{ "llm": { "conf": 0.9665, "grade": "suspicious", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 85, "prob": 0.95, "class": "suspicious" }, "outcome": "suspicious", "interpretation": "Remote code execution, persistence, obfuscation" }, "ml": { "v": "7", "id": 4, "lvl": -1, "conf": 0, "prob": 0.000016023715943447314, "type": "registry", "version": "v18.18", "analyzed_at": "2026-09-10T17:59:55Z" }, "path": "livedesk-0.1.695.tgz", "raw": { "rev": "ce66f", "files": [ { "id": 5, "ctx": [ { "b": "abZy8000000@}S2x)nPbK%]4REuasf**%Y2h{5{iKEAf/sTz/v/y(2C?f[9pg6/cJBB:z%0jxga\u003eE.]bE=peI))F=[zudH5KmeMV)r=(\u003c5T!+=wB6]s38vmNc3\u003c@\u003er/=pFSVLOMP!F@E]@3ZnajA5{/emV+O2f[DBkM+R\u003cn2M-}m=8iE\u003e\u0026RggV#=I+S(4o%7[.%eDomHZRI9*^\u003e)G", "ln": 0 } ], "mol": "K(Li₂)O₇(S₂Xe₂As₃Dy₆AlCaI)H₉(Po₃₅Cm₇₄Cr₉Db₃₅F₁₉Hf₅Os₂₄Ti₄U₁₂)Md₅(InLiPa₉Pm)", "pid": 2, "rel": "fetched", "sha": "f4616ea8fbfab7ee6c475f25821acc2ab829683d21cdb6b83752538f1896131a", "via": "https://registry.npmjs.org/livedesk/-/livedesk-0.1.695.tgz", "path": "pkg:npm/livedesk@0.1.695", "risk": 416, "size": 2555440, "type": "npm", "depth": 2, "facts": { "metrics": { "file": { "size": 2555440, "entropy": 8 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 2555440, "peak_region_entropy": 7.86 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 12 } } }, "ident": { "name": { "value": "livedesk", "source": "npm.name", "verified": false }, "trust": "unsigned", "version": { "value": "0.1.695", "source": "npm.version", "verified": false }, "identifier": { "value": "livedesk", "source": "npm.name", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/path/location::node-homedir-hidden-entry", "conf": 0.92, "crit": 3, "desc": "Node builds a hidden home-directory path", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/javascript-features::template-literal", "conf": 0.9, "crit": 1, "desc": "ES6 template literal syntax", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-decode-call-text", "conf": 0.86, "crit": 3, "desc": "JavaScript invokes a Base64 decoder", "from": [ { "file": 45 } ] }, { "id": "objectives/discovery/system/fingerprint/runtime::full-fingerprint", "atk": "T1082", "mbc": "E1592", "conf": 0.9, "crit": 4, "desc": "Comprehensive system fingerprinting (multiple vectors)", "from": [ { "off": 55144, "file": 45, "line": 1424 }, { "off": 2689, "file": 54, "line": 69 }, { "off": 25002, "file": 74, "line": 619 }, { "off": 79517, "file": 75, "line": 2142 }, { "file": 76 }, { "off": 32806, "file": 94, "line": 909 }, { "off": 259739, "file": 101, "line": 6494 } ], "uses": [ 58, 145, 230, 392, 456, 574, 638, 689, 713 ] }, { "id": "micro-behaviors/process/create/spawn::bare-spawn-call", "conf": 0.75, "crit": 1, "desc": "Bare spawn function call", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-location-path-read", "conf": 0.86, "crit": 3, "desc": "Reads current path from browser location", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/process/enumerate/shell::pgrep-cmd", "atk": "T1057", "conf": 0.6, "crit": 3, "desc": "pgrep process search command", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/process/create/local-exec::node-execfile-exe-path", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "execFile launches a Windows exe", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-bytes", "conf": 0.65, "crit": 3, "desc": "Node.js random byte generation", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::node-readdir-sync-call", "conf": 0.84, "crit": 3, "desc": "Calls Node.js synchronous directory enumeration", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/terminate/command::taskkill-token", "conf": 0.72, "crit": 3, "desc": "taskkill command token", "from": [ { "file": 24 } ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-icecandidate-handler", "atk": "T1016", "conf": 0.9, "crit": 1, "desc": "WebRTC ICE candidate handler", "from": [ { "file": 78 } ] }, { "id": "metadata/library/structure::js-esm-symbol-tostringtag", "conf": 0.94, "crit": 1, "desc": "ESM Symbol.toStringTag marker", "from": [ { "file": 38 } ] }, { "id": "metadata/file/string/telemetry::session-id-field-js", "conf": 0.88, "crit": 1, "desc": "Contains a session identifier field", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/data/decode/base64::multiple-node-base64-decodes", "conf": 0.8, "crit": 3, "desc": "Multiple Node.js Base64 decodes", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-value-socket-send", "conf": 0.94, "crit": 3, "desc": "Sends a browser value over a JavaScript socket", "from": [ { "file": 62 } ], "uses": [ 227, 646 ] }, { "id": "micro-behaviors/hardware/display/screen::node-screenshots-monitor-capture", "atk": "T1113", "mbc": "B0002", "conf": 0.93, "crit": 3, "desc": "node-screenshots monitor capture flow", "from": [ { "off": 47595, "file": 74, "line": 1189 } ], "uses": [ 545, 734 ] }, { "id": "micro-behaviors/crypto/hash/hmac::hmac-api-reference", "mbc": "C0029", "conf": 0.9, "crit": 3, "desc": "References an HMAC API", "from": [ { "file": 50 } ] }, { "id": "objectives/execution/trigger/plugin::shell-commands-event-trigger", "conf": 0.9, "crit": 3, "desc": "Obsidian shell command event trigger", "from": [ { "file": 148 }, { "file": 170 } ], "uses": [ 378 ] }, { "id": "micro-behaviors/os/privilege/elevation::sudo-command-string", "conf": 0.9, "crit": 3, "desc": "JavaScript sudo command string", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/communications/proxy/turn::webrtc-peer-connection-api", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "WebRTC peer connection API", "from": [ { "file": 78 } ] }, { "id": "metadata/package/scripts/develop::pkg-dev-script-field", "conf": 0.6, "crit": 3, "desc": "package.json declares a development script" }, { "id": "micro-behaviors/communications/http/auth::refresh-token-field-reference", "conf": 0.96, "crit": 3, "desc": "Refresh-token field reference", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-token-word", "conf": 0.45, "crit": 1, "desc": "token route vocabulary word", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/source/function/names::create-connection-call-target", "conf": 0.9, "crit": 1, "desc": "Call target named createConnection", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/hardware/display/record::media-recorder-data-handler", "conf": 0.94, "crit": 3, "desc": "Handles MediaRecorder dataavailable output", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/process/create/agent-permission::agent-approval-gate-disabled", "atk": "T1562.001", "conf": 0.93, "crit": 4, "desc": "Disables an AI agent approval gate", "from": [ { "file": 47 } ], "uses": [ 459 ] }, { "id": "micro-behaviors/process/fd/stdio::js-stdin-read", "conf": 0.88, "crit": 3, "desc": "Reads Node process stdin", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/data/format/crypto-address::eth-address-regex", "conf": 0.85, "crit": 3, "desc": "Ethereum address regex pattern", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "metadata/file/profile/language::lang-german--atom-7", "conf": 0.8, "crit": 2, "desc": "German function-word token \"werden\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/request/client::hardcoded-token-config-field", "conf": 0.85, "crit": 3, "desc": "Hardcoded token-bearing configuration field", "from": [ { "file": 146 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-secret-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses a credential variable in Bearer header", "from": [ { "file": 43 } ] }, { "id": "metadata/file/profile/language::lang-japanese", "conf": 0.8, "crit": 3, "desc": "Contains Hiragana or Katakana script", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::navigator-platform-read", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Reads navigator.platform browser identity", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/language::lang-italian--atom-1", "conf": 0.8, "crit": 1, "desc": "Italian function-word token \"questo\"", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-5", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"pada\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/performance/monitoring::node-process-memory-usage", "conf": 0.95, "crit": 3, "desc": "Reads Node.js process memory usage", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/websocket::wss-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an encrypted wss:// WebSocket URL", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/graphics/draw::canvas-image-data-readback", "conf": 0.9, "crit": 3, "desc": "Reads image pixels with Canvas getImageData", "from": [ { "file": 62 } ] }, { "id": "supply-chain/missing-author", "conf": 0.5, "crit": 3, "desc": "Package has empty or missing author field" }, { "id": "micro-behaviors/data/decode/base64::node-base64-tostring-token", "conf": 0.86, "crit": 1, "desc": "Node base64 toString token", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::browser-timezone-read", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Reads browser timezone via Intl API", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/fs/file/read::js-read-and-send-ipc", "conf": 0.95, "crit": 3, "desc": "Reads file content and sends via Node IPC", "from": [ { "file": 70 } ], "uses": [ 185, 309 ] }, { "id": "micro-behaviors/fs/directory/traverse::node-readdir-dirents", "conf": 0.74, "crit": 2, "desc": "Reads a Node.js directory with Dirent objects", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/io/stream::node-stream-end-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream end handler", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/fs/write/file/direct::js-file-write", "conf": 0.9, "crit": 3, "desc": "JavaScript file write operation", "from": [ { "file": 9 }, { "file": 23 }, { "file": 41 }, { "file": 74 }, { "file": 106 }, { "file": 133 }, { "file": 175 } ], "uses": [ 174, 398, 535, 678 ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias user identity query", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-http-upgrade-headers", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "WebSocket HTTP upgrade handshake", "from": [ { "off": 388696, "file": 94, "line": 9149 } ], "uses": [ 704, 709 ] }, { "id": "micro-behaviors/fs/path/sensitive/credential-filenames::auth-json-join-argument", "conf": 0.9, "crit": 3, "desc": "Auth JSON path construction", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/path/application/bundle::electron-asar-path", "conf": 0.9, "crit": 3, "desc": "Electron app.asar bundle path", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/form::form-submit-listener", "conf": 0.85, "crit": 3, "desc": "Registers a form submit event listener" }, { "id": "micro-behaviors/fs/enumerate/directory::fs-readdir", "conf": 0.6, "crit": 3, "desc": "Calls Node.js readdir at least twice", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/fs/file/write/async::node-write-file-promise-destructured", "conf": 0.9, "crit": 3, "desc": "Node writes a file via destructured import", "from": [ { "file": 18 } ], "uses": [ 99, 104 ] }, { "id": "micro-behaviors/data/encode/base64::json-stringify-base64", "mbc": "C0026", "conf": 0.85, "crit": 3, "desc": "JSON stringified to base64" }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 40 } ], "uses": [ 43, 115, 264, 449, 642, 698 ] }, { "id": "micro-behaviors/os/sysinfo/cpu::node-cpu-information-query", "conf": 0.9, "crit": 3, "desc": "Queries Node CPU information", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/source/syntax/schema::host-system-metric-schema", "conf": 0.93, "crit": 3, "desc": "Host recon fields: hostname, platform, arch", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-400-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 400", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/crypto/library/keyword::cipher-keyword", "conf": 0.4, "crit": 2, "desc": "Generic 'cipher' crypto term", "from": [ { "file": 50 } ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encryption-algorithm-keyword", "conf": 0.5, "crit": 3, "desc": "Encryption algorithm keyword", "from": [ { "file": 55 }, { "file": 93 }, { "file": 115 } ], "uses": [ 61 ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 1, "desc": "HTTP POST method string literal", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-intersection-observer", "conf": 0.82, "crit": 3, "desc": "Observes DOM element visibility", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-os-platform-alias-branch", "conf": 0.82, "crit": 3, "desc": "Node OS alias platform branch", "from": [ { "file": 69 } ], "uses": [ 139, 167, 169, 515 ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-leading-promise-chain-call", "conf": 0.84, "crit": 3, "desc": "Leading promise-chain call at module scope", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/workers::worker-constructor-call", "conf": 0.9, "crit": 1, "desc": "Worker constructor call", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::chmod-0755-mode", "atk": "T1222", "mbc": "E1222", "conf": 0.8, "crit": 3, "desc": "chmod() call with 0755 permission mode", "from": [ { "file": 168 } ] }, { "id": "micro-behaviors/data/encode/base64::node-buffer-base64-encode", "mbc": "C0026", "conf": 0.95, "crit": 3, "desc": "Encodes Node.js Buffer output as