{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-26T04:02:00Z"
  },
  "path": "auth-logs@WwybfdKuP9ogCGpT7d3NU.md",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(F)",
        "x": 29,
        "ff": {
          "m": {
            "file": {
              "size": 692.0,
              "entropy": 4.74,
              "size_bytes": 692.0
            }
          },
          "s": [
            [
              0,
              "u8",
              "# Authentication Logs"
            ],
            [
              23,
              "u8",
              "Authentication logs record system login events, password changes, and sudo commands, located in `/var/log/auth.log` (Debian) or "
            ],
            [
              408,
              "u8",
              "Visit the following resources to learn more:"
            ],
            [
              454,
              "u8",
              "- [@article@Monitoring Linux Authentication Logs](https://betterstack.com/community/guides/logging/monitoring-linux-auth-logs/)"
            ],
            [
              582,
              "u8",
              "- [@article@How to Check Linux Login History - Linux Handbook](https://linuxhandbook.com/linux-login-history/)"
            ]
          ],
          "id": "markdown"
        },
        "id": 0,
        "sz": 692,
        "ts": [
          {
            "c": 0.699999988079071,
            "d": "/var/log/auth authentication log",
            "e": [
              "/var/log/auth"
            ],
            "i": "objectives/evasion/indicator-removal/logs::var-log-auth",
            "l": 4
          },
          {
            "a": "T1552.001",
            "c": 0.699999988079071,
            "d": "Settings password keyword",
            "e": [
              "password"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "a": "T1548.003",
            "c": 0.699999988079071,
            "d": "sudo command keyword",
            "e": [
              "sudo"
            ],
            "i": "objectives/privilege-escalation/elevation-control/sudo::sudo-keyword",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "LLM role context",
            "e": [
              "system"
            ],
            "i": "micro-behaviors/data/text/llm/override::llm-role-context",
            "l": 1
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to sensitive Linux log files",
            "e": [
              "/var/log/auth.log"
            ],
            "i": "micro-behaviors/fs/path/log/system::log-var",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "shell code embedded in string",
            "e": [
              "Detected shell at offset 0x17"
            ],
            "i": "metadata/lang/embedded::shell",
            "l": 2
          }
        ],
        "sha": "e2484320645c47dcfaf6c1ea9710d383e592d55309af35992103a974e2d5f5a3",
        "path": "auth-logs@WwybfdKuP9ogCGpT7d3NU.md",
        "type": "markdown"
      }
    ],
    "tv": "60d49"
  }
}