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              42,
              84
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::arch-parameterized-variant",
            "atk": "T1082",
            "conf": 0.94,
            "crit": 3,
            "desc": "Host architecture selects a build variant",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              70,
              99
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/command-string::sh-c-exec",
            "conf": 0.8,
            "crit": 3,
            "desc": "Executes a shell command string with -c",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              100
            ]
          },
          {
            "id": "objectives/discovery/system/architecture::arch-host-probe-normalization",
            "conf": 0.9,
            "crit": 1,
            "desc": "Normalizes uname -m to an arch token",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              78
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::public-forge-http-download",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "Fetches content from a public code forge",
            "from": [
              {
                "off": 105,
                "file": 117,
                "line": 3
              },
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              21,
              104
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script sets curl or wget output file",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              43,
              81
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multi-arch-target",
            "conf": 0.85,
            "crit": 3,
            "desc": "Script references multiple CPU architectures",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              68,
              69
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references",
            "conf": 0.94,
            "crit": 3,
            "desc": "References multiple CPU architecture names",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              71,
              72
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command execution capability",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              102
            ]
          },
          {
            "id": "objectives/privilege-escalation/install-certificate::linux-ca-cert-install",
            "atk": "T1553.004",
            "mbc": "F0016",
            "conf": 0.85,
            "crit": 3,
            "desc": "Linux CA certificate installation",
            "from": [
              {
                "file": 118
              },
              {
                "file": 119
              }
            ],
            "uses": [
              53,
              82
            ]
          }
        ]
      }
    ]
  }
}