Base64", "from": [ { "file": 65 } ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-vbox", "atk": "T1497.001", "conf": 0.7, "crit": 3, "desc": "VirtualBox hypervisor vendor string", "from": [ { "file": 94 } ], "uses": [ 495 ] }, { "id": "micro-behaviors/communications/http/request/reference::js-fetch-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "Passes fetch as a call argument", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/headers::bearer-header-from-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.93, "crit": 1, "desc": "Bearer header from token", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-400-status-assignment", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source assigns HTTP status 400" }, { "id": "micro-behaviors/crypto/symmetric/aes/runtime-library::aes-256-gcm-dash", "mbc": "C0027", "conf": 0.75, "crit": 3, "desc": "AES-256-GCM with dashes", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/process/create/shell/script-host::wscript-shell-run-create", "atk": "T1059.005", "conf": 0.85, "crit": 3, "desc": "WScript.Shell launches a process", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read", "conf": 0.9, "crit": 3, "desc": "Reads constructor properties repeatedly", "from": [ { "file": 87 } ] }, { "id": "objectives/credential-access/wallet/provider::ethereum-provider", "atk": "T1555.003", "conf": 0.75, "crit": 3, "desc": "Web3 wallet provider access (window.ethereum)", "from": [ { "file": 109 } ], "uses": [ 486 ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-argv-command-string", "conf": 0.9, "crit": 3, "desc": "Builds a command string from process argv", "from": [ { "file": 168 } ] }, { "id": "micro-behaviors/ui/window/manage/electron::electron-browserwindow-constructor", "atk": "T1564.003", "conf": 0.92, "crit": 3, "desc": "Creates an Electron BrowserWindow", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::js-named-pipe-path", "atk": "T1559", "conf": 0.85, "crit": 3, "desc": "JavaScript builds a Windows named-pipe path", "from": [ { "file": 163 } ] }, { "id": "micro-behaviors/process/create/server::configured-server-executable-spawn", "conf": 0.9, "crit": 3, "desc": "Node spawns configured server executable", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "from": [ { "file": 89 } ] }, { "id": "objectives/supply-chain/recon-exfil/host-profile/install-context::npm-victim-exfil", "atk": "T1020", "mbc": "E1041", "conf": 0.92, "crit": 3, "desc": "NPM package sends victim ID via HTTP POST", "from": [ { "file": 70 } ], "uses": [ 64, 349, 512 ] }, { "id": "micro-behaviors/fs/file/read::cwd-reference", "conf": 0.84, "crit": 1, "desc": "References the Node.js current working directory", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/serialize/json::refresh-token-field-stringify", "conf": 0.96, "crit": 3, "desc": "JSON serialization includes refresh-token field", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/buffer::uint16-be-buffer-write", "conf": 0.85, "crit": 3, "desc": "Writes 16-bit big-endian buffer value", "from": [ { "file": 89 } ] }, { "id": "metadata/package/error-handling::try-block-open", "conf": 0.5, "crit": 2, "desc": "Contains the opening of a try block", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/string/conversion::keyboard-event-code-to-character", "conf": 0.93, "crit": 3, "desc": "Converts keyboard event code to character", "from": [ { "file": 87 } ] }, { "id": "metadata/file/profile/locale::language-label-code-vi", "conf": 0.97, "crit": 2, "desc": "Vietnamese UI language code", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/manage/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/communications/http/service-worker::event-install", "conf": 1.0, "crit": 3, "desc": "Service Worker install event listener", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::jvm-total-memory-reference", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Java runtime total memory reference", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/request/resource-action::destructive-resource-action-call", "conf": 0.96, "crit": 3, "desc": "Calls a destructive resource method", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-call", "conf": 0.5, "crit": 2, "desc": "Calls JSON.stringify()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/agent::remote-desktop-stream-command", "atk": "T1219", "mbc": "B0022", "conf": 0.94, "crit": 1, "desc": "Remote desktop stream command", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/agent::remote-pair-token-manager-cli", "atk": "T1219", "mbc": "B0022", "conf": 0.91, "crit": 3, "desc": "Remote pair-token manager CLI", "from": [ { "file": 69 } ] }, { "id": "metadata/file/extension/identity::declaration-file-extension", "conf": 1.0, "crit": 1, "desc": "File uses a source declaration extension", "from": [ { "file": 191 } ] }, { "id": "micro-behaviors/fs/file/write/async::node-fs-promises-import", "conf": 0.95, "crit": 2, "desc": "Imports the Node fs/promises API", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::multi-ip-discovery", "atk": "T1016", "mbc": "C0004", "conf": 0.9, "crit": 3, "desc": "Multiple public IP discovery services", "from": [ { "off": 11419, "file": 94, "line": 288 } ], "uses": [ 424, 607, 665 ] }, { "id": "micro-behaviors/communications/http/url/query::browser-location-search-read", "conf": 0.7, "crit": 3, "desc": "Reads browser URL query string", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-refresh-grant-type", "conf": 0.9, "crit": 3, "desc": "OAuth refresh_token grant type", "from": [ { "file": 54 } ] }, { "id": "objectives/discovery/system/fingerprint/runtime::js-system-info-discovery", "atk": "T1082", "mbc": "B0012", "conf": 0.85, "crit": 3, "desc": "System information discovery (JS)", "from": [ { "file": 40 } ], "uses": [ 58, 145, 230, 456, 707, 713 ] }, { "id": "micro-behaviors/fs/file/write/async::write-file-call-target", "conf": 0.9, "crit": 1, "desc": "Calls an unqualified writeFile function", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/process/create/flags::powershell-policy-bypass-argument", "atk": "T1059.001,T1562.001", "conf": 0.9, "crit": 3, "desc": "PowerShell execution-policy bypass argument", "from": [ { "file": 112 } ] }, { "id": "micro-behaviors/process/io/stream::node-stdout-reference", "conf": 0.8, "crit": 3, "desc": "References Node.js stdout stream", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/hardware/display/record::media-stream-recorder", "conf": 0.92, "crit": 3, "desc": "Creates a MediaRecorder for a media stream", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::recursive-mkdir-sync", "conf": 0.9, "crit": 3, "desc": "Creates a directory tree synchronously", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::generic-sensitive-credential-path", "atk": "T1552.001", "conf": 0.8, "crit": 3, "desc": "References a sensitive credential or environment file path", "from": [ { "file": 74 } ], "uses": [ 303 ] }, { "id": "metadata/import/builtin::child-process-import-runtime", "conf": 0.85, "crit": 3, "desc": "Imports Node child_process through ESM", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/process/interpreter/node::js-electron-main-require", "conf": 0.95, "crit": 3, "desc": "Node requires Electron main process module", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/headers::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "from": [ { "file": 134 } ], "uses": [ 138 ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem", "conf": 0.9, "crit": 3, "desc": "Writes browser storage with setItem", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/decode/base64::atob-decode", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with JavaScript atob()", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/process/interpreter/shell::bin-sh", "conf": 0.6, "crit": 3, "desc": "/bin/sh shell interpreter path reference", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/communications/http/post::js-fetch-post-body-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Fetch POST body uses a variable", "from": [ { "file": 48 }, { "file": 75 }, { "file": 76 }, { "file": 83 }, { "file": 96 }, { "file": 107 }, { "file": 118 }, { "file": 148 } ], "uses": [ 358, 393 ] }, { "id": "metadata/package/dependencies/manifest::has-optional-deps", "conf": 0.8, "crit": 3, "desc": "Package has optional dependencies" }, { "id": "objectives/collection/file-targeting/filter::credential-file-path-segment", "atk": "T1005,T1083", "conf": 0.92, "crit": 1, "desc": "Credential-like path segment", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-payload-call", "conf": 0.92, "crit": 3, "desc": "Serializes a payload object as JSON", "from": [ { "file": 40 } ] }, { "id": "objectives/execution/condition/platform::has-os-check", "conf": 0.6, "crit": 1, "desc": "Checks for OS platform", "from": [ { "file": 4 } ], "uses": [ 162 ] }, { "id": "micro-behaviors/communications/ipc/rpc::wallet-provider-personal-sign", "conf": 0.9, "crit": 3, "desc": "Ethereum wallet personal-sign RPC method", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/response-code::source-http-429-status", "atk": "T1590", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Source checks for HTTP 429 rate-limit response", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/os/random/crypto::webcrypto-random-uuid", "conf": 0.72, "crit": 3, "desc": "Generates UUID with Web Crypto", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/serialize/json::identity-platform-json-payload", "conf": 0.9, "crit": 3, "desc": "JSON payload has an ID and platform", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::dotenv-filename-literal", "atk": "T1552.001", "conf": 0.85, "crit": 1, "desc": ".env filename literal", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/crypto/library/provider::ecdh-create", "conf": 0.72, "crit": 3, "desc": "Node ECDH key exchange", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 38 } ] }, { "id": "micro-behaviors/communications/proxy/turn::webrtc-data-channel-api", "atk": "T1071.001", "conf": 0.92, "crit": 3, "desc": "WebRTC data channel API", "from": [ { "file": 78 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-concat", "atk": "T1059.001", "conf": 0.9, "crit": 1, "desc": "Concatenated PowerShell execution policy bypass", "from": [ { "file": 29 }, { "file": 33 }, { "file": 70 }, { "file": 74 }, { "file": 76 }, { "file": 117 }, { "file": 120 } ], "uses": [ 450 ] }, { "id": "micro-behaviors/hardware/input/event::browser-scroll-listener", "conf": 0.9, "crit": 3, "desc": "Registers a DOM scroll listener", "from": [ { "file": 62 } ] }, { "id": "metadata/package/dependencies/manifest::optional-native-linux-dep-name", "conf": 0.9, "crit": 1, "desc": "Optional Linux native dependency name", "from": [ { "file": 117 } ] }, { "id": "micro-behaviors/data/llm::role-line-marker", "conf": 0.72, "crit": 1, "desc": "Quoted LLM role label", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/socket/receive::node-socket-data-event", "atk": "T1071", "mbc": "C0001", "conf": 0.78, "crit": 3, "desc": "Node socket data event handler", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/autorun/login-items::gnome-autostart-enabled-marker", "atk": "T1547.013", "conf": 0.9, "crit": 3, "desc": "X-GNOME-Autostart-enabled desktop flag", "from": [ { "file": 136 } ] }, { "id": "micro-behaviors/communications/http/request/evented::node-evented-get-response", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Node get call receives an evented response", "from": [ { "file": 65 } ] }, { "id": "metadata/file/profile/language::vietnamese-common-word-cac", "conf": 1.0, "crit": 1, "desc": "Vietnamese common word các", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/headers::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "from": [ { "file": 129 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-linux-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Linux platform value", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/fs/directory/delete::fs-rm-recursive", "atk": "T1070.004", "mbc": "C0047", "conf": 0.8, "crit": 3, "desc": "Node.js fs.rm with recursive option", "from": [ { "file": 69 } ] }, { "id": "metadata/file/profile/language::lang-german--atom-2", "conf": 0.8, "crit": 2, "desc": "German function-word token \"oder\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/write/content::batch-command-extension-literal", "conf": 0.95, "crit": 3, "desc": "Batch or command file extension literal", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/fd/stdio::stdout-string", "conf": 0.3, "crit": 2, "desc": "References the stdout stream name", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/auth::access-token-field-reference", "conf": 0.96, "crit": 3, "desc": "Access-token field reference", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/os/network/interface::node-network-interfaces-call", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Node.js network interface enumeration call", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/hardware/input/keyboard/simulate::osascript-keystroke-injection", "atk": "T1056.003", "conf": 0.9, "crit": 3, "desc": "macOS AppleScript keystroke injection", "from": [ { "file": 69 } ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/buffer::buffer-from-utf8", "conf": 0.9, "crit": 3, "desc": "Creates Node.js Buffer from UTF-8 text", "from": [ { "file": 45 } ] }, { "id": "metadata/library/structure::js-distribution-output-path", "conf": 0.96, "crit": 2, "desc": "JavaScript distribution output path" }, { "id": "micro-behaviors/process/create/shell/bridge::object-exec-method-call", "atk": "T1059", "conf": 1.0, "crit": 1, "desc": "Calls an object exec method", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/http/cookies::cookie-header", "conf": 0.7, "crit": 3, "desc": "HTTP Cookie request header string", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/url/path::url-object-host-read", "conf": 0.9, "crit": 3, "desc": "Extracts host from a constructed URL", "from": [ { "file": 96 } ] }, { "id": "objectives/discovery/system/fingerprint/hardware::node-comp", "atk": "T1082", "conf": 0.85, "crit": 4, "desc": "Node.js collects multiple host/user profile fields", "from": [ { "file": 70 } ], "uses": [ 392, 456, 707, 713 ] }, { "id": "micro-behaviors/fs/log-rotation::rotate-file", "conf": 0.85, "crit": 2, "desc": "rotateFile log retention helper", "from": [ { "file": 128 } ] }, { "id": "micro-behaviors/crypto/hash/file::pinned-artifact-digest-constant", "conf": 0.9, "crit": 3, "desc": "Pins an expected SHA-256 digest constant", "from": [ { "file": 122 } ] }, { "id": "micro-behaviors/communications/http/service-worker::api-register", "conf": 1.0, "crit": 3, "desc": "Registers a Service Worker", "from": [ { "file": 84 } ] }, { "id": "micro-behaviors/os/privilege/check::node-root-uid-check", "conf": 0.85, "crit": 3, "desc": "Node checks for UID 0", "from": [ { "file": 66 } ] }, { "id": "metadata/package/testing/presence/harness::tests-path-basename", "conf": 1.0, "crit": 1, "desc": "Tests path basename", "from": [ { "file": 130 } ] }, { "id": "metadata/file/profile/locale::language-label-code-zh", "conf": 0.97, "crit": 2, "desc": "Chinese UI language code", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/service-worker::api-respond-with", "conf": 1.0, "crit": 1, "desc": "respondWith method call", "from": [ { "file": 106 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-6", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"adalah\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-content", "conf": 0.7, "crit": 2, "desc": "References the Node.js process.platform value", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/url/path::js-url-host-read", "conf": 0.8, "crit": 3, "desc": "Reads hostname from URL variable", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-get-dup", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js http.get", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-arbitrary", "conf": 0.66, "crit": 3, "desc": "Access /proc for arbitrary PIDs", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/client/resource::stylesheet-font-face-remote-url", "conf": 0.9, "crit": 3, "desc": "Font face declaration references remote http URL", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-darwin-branch", "conf": 0.7, "crit": 2, "desc": "Branches on macOS platform value", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/interface::ipv4-family-literal", "atk": "T1016", "conf": 0.8, "crit": 1, "desc": "Checks an IPv4 interface family", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-method-call", "conf": 0.75, "crit": 3, "desc": "Calls a Node OS platform method", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/fs/file/write/direct::node-write-file-sync", "conf": 1.0, "crit": 3, "desc": "Node synchronously writes a file", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/html::html-fetch-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Calls fetch API from HTML script", "from": [ { "file": 15 } ] }, { "id": "objectives/discovery/system/fingerprint/hardware::js-sysinfo-multi", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Multiple system info function calls", "from": [ { "file": 40 } ], "uses": [ 58, 145, 230, 707 ] }, { "id": "micro-behaviors/process/create/launch::platform-default-opener-selection", "atk": "T1106", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Selects the platform default open command", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/fs/write/file/direct::write-file-async", "conf": 0.8, "crit": 2, "desc": "Node fs writes to a file asynchronously", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-spawnsync-windows-interpreter", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Runs a Windows interpreter via spawnSync", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-url-origin-read", "conf": 0.94, "crit": 3, "desc": "Derives an origin from a URL", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/crypto/library/provider::subtle-sign-verify", "conf": 0.7, "crit": 3, "desc": "WebCrypto subtle sign/verify", "from": [ { "file": 104 } ] }, { "id": "objectives/collection/file-targeting/filter::credential-file-path", "atk": "T1005,T1083", "conf": 0.92, "crit": 1, "desc": "Credential-like file path", "from": [ { "off": 57059, "file": 74, "line": 1442 } ], "uses": [ 119 ] }, { "id": "micro-behaviors/ui/window/manage/enumerate::browser-og-meta-read", "conf": 0.9, "crit": 3, "desc": "Reads Open Graph meta tag content", "from": [ { "file": 73 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-3", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"dari\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::bind-loopback-address", "conf": 0.85, "crit": 3, "desc": "Binds or listens on the loopback address", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-session-word", "conf": 0.45, "crit": 1, "desc": "session route vocabulary word", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/websocket::ws-dynamic-import", "conf": 0.8, "crit": 3, "desc": "Dynamically imports the 'ws' WebSocket module", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/crypto/hash/file::actual-hash-variable", "conf": 0.84, "crit": 3, "desc": "Stores computed actualHash variable", "from": [ { "file": 137 } ] }, { "id": "micro-behaviors/fs/file/read::read-node", "conf": 0.9, "crit": 3, "desc": "Reads files with Node.js", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-status", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response status method", "from": [ { "file": 96 } ] }, { "id": "metadata/library/structure::js-medium-minified-line", "conf": 0.9, "crit": 1, "desc": "JavaScript contains a long minified line", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/os/env/access::node-process-env-object-field", "conf": 0.9, "crit": 3, "desc": "Places full Node environment in object field", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-call", "conf": 0.65, "crit": 3, "desc": "Node.js createHash call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/runtime-library::createDecipheriv", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "Creates decipher with initialization vector", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/communications/http/request/client::js-fetch-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript fetch API" }, { "id": "objectives/anti-static/obfuscation/payload/encoded::base64-exec-proximity", "atk": "T1140", "mbc": "B0032", "conf": 0.95, "crit": 4, "desc": "Nearby Base64 decode and exec call", "uses": [ 57, 211, 261, 363, 578 ] }, { "id": "metadata/library/structure::js-known-bundler-output", "conf": 0.95, "crit": 2, "desc": "File is known bundler/wrapper output", "from": [ { "off": 51, "file": 88, "line": 1 } ], "uses": [ 630 ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-peerconnection-call", "atk": "T1016", "conf": 0.9, "crit": 1, "desc": "WebRTC peer connection creation", "from": [ { "file": 83 } ], "uses": [ 198 ] }, { "id": "metadata/package/dependencies/manifest::npm-dependency-fanout", "conf": 0.85, "crit": 3, "desc": "Package has at least eight runtime deps" }, { "id": "metadata/package/testing/harness/unit::node-test-runner-import", "conf": 0.95, "crit": 3, "desc": "Imports the node:test runner", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/service::cloudflare-pages-host", "conf": 0.8, "crit": 3, "desc": "Cloudflare Pages hosting domain", "from": [ { "file": 40 } ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-peerconnection-call--rtcpeerconnection", "atk": "T1016", "conf": 0.9, "crit": 1, "desc": "WebRTC peer connection (RTCPeerConnection)", "from": [ { "file": 78 } ] }, { "id": "metadata/package/scripts/build::has-release-scripts-2", "conf": 1.0, "crit": 3, "desc": "Package release management scripts (pre/post)", "from": [ { "file": 117 } ] }, { "id": "micro-behaviors/data/parse/json::json-data-property-parse", "conf": 0.94, "crit": 3, "desc": "Parses a data property with JSON.parse", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/decode/command::tr-delete", "conf": 0.7, "crit": 3, "desc": "tr command for character deletion", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket", "atk": "T1071.001", "mbc": "C0002", "conf": 0.66, "crit": 3, "desc": "WebSocket communication", "from": [ { "file": 45 } ], "uses": [ 268, 679 ] }, { "id": "metadata/library/structure::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 31 } ], "uses": [ 187, 193, 478 ] }, { "id": "micro-behaviors/communications/http/auth::oauth-access-refresh-token-fields", "conf": 0.96, "crit": 3, "desc": "Access and refresh token fields", "from": [ { "file": 35 } ], "uses": [ 22, 144 ] }, { "id": "micro-behaviors/communications/ipc/rpc::wallet-provider-personal-sign-text", "conf": 0.9, "crit": 3, "desc": "Quoted personal_sign in bundle text", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::js-locale-symbol", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Reads locale through Intl.DateTimeFormat", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/os/network/interface::returns-interface-address", "atk": "T1016", "conf": 0.86, "crit": 1, "desc": "Returns a network interface address", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/server/route::app-router-get-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "App or router GET route definition", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-click-call", "conf": 0.82, "crit": 3, "desc": "Calls click() on a DOM element", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/create/agent::ai-agent-unattended-execution-value", "atk": "T1059", "mbc": "B0022", "conf": 0.9, "crit": 1, "desc": "Unattended agent execution mode value", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "from": [ { "file": 1 } ], "uses": [ 274, 473, 673, 699 ] }, { "id": "metadata/lang/javascript-features::const-let", "conf": 0.9, "crit": 1, "desc": "ES6 const/let declarations", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/websocket/library::ws", "conf": 0.9, "crit": 3, "desc": "Node.js uses the ws WebSocket library", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/proxy/turn::webrtc-sdp-signaling-api", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "WebRTC SDP offer-answer signaling", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/service-worker::control-claim", "conf": 1.0, "crit": 3, "desc": "Service Worker claims clients immediately", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/communications/http/client/resource::create-link-resource-element", "conf": 0.92, "crit": 3, "desc": "Creates a link resource element", "from": [ { "file": 73 } ] }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/fs/file/write/direct::node-write-file-sync-call", "conf": 1.0, "crit": 3, "desc": "Node calls imported writeFileSync", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body" }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem-call", "conf": 0.9, "crit": 3, "desc": "Calls localStorage or sessionStorage getItem", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/language::lang-french--atom-1", "conf": 0.8, "crit": 1, "desc": "French function-word token \"dans\"", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/locale::language-label-code-en", "conf": 0.97, "crit": 2, "desc": "English UI language code", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-form-submit", "conf": 0.9, "crit": 3, "desc": "Programmatically submits a browser form" }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call", "conf": 0.95, "crit": 3, "desc": "Invokes preserved console method with arguments", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/data/language::lang-turkish", "conf": 0.8, "crit": 3, "desc": "Turkish language detection", "from": [ { "off": 20059, "file": 67, "line": 2 } ], "uses": [ 381, 654 ] }, { "id": "micro-behaviors/communications/socket/send::javascript-socket-send", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "JavaScript socket send call", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/data/string/concat::leading-variable-dotted-name", "conf": 0.9, "crit": 3, "desc": "Dotted name built from a leading variable", "from": [ { "file": 36 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/sysinfo/performance/metrics::node-os-totalmem", "conf": 0.7, "crit": 3, "desc": "Reads total system memory", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-property-fingerprint", "conf": 0.8, "crit": 3, "desc": "Reads multiple Node.js process properties", "from": [ { "file": 70 } ], "uses": [ 162, 292, 479 ] }, { "id": "micro-behaviors/communications/http/request/privacy::no-referrer-request-policy", "conf": 0.85, "crit": 3, "desc": "Sets referrer policy to no-referrer", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/server/listener::nodejs-http-server", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 2, "desc": "Node.js HTTP server patterns", "from": [ { "off": 74936, "file": 45, "line": 1862 }, { "off": 117836, "file": 75, "line": 3124 }, { "off": 10837, "file": 96, "line": 239 }, { "off": 81816, "file": 101, "line": 1877 } ], "uses": [ 338 ] }, { "id": "micro-behaviors/communications/ip/private-range::private-ip-check-js", "conf": 1.0, "crit": 3, "desc": "Checks for private IP address ranges (JS)" }, { "id": "metadata/library/runtime::intl-polyfill-locale-data", "conf": 0.96, "crit": 2, "desc": "Intl polyfill locale data", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-create-element", "conf": 0.96, "crit": 3, "desc": "Creates DOM element", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/create::node-dgram-create-socket", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node datagram module creates a socket", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 40 } ] }, { "id": "objectives/credential-access/theft/keywords::api-key-field-name", "conf": 0.96, "crit": 1, "desc": "API-key field name in structured data", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/server/listener::node-http-create-server-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 1, "desc": "Imports Node.js http.createServer", "from": [ { "file": 40 } ] }, { "id": "objectives/supply-chain/recon-exfil/host-profile/install-context::npm-sysinfo-http", "atk": "T1082", "conf": 0.85, "crit": 4, "desc": "NPM package with system info and HTTP POST", "from": [ { "file": 70 } ], "uses": [ 64, 512 ] }, { "id": "micro-behaviors/communications/http/headers::headers-auth", "atk": "T1071.001", "mbc": "C0002", "conf": 0.66, "crit": 3, "desc": "HTTP Authorization header", "from": [ { "file": 48 }, { "file": 54 }, { "file": 67 }, { "file": 96 }, { "file": 101 }, { "file": 109 }, { "file": 121 } ], "uses": [ 73 ] }, { "id": "metadata/lang/javascript-features::arrow-function", "conf": 0.9, "crit": 1, "desc": "ES6 arrow function syntax", "from": [ { "file": 70 } ] }, { "id": "metadata/lang/scripted::dts-declaration-file", "conf": 0.99, "crit": 2, "desc": "TypeScript declaration file", "from": [ { "file": 191 } ] }, { "id": "micro-behaviors/data/source/arithmetic::js-bitwise-arithmetic-chain", "conf": 0.8, "crit": 3, "desc": "JavaScript bitwise arithmetic and shift chain", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/request/client::fetch-then-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.74, "crit": 3, "desc": "fetch() response JSON parse", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/data/serialize/json-write::json-stringified-text-field", "conf": 0.9, "crit": 3, "desc": "Serializes a text or caption field", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/crypto/hash/digest::node-createhash-sha256-call", "conf": 0.94, "crit": 3, "desc": "Node.js createHash('sha256') call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/terminate/signal::process-kill-group", "atk": "T1562", "mbc": "E1562", "conf": 0.85, "crit": 3, "desc": "Process group kill via negative PID", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/ui/window/manage/style::zero-width-element-style", "conf": 0.92, "crit": 1, "desc": "CSS sets element width to zero", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-platform-member", "conf": 0.8, "crit": 3, "desc": "Reads the Node.js process.platform value", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-bind", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node server bind call", "from": [ { "file": 109 } ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-datachannel-call", "atk": "T1016", "conf": 0.9, "crit": 1, "desc": "WebRTC data channel creation", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/communications/http/server/listener::nodejs-http-imported-create-server", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Node.js HTTP server created through an ES-module import", "from": [ { "off": 74936, "file": 45, "line": 1862 }, { "off": 117836, "file": 75, "line": 3124 }, { "off": 10837, "file": 96, "line": 239 }, { "off": 81816, "file": 101, "line": 1877 } ], "uses": [ 240, 338 ] }, { "id": "micro-behaviors/process/create/exec::node-promisified-exec-file", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Node promisifies the file exec API", "from": [ { "file": 93 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw-socket-ref", "atk": "T1011", "mbc": "C0001", "conf": 0.7, "crit": 1, "desc": "Raw socket terminology", "from": [ { "file": 50 } ] }, { "id": "metadata/package/quality/profile::has-buffer-encoding-1", "conf": 1.0, "crit": 3, "desc": "Code uses Buffer (utf8/ascii)", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/communications/http/service-worker::event-fetch", "conf": 1.0, "crit": 3, "desc": "Service Worker fetch event listener", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-login-word", "conf": 0.45, "crit": 1, "desc": "login route vocabulary word", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/post::formdata-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Constructs browser FormData", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/process/create/exec::node-execfile-reference", "atk": "T1059", "conf": 0.86, "crit": 3, "desc": "References Node execFile API", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/wallet/keywords::wallet-token", "conf": 0.4, "crit": 1, "desc": "Wallet keyword", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/launch::embedded-desktop-entry-exec-field", "conf": 0.9, "crit": 3, "desc": "Embeds a Desktop Entry Exec field", "from": [ { "file": 136 } ] }, { "id": "micro-behaviors/data/decode/base64::node-json-parse-buffer", "conf": 0.86, "crit": 1, "desc": "Node JSON.parse Buffer.from", "from": [ { "file": 40 } ] }, { "id": "metadata/file/string/application-name::safari-browser-name-literal", "conf": 0.4, "crit": 3, "desc": "String literal names the Safari browser", "from": [ { "file": 73 } ] }, { "id": "metadata/package/files/included::npm-package-scripts-member", "conf": 0.99, "crit": 3, "desc": "JavaScript under npm package scripts dir", "from": [ { "file": 107 } ] }, { "id": "objectives/execution/interpreter/script/wsh::detached-powershell-policy-bypass-launch", "atk": "T1059.001,T1059.007,T1564.003", "conf": 0.98, "crit": 5, "desc": "Detached hidden child runs PowerShell policy bypass", "from": [ { "off": 3637, "file": 29, "line": 90 }, { "off": 56267, "file": 75, "line": 1439 }, { "off": 23496, "file": 76, "line": 654 }, { "off": 8054, "file": 97, "line": 242 }, { "off": 5705, "file": 117, "line": 97 } ], "uses": [ 385, 596 ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 1, "desc": "WebSocket class reference", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/ipc/rpc::jsonrpc-2-protocol-object", "conf": 0.9, "crit": 3, "desc": "JSON-RPC 2.0 protocol object", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-library-api-reference", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "WebSocket library or handler API reference", "from": [ { "file": 83 }, { "file": 140 }, { "file": 152 }, { "file": 173 } ], "uses": [ 323 ] }, { "id": "micro-behaviors/communications/ip/endpoint::common-service-port", "conf": 0.6, "crit": 3, "desc": "Common service port number", "from": [ { "file": 148 } ], "uses": [ 703 ] }, { "id": "micro-behaviors/communications/http/client/response-body::fetch-response-body-read", "conf": 0.9, "crit": 3, "desc": "JavaScript fetch reads response body", "from": [ { "file": 84 } ] }, { "id": "micro-behaviors/os/module/load::dynamic-external-import-string-literal", "conf": 0.9, "crit": 3, "desc": "Dynamically imports a non-relative module path" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "from": [ { "off": 85591, "file": 74, "line": 1937 }, { "file": 75 }, { "off": 23417, "file": 76, "line": 653 } ], "uses": [ 76, 312 ] }, { "id": "micro-behaviors/ui/window/form-input::browser-value-event-b", "conf": 0.9, "crit": 3, "desc": "Reads a browser event or active-element value", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/header/retry-after::retry-after-header-name-reference", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "References the Retry-After header name", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/write/async::node-write-file-promise", "conf": 0.9, "crit": 3, "desc": "Node asynchronously writes a file", "from": [ { "file": 69 } ] }, { "id": "metadata/package/quality/empty::npm-has-name", "conf": 1.0, "crit": 2, "desc": "package.json defines a package name" }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/create/agent::remote-thumbnail-capture-command", "atk": "T1219", "mbc": "B0022", "conf": 0.94, "crit": 1, "desc": "Remote thumbnail capture command", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-editable-content-selector-sweep", "conf": 0.94, "crit": 3, "desc": "Targets form fields and editable page content", "from": [ { "file": 102 } ], "uses": [ 319, 593, 717 ] }, { "id": "micro-behaviors/data/parse/vocabulary::auth-route-auth-word", "conf": 0.45, "crit": 1, "desc": "auth route vocabulary word", "from": [ { "file": 33 } ] }, { "id": "micro-behaviors/communications/ipc/message::js-message-event-listener", "conf": 0.85, "crit": 3, "desc": "Registers an event listener for message events", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::navigator-language", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Reads browser UI language", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/fs/directory/traverse::root-dirs-list-volumes", "conf": 0.8, "crit": 3, "desc": "Root directories list includes Volumes", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/directory/traverse::node-dirent-isdirectory", "conf": 0.72, "crit": 2, "desc": "Checks whether Node.js entries are directories", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/os/clipboard/access::clipboard-keyword", "conf": 0.7, "crit": 1, "desc": "Clipboard keyword", "from": [ { "file": 5 } ] }, { "id": "objectives/supply-chain/recon-exfil/host-profile/victim::node-machine-fingerprint-posted", "atk": "T1082,T1041", "mbc": "B0024,E1082", "conf": 0.93, "crit": 5, "desc": "Posts a machine fingerprint off the host", "from": [ { "file": 70 } ], "uses": [ 49, 95, 105, 145, 229, 296, 419, 659, 731 ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-named-event-object-emission", "conf": 0.82, "crit": 3, "desc": "Emits object through named JavaScript event", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-url-safe-base64", "conf": 0.9, "crit": 3, "desc": "JavaScript URL-safe Base64 decode via Buffer", "from": [ { "file": 40 } ] }, { "id": "metadata/file/profile/language::vietnamese-common-word-voi", "conf": 1.0, "crit": 1, "desc": "Vietnamese common word với", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::process-version-access", "conf": 0.72, "crit": 3, "desc": "Reads Node.js version through process.version", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/os/network/interface::node-mac-address-property", "atk": "T1016", "conf": 0.9, "crit": 3, "desc": "Reads a Node network interface MAC property", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/ipc/message::postmessage-call", "conf": 0.86, "crit": 3, "desc": "Sends data with window or worker postMessage", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.8, "crit": 3, "desc": "Writes HTML into the DOM with innerHTML" }, { "id": "micro-behaviors/data/serialize/json::json-parse-call", "conf": 0.5, "crit": 2, "desc": "Calls JSON.parse()", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 1, "desc": "Calls a parenthesized function expression", "from": [ { "file": 21 } ] }, { "id": "metadata/package/error-handling::catch-keyword", "conf": 0.5, "crit": 2, "desc": "Contains a catch error handler", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/os/env/modify::electron-run-as-node-env-injection", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Sets ELECTRON_RUN_AS_NODE in child env", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/os/env/vars/platform::node-appdata-access", "conf": 0.9, "crit": 3, "desc": "Node reads Windows APPDATA directory", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/process/create/hidden::encodedcommand-flag-js", "atk": "T1059.001", "conf": 0.86, "crit": 1, "desc": "PowerShell EncodedCommand flag in script literal", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/ui/window/manage/visibility::browser-blur-call", "conf": 0.9, "crit": 3, "desc": "Calls blur() on DOM object", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/path/sensitive/ssh::keys", "atk": "T1552.004", "mbc": "T1552.004", "conf": 0.8, "crit": 1, "desc": "SSH keys directory path literal", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-serializer-call", "conf": 0.9, "crit": 3, "desc": "Calls a URL query serializer", "from": [ { "file": 31 } ] }, { "id": "metadata/library/runtime::js-module-exports", "conf": 1.0, "crit": 2, "desc": "Exports a JavaScript module", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/crypto/library/provider::node-hkdf", "conf": 0.72, "crit": 3, "desc": "Node HKDF operation", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/os/module/load::node-require-resolve-package-name", "conf": 0.9, "crit": 3, "desc": "Resolves a named Node package", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-redirect", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response redirect method", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/ipc/message::node-process-send", "conf": 0.95, "crit": 3, "desc": "Sends message via Node.js process.send", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::multi-platform-branch", "atk": "T1082", "mbc": "E1082", "conf": 0.8, "crit": 3, "desc": "Multi-platform OS branching logic", "from": [ { "file": 40 } ], "uses": [ 497, 584, 676 ] }, { "id": "micro-behaviors/process/create/exec::node-promisified-exec-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Node promisified exec API call", "from": [ { "file": 93 } ] }, { "id": "micro-behaviors/process/create/shell/script-host::rundll32-command-text", "atk": "T1218.011", "conf": 0.9, "crit": 3, "desc": "Rundll32 command text", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-location-host-read", "conf": 0.82, "crit": 3, "desc": "Reads current host from browser location", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/ui/window/manage/style::zero-height-element-style", "conf": 0.92, "crit": 1, "desc": "CSS sets element height to zero", "from": [ { "file": 69 } ] }, { "id": "metadata/package/testing/presence/harness::spec-test-filename", "conf": 0.85, "crit": 1, "desc": "Spec or test filename markers", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/communications/http/request/verb::javascript-mutating-method-branch-cluster", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "Branches on mutating HTTP request methods", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/create/hidden::argv-array-windowstyle-hidden", "atk": "T1564.003", "conf": 0.94, "crit": 3, "desc": "Hidden-window flag in an argv array", "from": [ { "file": 112 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-flag", "atk": "T1059.001", "conf": 0.95, "crit": 1, "desc": "ExecutionPolicy bypass flag", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-contenteditable-selector", "conf": 0.92, "crit": 1, "desc": "Browser selector targets editable page content", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-timing-safe-equal-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js constant-time comparison call", "from": [ { "file": 50 } ] }, { "id": "metadata/import/builtin::import-dns", "conf": 0.8, "crit": 3, "desc": "ESM import of the Node.js dns module", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/process/create/shell/path::shell-executable-reference", "conf": 0.9, "crit": 3, "desc": "References a shell executable", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/websocket/handler::websocket-javascript-constructor", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "JavaScript WebSocket constructor", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::refresh-token-env-name", "conf": 0.94, "crit": 3, "desc": "OAuth refresh-token environment variable", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/crypto/hash/digest::javascript-sha256-operation", "mbc": "C0029", "conf": 0.88, "crit": 3, "desc": "Performs JavaScript SHA-256 operation", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/graphics/draw::canvas-2d-context", "conf": 0.78, "crit": 3, "desc": "Uses canvas 2D context", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request" }, { "id": "metadata/package/dependencies/manifest::platform-optional-native-deps", "conf": 0.9, "crit": 3, "desc": "Platform-specific optional native dependencies", "from": [ { "file": 122 }, { "file": 124 } ], "uses": [ 118, 132 ] }, { "id": "micro-behaviors/communications/socket/framing::node-be32-frame-length-read", "mbc": "C0001", "conf": 0.95, "crit": 3, "desc": "Reads BE32 frame length at offset zero", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/os/network/interface::node-mac-address-enumeration", "atk": "T1016", "conf": 0.96, "crit": 3, "desc": "Enumerates MAC addresses from Node interfaces", "from": [ { "off": 23924, "file": 45, "line": 669 }, { "off": 23493, "file": 74, "line": 587 }, { "file": 75 }, { "file": 94 } ], "uses": [ 145, 293 ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/crypto/library/provider::subtle-key-ops", "conf": 0.7, "crit": 3, "desc": "WebCrypto subtle key operations", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-sync-call", "conf": 0.85, "crit": 3, "desc": "Creates a directory synchronously", "from": [ { "file": 40 } ] }, { "id": "metadata/package/testing/presence/harness::pkg-build-or-test-helper-script", "conf": 0.95, "crit": 2, "desc": "Packaging build or test helper script", "from": [ { "file": 135 } ], "uses": [ 614 ] }, { "id": "micro-behaviors/communications/url/encoded::inline-svg-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Contains an inline SVG data URI", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-timing-safe-equal", "mbc": "C0029", "conf": 0.94, "crit": 3, "desc": "Constant-time buffer comparison", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/time/sleep/interval::sleep-interval-after-call", "conf": 0.65, "crit": 3, "desc": "Sleep precedes an interval configuration term", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/server/listener::create-server-factory-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Calls a createServer factory", "from": [ { "file": 40 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 130 } ], "uses": [ 396, 614 ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-1", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"yang\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/client/resource::local-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads local script element", "from": [ { "file": 13 } ] }, { "id": "metadata/file/profile/language::lang-hindi-marathi", "conf": 0.8, "crit": 3, "desc": "Contains Devanagari script", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/url/domain::workers-dev-domain", "conf": 0.8, "crit": 3, "desc": "Cloudflare Workers domain reference", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/language::lang-vietnamese", "conf": 0.8, "crit": 3, "desc": "Vietnamese language detection", "from": [ { "off": 14103, "file": 67, "line": 2 } ], "uses": [ 137, 291, 360, 520 ] }, { "id": "micro-behaviors/fs/chmod/modify::node-create-restricted-mode", "conf": 0.9, "crit": 3, "desc": "Node creates a path with restricted mode", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/endpoints::health-check-path", "conf": 0.9, "crit": 3, "desc": "HTTP health-check endpoint path", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-node-remove", "conf": 0.8, "crit": 3, "desc": "Removes a child node from the DOM", "from": [ { "file": 13 } ] }, { "id": "metadata/file/metrics::javascript-small-file-5k", "conf": 0.7, "crit": 1, "desc": "JavaScript file under 5KB", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::net-create-connection-call", "conf": 0.88, "crit": 3, "desc": "Node net.createConnection call", "from": [ { "file": 4 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-7", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"dengan\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem", "conf": 0.9, "crit": 3, "desc": "Reads browser storage with getItem", "from": [ { "file": 31 } ] }, { "id": "metadata/package/files/package-json::files-array-present", "conf": 0.92, "crit": 3, "desc": "Package.json declares a files allowlist" }, { "id": "metadata/file/profile/locale::language-label-table-codes-a", "conf": 0.9, "crit": 2, "desc": "Common UI language-code pair", "from": [ { "file": 40 } ], "uses": [ 90, 159, 222 ] }, { "id": "metadata/library/structure::js-minified-esm-import-list", "conf": 0.9, "crit": 1, "desc": "Minified ESM import list", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/process/create/workers::browser-worker-constructor", "conf": 0.9, "crit": 3, "desc": "Creates a browser Web Worker", "from": [ { "file": 107 }, { "file": 109 } ], "uses": [ 68 ] }, { "id": "micro-behaviors/process/user/query::node-os-alias-homedir-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "Node os-alias home directory query", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/post::js-fetch-body-variable", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Fetch call passes a variable request body" }, { "id": "micro-behaviors/process/daemonize/detach::node-handle-unref-text", "mbc": "F0011", "conf": 0.86, "crit": 3, "desc": "Detaches a handle with unref()", "from": [ { "file": 69 } ] }, { "id": "metadata/file/profile/language::vietnamese-common-word-va", "conf": 1.0, "crit": 1, "desc": "Vietnamese common word và", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/db/web-storage::browser-storage-persistence", "conf": 0.8, "crit": 3, "desc": "Persists data in browser storage", "from": [ { "off": 40051, "file": 36, "line": 6 }, { "off": 218051, "file": 67, "line": 177 }, { "off": 125250, "file": 109, "line": 13 }, { "off": 2739, "file": 118, "line": 1 } ], "uses": [ 114, 352 ] }, { "id": "micro-behaviors/fs/file/read::file-read-api-call", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript readFile API", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/process/create/exec::node-process-launch-call", "conf": 0.9, "crit": 3, "desc": "Invokes a Node.js child-process launch API", "from": [ { "file": 1 } ], "uses": [ 684, 699 ] }, { "id": "micro-behaviors/fs/directory/traverse::node-recursive-dirent-walk", "conf": 0.82, "crit": 3, "desc": "Recursively traverses a Node.js directory tree", "from": [ { "off": 2701, "file": 56, "line": 67 }, { "off": 66652, "file": 74, "line": 1651 }, { "off": 2935, "file": 98, "line": 83 } ], "uses": [ 46, 286 ] }, { "id": "objectives/discovery/system/fingerprint/hardware::js-profiling", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Aggregates system info for profiling", "from": [ { "file": 40 } ], "uses": [ 58, 145, 230, 707 ] }, { "id": "micro-behaviors/fs/path/application/config::codex-config-directory", "conf": 0.9, "crit": 3, "desc": "Codex config directory path", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::cmd-name", "conf": 1.0, "crit": 1, "desc": "cmd executable string literal", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/fs/write/file/shell::shell-profile-append-call", "conf": 0.9, "crit": 3, "desc": "Appends with the appendFile API", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::navigator-hardware-concurrency-read", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Reads browser logical processor count", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/language::lang-italian--atom-3", "conf": 0.8, "crit": 1, "desc": "Italian function-word token \"nella\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/websocket/send::websocket-instance-send-call", "conf": 0.92, "crit": 3, "desc": "WebSocket instance sends data", "from": [ { "file": 147 } ] }, { "id": "micro-behaviors/process/io/stream::process-stdout-data-listener", "conf": 0.9, "crit": 3, "desc": "Registers a process stdout data listener", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/service-worker::intercept-all", "conf": 1.0, "crit": 3, "desc": "Service Worker intercepts requests and claims clients immediately", "from": [ { "off": 2545, "file": 111, "line": 50 } ], "uses": [ 160, 215, 258 ] }, { "id": "objectives/impact/dos/attack/flood::flood-packet-count-prompt", "atk": "T1498", "mbc": "B0009", "conf": 0.85, "crit": 3, "desc": "Prompts for a packet count to send", "from": [ { "file": 96 } ] }, { "id": "metadata/package/testing/harness/electron::electron-remote-control-loopback", "conf": 0.95, "crit": 1, "desc": "Electron loopback listener fixture", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/communications/http/client/resource::stylesheet-remote-url-value", "conf": 0.9, "crit": 3, "desc": "Stylesheet property loads a remote http URL", "from": [ { "file": 9 } ] }, { "id": "well-known/app/system/electron-auth::electron-safe-storage-encrypt", "conf": 0.95, "crit": 1, "desc": "Electron safeStorage encryptString call", "from": [ { "file": 143 } ] }, { "id": "objectives/execution/trigger/plugin::shell-commands-event-trigger--rx-12", "conf": 0.9, "crit": 1, "desc": "Regex component marker", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/process/create/shell/guard::node-temp-exec-benign-context", "conf": 0.9, "crit": 1, "desc": "Benign Node temp execution context", "from": [ { "file": 2 } ], "uses": [ 12, 149, 158, 187, 193, 196, 203, 235, 305, 315, 334, 339, 355, 375, 396, 402, 404, 425, 441, 478, 493, 554, 555, 562, 577, 601, 614, 630, 636, 653, 667, 740 ] }, { "id": "micro-behaviors/os/network/interface::node-local-ip-selection", "atk": "T1016", "conf": 0.96, "crit": 3, "desc": "Selects a local IPv4 interface address", "from": [ { "off": 23924, "file": 45, "line": 669 }, { "off": 23493, "file": 74, "line": 587 }, { "off": 145094, "file": 75, "line": 3677 }, { "off": 38064, "file": 94, "line": 1069 } ], "uses": [ 145, 168, 207, 743 ] }, { "id": "micro-behaviors/data/language::lang-turkish--atom-2", "conf": 0.8, "crit": 1, "desc": "Turkish function-word token", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/identity::escaped-unicode-codepoint", "conf": 0.99, "crit": 3, "desc": "Escaped Unicode codepoint in source", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/oauth::refresh-token-snake-assign", "conf": 0.9, "crit": 3, "desc": "Snake-case OAuth refresh_token field assign", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/process/create/spawn::windowshide-option", "conf": 0.85, "crit": 3, "desc": "Node.js windowsHide spawn option", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/process/create/spawn::detached-ignored-unref-spawn", "conf": 0.9, "crit": 3, "desc": "Spawns detached child and calls unref()", "from": [ { "file": 70 } ], "uses": [ 359, 418, 587 ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/put::javascript-put-request-body", "conf": 0.9, "crit": 3, "desc": "JavaScript PUT request with body", "from": [ { "file": 31 } ] }, { "id": "objectives/anti-analysis/emulator-detect/hardware::virtualbox-word", "atk": "T1497.001", "mbc": "B0009", "conf": 0.5, "crit": 1, "desc": "VirtualBox vendor token", "from": [ { "file": 89 } ] }, { "id": "metadata/lang/javascript-features::async-await", "conf": 0.9, "crit": 1, "desc": "ES2017 async/await syntax", "from": [ { "file": 70 } ] }, { "id": "metadata/lang/javascript-features::es6-class", "conf": 0.9, "crit": 1, "desc": "ES6 class declaration", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/oauth::url-authorization-code-read", "conf": 0.95, "crit": 3, "desc": "Reads URL authorization code parameter", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::os-platform-call", "conf": 0.75, "crit": 2, "desc": "Queries OS platform with os.platform()", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "from": [ { "file": 43 } ] }, { "id": "metadata/file/string/telemetry::device-id-field-js", "conf": 0.88, "crit": 1, "desc": "Contains a device identifier field", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/communications/http/endpoints::aws-api-endpoint", "conf": 0.8, "crit": 3, "desc": "References an AWS API endpoint", "from": [ { "file": 89 } ] }, { "id": "metadata/package/testing/presence/harness::tests-path-filename", "conf": 0.85, "crit": 1, "desc": "File path or name indicates test code", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/process/fd/stdio::js-stdin-write", "conf": 0.8, "crit": 3, "desc": "Writes to Node process stdin", "from": [ { "file": 76 } ] }, { "id": "micro-behaviors/fs/write/file/direct::create-write-stream", "conf": 0.8, "crit": 3, "desc": "Creates a write stream", "from": [ { "file": 128 } ] }, { "id": "micro-behaviors/data/string/concat::array-join-empty-separator-text", "conf": 0.78, "crit": 3, "desc": "Array expression joined without separator", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/socket/raw::raw", "atk": "T1011", "mbc": "C0001", "conf": 0.8, "crit": 3, "desc": "Create raw network sockets", "from": [ { "file": 55 }, { "file": 94 } ], "uses": [ 256 ] }, { "id": "micro-behaviors/crypto/library/provider::subtle-digest", "conf": 0.65, "crit": 3, "desc": "WebCrypto subtle digest", "from": [ { "file": 62 } ] }, { "id": "metadata/library/web-frameworks::has-routes", "conf": 0.8, "crit": 3, "desc": "Code defines HTTP routes", "from": [ { "off": 60177, "file": 139, "line": 1561 } ], "uses": [ 562 ] }, { "id": "micro-behaviors/process/create/shell/wsh::hidden-window-run", "conf": 0.92, "crit": 3, "desc": "WSH launches process with hidden window", "from": [ { "file": 70 } ] }, { "id": "metadata/library/runtime::has-eventemitter", "conf": 0.8, "crit": 2, "desc": "Code uses EventEmitter pattern", "from": [ { "file": 165 } ] }, { "id": "metadata/file/profile/language::lang-french", "conf": 0.8, "crit": 3, "desc": "French language detection", "from": [ { "off": 286911, "file": 67, "line": 180 } ], "uses": [ 221, 417, 453, 490 ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::numeric-suffix-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Many numeric suffix identifier names", "from": [ { "file": 87 } ] }, { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header", "from": [ { "file": 170 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-4", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"untuk\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/manipulation::sensitive-token-redaction", "conf": 0.8, "crit": 3, "desc": "Redacts a token or secret value", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/request-wrapper::forwarded-fetch-url-options", "atk": "T1105", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Fetch forwarded with URL and options", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/os/event/shutdown::shutdown-command-source", "conf": 0.9, "crit": 3, "desc": "Windows shutdown command in source", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::ssh-dir", "atk": "T1552.001", "conf": 0.95, "crit": 2, "desc": ".ssh directory path", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/user-agent::navigator-useragent-read", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Reads browser User-Agent string", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/com/object::wscript-shell-literal", "conf": 0.8, "crit": 3, "desc": "References the WScript.Shell COM object", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-parameter-mutation", "conf": 0.82, "crit": 3, "desc": "Mutates a URL query parameter collection", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/fs/write/file/shell::shell-profile-rc-name", "conf": 0.9, "crit": 3, "desc": "References a shell startup file", "from": [ { "file": 69 } ] }, { "id": "metadata/file/profile/language::lang-french--atom-5", "conf": 0.8, "crit": 1, "desc": "French function-word token \"cette\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/create/spawn::stdio-ignore", "mbc": "F0005", "conf": 0.85, "crit": 3, "desc": "Spawns a child with standard I/O ignored", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::node-os-alias-hostname-call", "atk": "T1082", "conf": 0.8, "crit": 3, "desc": "Node os-alias hostname query", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/buffer::buffer-from-call", "conf": 0.4, "crit": 3, "desc": "Calls Buffer.from at least three times", "from": [ { "file": 112 } ] }, { "id": "micro-behaviors/ui/window/manage/navigation::browser-location-replace", "conf": 0.9, "crit": 3, "desc": "Replaces explicit browser window location", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/process/create/load/remote-code::remote-plugin-stage-identifier", "conf": 0.88, "crit": 3, "desc": "Remote or staged plugin identifier", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-image-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Contains an inline image data URI", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipify-api", "conf": 0.85, "crit": 3, "desc": "ipify.org IP discovery API", "from": [ { "file": 89 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-pattern", "conf": 1.0, "crit": 2, "desc": "Node.js test filename pattern", "from": [ { "file": 130 } ], "uses": [ 653 ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "uses": [ 191 ] }, { "id": "micro-behaviors/time/sleep/interval::js-sleep-ms-delay", "conf": 0.9, "crit": 3, "desc": "JavaScript sleep call with millisecond delay" }, { "id": "micro-behaviors/data/manipulation::replacement-redaction-marker", "conf": 0.8, "crit": 3, "desc": "Replaces data with a redaction marker", "from": [ { "file": 31 } ] }, { "id": "metadata/file/profile/language::lang-korean", "conf": 0.8, "crit": 3, "desc": "Contains Hangul script", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/fs/file/write/direct::node-append-file-sync", "conf": 0.92, "crit": 3, "desc": "Node synchronously appends to a file", "from": [ { "file": 65 } ] }, { "id": "objectives/anti-analysis/emulator-detect/hardware::virtualbox-string", "atk": "T1497.001", "mbc": "B0009", "conf": 0.6, "crit": 3, "desc": "VirtualBox vendor string detection", "from": [ { "file": 94 } ], "uses": [ 388 ] }, { "id": "micro-behaviors/os/clipboard/command::str-xclip", "conf": 0.7, "crit": 1, "desc": "xclip string", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/buffer::node-buffer-from-json-stringify", "conf": 0.94, "crit": 3, "desc": "Creates Node.js Buffer from JSON serialization", "from": [ { "file": 45 } ] }, { "id": "objectives/discovery/system/fingerprint/user::small-node-host-user-query", "atk": "T1033,T1082", "conf": 0.9, "crit": 3, "desc": "Small Node script queries host and user", "from": [ { "file": 70 } ], "uses": [ 349, 512 ] }, { "id": "micro-behaviors/communications/http/server/framework::server-express", "atk": "T1071.001", "mbc": "C0002", "conf": 0.66, "crit": 3, "desc": "Express.js HTTP server", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/request/url::fetch-timestamped-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Fetches a URL with the current timestamp", "from": [ { "file": 84 } ] }, { "id": "micro-behaviors/fs/file/read::create-read-stream", "conf": 0.92, "crit": 3, "desc": "Creates a file read stream", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/process/create/shell/pipeline::pipeline-terminates-in-shell", "atk": "T1027,T1059.004", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "Pipeline terminates in a shell", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/http/endpoints::fetch-http-scheme-url", "conf": 0.82, "crit": 3, "desc": "Fetches an HTTP(S)-scheme URL", "from": [ { "file": 92 } ] }, { "id": "metadata/package/testing/presence/harness::test-or-declaration-file", "conf": 0.85, "crit": 1, "desc": "File is a test or type-declaration source file", "from": [ { "file": 130 } ], "uses": [ 98, 315, 396 ] }, { "id": "micro-behaviors/fs/file/read::package-json-path-reference", "conf": 0.84, "crit": 1, "desc": "References a package.json path", "from": [ { "file": 2 } ] }, { "id": "metadata/package/scripts/build::pkg-build-script-field", "conf": 0.6, "crit": 3, "desc": "Package declares a build script" }, { "id": "metadata/file/profile/language::lang-german", "conf": 0.8, "crit": 3, "desc": "Contains probable German text", "from": [ { "off": 290999, "file": 67, "line": 180 } ], "uses": [ 31, 141, 730 ] }, { "id": "micro-behaviors/crypto/asymmetric/ecdh::ecdh-api-reference", "atk": "T1573.001", "conf": 0.88, "crit": 3, "desc": "ECDH key-agreement API reference", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/os/env/vars/access::node-localappdata-access", "conf": 0.9, "crit": 3, "desc": "Node reads Windows LOCALAPPDATA directory", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/data/serialize/json-write::json-object-body-field", "conf": 0.9, "crit": 3, "desc": "Serializes an object into a body field", "from": [ { "file": 30 } ] }, { "id": "metadata/file/metrics::multiple-lines-over-1000-chars", "conf": 0.88, "crit": 3, "desc": "Multiple source lines exceed 1000 characters", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64-to-utf8", "conf": 0.85, "crit": 3, "desc": "Buffer base64 decode to UTF-8", "from": [ { "file": 65 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass-concat-full", "atk": "T1059.001", "conf": 0.9, "crit": 1, "desc": "Concatenated ExecutionPolicy bypass", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/socket/bind/address::bind-all-interfaces", "conf": 0.8, "crit": 3, "desc": "Binds or listens on all interfaces (0.0.0.0)", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/communications/http/auth::authentication-token-member", "conf": 0.94, "crit": 3, "desc": "References an authentication-token member field", "from": [ { "file": 104 } ] }, { "id": "metadata/file/profile/language::lang-french--atom-2", "conf": 0.8, "crit": 1, "desc": "French function-word token \"avec\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/llm::tool-result-marker", "conf": 0.9, "crit": 3, "desc": "References an LLM tool-result marker", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/transaction::solana-library-reference", "conf": 0.8, "crit": 3, "desc": "Solana blockchain library reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/create/spawn::process-execpath-spawn", "atk": "T1059.007", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Spawn using process.execPath", "from": [ { "file": 68 } ] }, { "id": "micro-behaviors/data/encode/url::encodeuri-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURI", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/agent-permission::vendor-agent-approval-mode-disabled", "atk": "T1562.001", "conf": 0.94, "crit": 3, "desc": "Agent run mode waives command approval", "from": [ { "file": 47 } ], "uses": [ 618 ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.7, "crit": 3, "desc": "References the Bash shell", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/agent::remote-desktop-task-agent", "atk": "T1219", "mbc": "B0022", "conf": 0.97, "crit": 3, "desc": "Remote desktop task agent capability", "from": [ { "file": 69 } ], "uses": [ 16, 96, 97, 280, 464, 469, 693 ] }, { "id": "micro-behaviors/os/telemetry/logging/event::log-event-identifier", "conf": 0.82, "crit": 3, "desc": "References the logEvent telemetry method", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-window-open", "conf": 0.8, "crit": 3, "desc": "Opens browser window or tab", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/process/create/agent::remote-received-files-label", "atk": "T1219", "mbc": "B0022", "conf": 0.86, "crit": 1, "desc": "Remote received files label", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/request/body::oauth-token-field-in-body", "conf": 0.92, "crit": 3, "desc": "Builds body containing OAuth token fields", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::async-iife-invoke", "conf": 0.7, "crit": 3, "desc": "Immediately invokes an async function" }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/create/agent::remote-file-transfer-directory", "atk": "T1219", "mbc": "B0022", "conf": 0.88, "crit": 1, "desc": "Remote file transfer directory", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/buffer::node-buffer-tostring-call", "conf": 0.88, "crit": 3, "desc": "Converts Node.js Buffer output to text", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/url/domain::workers-dev-url", "conf": 0.85, "crit": 3, "desc": "HTTP(S) URL pointing to Cloudflare Workers", "from": [ { "file": 45 } ] }, { "id": "well-known/lib/cloud/supabase::storage-js-package-reference", "conf": 0.96, "crit": 3, "desc": "References the Supabase JS SDK package", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "file": 42 } ], "uses": [ 684 ] }, { "id": "metadata/lang/javascript-features::destructuring", "conf": 0.9, "crit": 1, "desc": "ES6 destructuring assignment", "from": [ { "file": 71 } ] }, { "id": "micro-behaviors/communications/http/websocket::ws-scheme", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "References an unencrypted ws:// WebSocket URL", "from": [ { "file": 104 } ] }, { "id": "metadata/file/metrics::low-whitespace", "conf": 0.7, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/time/schedule/interval::repeated-settimeout", "conf": 0.9, "crit": 3, "desc": "Contains at least six setTimeout calls", "from": [ { "file": 40 } ] }, { "id": "metadata/library/structure::js-large-minified-bundle", "conf": 0.92, "crit": 2, "desc": "Large minified JavaScript bundle", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/info/commandline::check-argv", "conf": 0.8, "crit": 2, "desc": "Reads Node.js arguments through process.argv", "from": [ { "file": 68 } ] }, { "id": "micro-behaviors/communications/socket/connect::node-named-create-connection", "conf": 0.94, "crit": 3, "desc": "Node net import opens a TCP connection", "from": [ { "file": 4 } ], "uses": [ 24, 655 ] }, { "id": "micro-behaviors/communications/http/request/client::fetch-post-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JavaScript file uses fetch and configures an HTTP POST", "uses": [ 105, 191 ] }, { "id": "micro-behaviors/communications/http/url/domain::js-http-url-literal-in-file-tail", "conf": 0.85, "crit": 3, "desc": "HTTP(S) URL literal in file tail", "from": [ { "file": 78 } ] }, { "id": "metadata/package/scripts/build::has-prepublish-only", "conf": 0.85, "crit": 3, "desc": "Package declares a prepublish-only script" }, { "id": "micro-behaviors/fs/path/sensitive/credentials::ssh-private-key-filename-rsa", "atk": "T1552.001", "conf": 0.95, "crit": 1, "desc": "id_rsa filename constant", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/hardware/input/event::browser-keyboard-event-listener", "conf": 0.94, "crit": 3, "desc": "Registers a DOM keyboard event listener", "from": [ { "file": 31 } ] }, { "id": "objectives/credential-access/wallet/provider::window-dot-ethereum", "atk": "T1555.003", "conf": 0.6, "crit": 3, "desc": "window.ethereum access", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/crypto/library/provider::create-hmac", "conf": 0.7, "crit": 3, "desc": "Node crypto HMAC creation", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::pem-file-extension-reference", "atk": "T1552.004", "conf": 0.75, "crit": 3, "desc": "References a PEM certificate or key file", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/os/clipboard/access::browser-clipboard-write", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Writes to the browser clipboard", "from": [ { "file": 62 } ] }, { "id": "metadata/file/profile/language::lang-french--atom-4", "conf": 0.8, "crit": 1, "desc": "French function-word token \"vous\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/send::node-socket-write", "atk": "T1071", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node socket writes a data payload", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen", "from": [ { "file": 69 } ] }, { "id": "metadata/package/testing/harness/electron::electron-remote-control-import", "conf": 0.9, "crit": 1, "desc": "Electron remote control import", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-constructor-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Creates a WebSocket connection", "from": [ { "file": 78 } ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-virtualbox", "atk": "T1497.001", "conf": 0.6, "crit": 3, "desc": "VirtualBox hypervisor vendor string", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-target", "conf": 0.9, "crit": 3, "desc": "HTTP request targets loopback address", "from": [ { "file": 92 } ], "uses": [ 427, 547 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::js-platform-darwin-check", "conf": 0.6, "crit": 2, "desc": "process.platform macOS check", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/interpreter/jscript::is-jscript", "conf": 0.8, "crit": 3, "desc": "WScript host object access", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::xhr-readystatechange-handler", "conf": 0.7, "crit": 3, "desc": "Assigns an XHR readystatechange handler", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/response::server-response-send-end", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response send/end method", "from": [ { "file": 40 } ] }, { "id": "metadata/package/quality/profile::has-config-assignment", "conf": 0.75, "crit": 3, "desc": "Code uses assigned configuration objects", "from": [ { "file": 171 } ] }, { "id": "micro-behaviors/communications/http/url/query::js-urlsearchparams-construction", "conf": 0.95, "crit": 3, "desc": "Builds URL query parameters", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/data/encode/base64::node-template-image-data-url", "mbc": "C0026", "conf": 0.9, "crit": 3, "desc": "Image data URL with interpolated Base64", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/time/schedule/delay::settimeout-callback-long-delay", "conf": 0.85, "crit": 3, "desc": "setTimeout defers callback ten or more seconds", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/os/security/auth/session::source-session-user-member-assignment", "conf": 0.88, "crit": 3, "desc": "Assigns session user member", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/ui/menu/dom::browser-contextmenu-suppress", "conf": 0.86, "crit": 3, "desc": "Suppresses DOM context menu", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/data/serialize/json::json-object-action-field", "conf": 0.82, "crit": 3, "desc": "JSON payload includes an action field", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/network/status::netstat", "conf": 0.9, "crit": 3, "desc": "netstat command", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/create/flags::powershell-policy-bypass-argv-pair", "atk": "T1059.001,T1562.001", "conf": 0.94, "crit": 3, "desc": "PowerShell Bypass as separate argv strings", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-number-parse", "conf": 0.9, "crit": 3, "desc": "JavaScript hex-to-integer conversion", "from": [ { "file": 104 } ] }, { "id": "objectives/discovery/system/fingerprint/user::node-host-user-query", "atk": "T1033,T1082", "conf": 0.85, "crit": 3, "desc": "Node queries host and user identity", "from": [ { "off": 23924, "file": 45, "line": 669 }, { "file": 54 }, { "off": 23493, "file": 74, "line": 587 }, { "file": 75 }, { "file": 76 }, { "file": 94 }, { "file": 101 } ], "uses": [ 145, 456, 713 ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::node-chmod-exec-mode-755", "atk": "T1222", "mbc": "E1222", "conf": 0.9, "crit": 3, "desc": "Node chmod sets 0o755 executable mode", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::fetch-empty-catch-handler", "conf": 0.9, "crit": 3, "desc": "Fetch promise uses empty catch handler", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::node-platform-win32-branch", "conf": 0.7, "crit": 2, "desc": "Branches on Windows platform value", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/get::node-http-client-get", "conf": 0.75, "crit": 3, "desc": "Node HTTP client invokes get()", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/process/fd/stdio::stderr-string", "conf": 0.3, "crit": 2, "desc": "References the stderr stream name", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/http/oauth::supabase-google-oauth-flow", "conf": 0.95, "crit": 3, "desc": "Supabase Google OAuth flow", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::js-bearer-header-from-auth-token", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Uses an auth token in Bearer header", "from": [ { "file": 40 } ] }, { "id": "metadata/file/profile/language::vietnamese-common-word-cua", "conf": 1.0, "crit": 1, "desc": "Vietnamese common word của", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/fs/path/sensitive/credentials::ssh-credentials", "atk": "T1552.001", "conf": 0.95, "crit": 3, "desc": "SSH credential file paths", "from": [ { "file": 74 } ], "uses": [ 412 ] }, { "id": "micro-behaviors/data/decode/custom::fromcharcode-arrow-map", "atk": "T1140", "conf": 0.85, "crit": 3, "desc": "Arrow-maps character codes to a string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/browser-automation::authentication-token-name-literal", "conf": 0.9, "crit": 3, "desc": "Authentication token name literal", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/proc/info/path::proc-pid-cmdline-glob", "conf": 0.8, "crit": 3, "desc": "Glob pattern for /proc/*/cmdline", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-provider-token-field", "conf": 0.94, "crit": 3, "desc": "OAuth provider token session field", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/hardware/input/event::browser-touchstart-listener", "conf": 0.9, "crit": 3, "desc": "Registers a DOM touchstart listener", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/proxy/turn::webrtc-stun-turn-relay-config", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "WebRTC STUN or TURN relay configuration", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/os/env/vars/user-paths::userprofile-var", "conf": 0.5, "crit": 3, "desc": "USERPROFILE path environment variable", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-generic", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node generic server listens on endpoint", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/patch::patch-method-detection", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "Uses or defines an HTTP PATCH method", "from": [ { "file": 35 }, { "file": 67 }, { "file": 104 }, { "file": 107 } ], "uses": [ 569 ] }, { "id": "micro-behaviors/data/compress/library::node-zlib-import", "conf": 0.9, "crit": 3, "desc": "Imports the Node.js zlib module", "from": [ { "file": 110 } ] }, { "id": "micro-behaviors/communications/http/url/query::function-encoded-template-query-parameter", "conf": 0.92, "crit": 3, "desc": "Encodes query value with function", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/headers::authorization-header-index-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Authorization header property assignment", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/cookies::instagram-session-cookie-name", "atk": "T1539", "mbc": "C0002", "conf": 0.99, "crit": 3, "desc": "References Instagram session cookie name", "from": [ { "file": 169 } ] }, { "id": "micro-behaviors/fs/write/file/direct::append-file-async", "conf": 0.8, "crit": 3, "desc": "Appends to file asynchronously", "from": [ { "file": 18 } ] }, { "id": "well-known/lib/ui/react::production-error-decoder", "conf": 0.95, "crit": 3, "desc": "React minified production error decoder text", "from": [ { "file": 87 } ] }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/module/load::dynamic-import-expression", "conf": 0.88, "crit": 3, "desc": "Dynamically imports a computed module reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/encode/base64::node-json-buffer-base64-encode", "mbc": "C0026", "conf": 0.94, "crit": 3, "desc": "Serializes JSON into a Node.js Buffer and Base64-encodes it", "uses": [ 70, 434 ] }, { "id": "micro-behaviors/crypto/hash/hmac::node-createhmac-text-call", "mbc": "C0029", "conf": 0.92, "crit": 3, "desc": "Node.js HMAC call in source text", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/os/module/load::node-require-resolve-call", "conf": 0.8, "crit": 3, "desc": "Resolves an installed module path", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/process/create/shell/interpreter::powershell-executable-token", "conf": 0.98, "crit": 3, "desc": "PowerShell executable name reference", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/process/create/spawn::detached-dynamic", "atk": "T1059", "mbc": "F0011", "conf": 0.8, "crit": 3, "desc": "Detached spawn with dynamic value", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/data/control-flow/branch::send-action-branch", "conf": 0.85, "crit": 3, "desc": "Branches on send action", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/hardware/display/screen::dynamic-import-node-screenshots", "atk": "T1113", "mbc": "B0002", "conf": 0.92, "crit": 3, "desc": "Dynamically imports node-screenshots library", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/spawn-variable::spawn-variable-program", "conf": 0.82, "crit": 3, "desc": "Node spawns a variable program path", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/endpoints::loopback-http-url-reference", "conf": 0.9, "crit": 3, "desc": "References a loopback HTTP URL", "from": [ { "file": 32 } ] }, { "id": "well-known/app/system/electron-auth::electron-safe-storage-decrypt", "conf": 0.95, "crit": 1, "desc": "Electron safeStorage decryptString call", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/http/header/accept::accept-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Requests a JSON HTTP response", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/telemetry/logging/event::extension-installation-id-field", "conf": 0.93, "crit": 3, "desc": "Extension installation identifier field", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/url/tld::reserved-documentation-tld-url", "conf": 0.95, "crit": 3, "desc": "URL uses RFC 2606 reserved documentation TLD", "from": [ { "file": 134 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-32-byte-value", "conf": 0.84, "crit": 3, "desc": "Node.js 32-byte random value", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/auth::oauth-token-body-variable-post", "conf": 0.93, "crit": 3, "desc": "Posts OAuth token body variable", "from": [ { "file": 113 } ], "uses": [ 465, 481 ] }, { "id": "metadata/package/testing/presence/fixture::test-filename-pattern", "conf": 0.6, "crit": 2, "desc": "Common test filename pattern", "from": [ { "file": 130 } ] }, { "id": "metadata/package/testing/presence/harness::test-spec-path-benign-context", "conf": 1.0, "crit": 1, "desc": "Test or spec path context", "from": [ { "file": 135 } ], "uses": [ 158 ] }, { "id": "micro-behaviors/process/io/stream::node-stream-data-event", "conf": 0.88, "crit": 3, "desc": "Registers a Node stream data handler", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/serialize/object::dotnet-framework-assembly-type", "conf": 0.96, "crit": 3, "desc": "Assembly-qualified System type" }, { "id": "metadata/file/profile/language::lang-arabic-script", "conf": 0.8, "crit": 3, "desc": "Contains Arabic-script text", "from": [ { "file": 62 } ] }, { "id": "objectives/anti-static/obfuscation/multi-layer::aes-gcm-decrypt-in-decoded-layer", "atk": "T1027,T1140", "mbc": "B0032,E1027", "conf": 0.85, "crit": 3, "desc": "AES-GCM decryption call", "from": [ { "file": 50 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-variable-code-constructor-call", "atk": "T1059.007", "conf": 0.95, "crit": 3, "desc": "Constructor receives a code variable", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/communications/http/url/query::encoded-template-query-parameter", "conf": 0.9, "crit": 3, "desc": "Encodes value in a URL query template", "from": [ { "file": 40 } ] }, { "id": "metadata/library/web-frameworks::has-routes-app-a", "conf": 0.8, "crit": 3, "desc": "Code defines HTTP routes", "from": [ { "file": 134 } ] }, { "id": "micro-behaviors/ui/window/manage/style::fixed-viewport-style", "conf": 0.9, "crit": 3, "desc": "Fixed CSS element spans viewport", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/os/module/load::dynamic-import-string-literal", "conf": 0.8, "crit": 3, "desc": "Dynamically imports a literal module path" }, { "id": "micro-behaviors/os/sysinfo/platform/browser::browser-screen-dimensions-read", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "Reads browser screen dimensions", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/buffer::stream-write-buffer-arg", "conf": 0.9, "crit": 3, "desc": "Writes a buffer argument to a stream", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/load/remote-code::js-head-append-script-node", "atk": "T1105", "conf": 0.85, "crit": 3, "desc": "Appends a node to document.head", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-mutation-observer", "conf": 0.8, "crit": 3, "desc": "Watches DOM changes with MutationObserver", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/http/patch::http-patch-method-field", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "HTTP PATCH method marker", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "from": [ { "file": 9 } ], "uses": [ 695 ] }, { "id": "micro-behaviors/communications/http/header/custom::non-mozilla-user-agent-header", "conf": 0.9, "crit": 3, "desc": "Sets a non-Mozilla User-Agent header", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::catch-returns-constant-only", "conf": 0.88, "crit": 3, "desc": "Catch block only returns a constant", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/hardware/input/mouse/position::dom-pointer-client-coordinate-read", "conf": 0.9, "crit": 3, "desc": "Reads a DOM pointer client coordinate", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::os-release-call", "conf": 0.75, "crit": 3, "desc": "Queries OS release with os.release()", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-tools-call-method", "conf": 0.85, "crit": 3, "desc": "MCP tools/call JSON-RPC method", "from": [ { "file": 43 } ] }, { "id": "well-known/lib/cloud/supabase::supabase-api-version-header", "conf": 0.9, "crit": 3, "desc": "Supabase API version request header", "from": [ { "file": 104 } ] }, { "id": "metadata/package/testing/presence/harness::smoke-test-source-path", "conf": 0.95, "crit": 1, "desc": "Smoke test source path", "from": [ { "file": 168 } ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/start-process::start-process-filepath", "conf": 0.8, "crit": 3, "desc": "Start-Process FilePath parameter", "from": [ { "file": 112 } ] }, { "id": "micro-behaviors/data/encode/base64::btoa-symbol", "conf": 0.78, "crit": 3, "desc": "Calls the browser btoa() Base64 encoder", "from": [ { "file": 62 } ] }, { "id": "objectives/credential-access/theft/keywords::access-token-field-name", "conf": 0.96, "crit": 1, "desc": "Access-token field name in structured data", "from": [ { "file": 104 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/read::node-open-sync", "conf": 0.7, "crit": 3, "desc": "Opens a file synchronously with Node.js", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::js-platform-win32-check", "conf": 0.6, "crit": 2, "desc": "Checks whether Node.js runs on Windows", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.7, "crit": 3, "desc": "Reads an XMLHttpRequest response body", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/format/locale::js-locale-formatting-call", "conf": 0.9, "crit": 3, "desc": "JavaScript locale-aware formatting call", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/process/create/spawn::detached-true", "atk": "T1059", "mbc": "F0011", "conf": 0.85, "crit": 3, "desc": "Detached process spawn option", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/data/decode/base64::powershell-frombase64string", "conf": 0.95, "crit": 3, "desc": "PowerShell decodes Base64 with Convert" }, { "id": "micro-behaviors/data/buffer::indexed-byte-xor-mutation", "conf": 0.92, "crit": 3, "desc": "XOR-mutates an indexed byte", "from": [ { "file": 133 } ] }, { "id": "micro-behaviors/os/privilege/elevation::pkexec-binary-reference", "conf": 0.85, "crit": 3, "desc": "References the pkexec elevation helper", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem-variable-key", "conf": 0.9, "crit": 3, "desc": "Writes browser storage with a computed key", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/os/random/crypto::webcrypto-get-random-values", "conf": 0.96, "crit": 3, "desc": "Generates Web Crypto random bytes", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-input-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets input elements", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-400-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 400", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/url/encoded::slash-to-percent-encoded-rewrite-replacement-first", "conf": 0.94, "crit": 3, "desc": "Replacement-first call percent-encodes slashes", "from": [ { "file": 112 } ] }, { "id": "objectives/execution/interpreter/script/wsh::execution-policy-bypass", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "PowerShell execution policy bypass", "from": [ { "off": 9163, "file": 29, "line": 208 }, { "file": 33 }, { "file": 70 }, { "file": 74 }, { "off": 29057, "file": 76, "line": 799 }, { "file": 117 }, { "file": 120 } ], "uses": [ 130, 318, 741 ] }, { "id": "micro-behaviors/communications/http/request/url::fetch-no-store-cache", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Fetch disables response caching" }, { "id": "micro-behaviors/communications/socket/listen::node-net-create-server", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node net module creates a server", "from": [ { "file": 70 } ] }, { "id": "metadata/file/string/identity::source-text-token", "conf": 0.95, "crit": 1, "desc": "Contains the sourceText identifier", "from": [ { "file": 114 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::object-type-dispatch-switch", "conf": 0.93, "crit": 3, "desc": "Switch dispatches on an object type field", "from": [ { "file": 87 } ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "from": [ { "file": 130 } ], "uses": [ 339, 425 ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/data/buffer::uint8array-constructor", "conf": 0.9, "crit": 2, "desc": "Constructs a Uint8Array buffer", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/communications/ipc/rpc::wallet-provider-eth-request-accounts-text", "conf": 0.9, "crit": 3, "desc": "Quoted eth_requestAccounts in bundle text", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/request/body::request-body-property-access", "conf": 0.84, "crit": 3, "desc": "Accesses a request body property", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/download/handler::browser-forced-download", "conf": 0.9, "crit": 3, "desc": "Browser creates forced download link", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::checkip-aws", "conf": 0.85, "crit": 3, "desc": "AWS checkip service", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-named", "mbc": "C0001", "conf": 0.86, "crit": 3, "desc": "Node named server listens on endpoint", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/socket/connect::net-connect", "conf": 0.86, "crit": 3, "desc": "Node net.connect or createConnection usage", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-pkce-code-challenge", "conf": 0.8, "crit": 3, "desc": "OAuth PKCE code-challenge field", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-proxy-get-trap", "conf": 0.9, "crit": 3, "desc": "Proxy intercepts property reads", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/receive::node-socket-message-event", "atk": "T1071", "mbc": "C0001", "conf": 0.78, "crit": 3, "desc": "Node socket message event handler", "from": [ { "file": 45 } ] }, { "id": "metadata/file/profile/language::lang-indonesian", "conf": 0.8, "crit": 3, "desc": "Contains probable Indonesian text", "from": [ { "off": 12783, "file": 67, "line": 2 } ], "uses": [ 38, 161, 180, 340, 351, 408, 716 ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/time/query::unix-timestamp-expression", "conf": 0.86, "crit": 3, "desc": "Computes a Unix-seconds timestamp", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-keyword-reference", "conf": 0.5, "crit": 3, "desc": "References an OAuth endpoint marker", "from": [ { "file": 149 } ] }, { "id": "micro-behaviors/communications/http/service-worker::event-activate", "conf": 1.0, "crit": 3, "desc": "Service Worker activate event listener", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/create/agent::codex-never-approval-policy", "atk": "T1059", "mbc": "B0022", "conf": 0.88, "crit": 3, "desc": "Codex command approvals disabled", "from": [ { "file": 42 } ] }, { "id": "metadata/package/quality/empty::npm-no-keywords", "conf": 0.5, "crit": 2, "desc": "package.json has no keywords" }, { "id": "micro-behaviors/communications/http/response::server-response-not-found-status", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Server response emits HTTP 404 status", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/data/encode/arrays::js-hex-number-array", "conf": 0.8, "crit": 3, "desc": "Contains a long hexadecimal byte array", "from": [ { "file": 135 } ] }, { "id": "micro-behaviors/communications/http/service-worker::control-skip-waiting", "conf": 1.0, "crit": 3, "desc": "Service Worker skips waiting phase", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/create/launch::embedded-desktop-entry-exec", "conf": 0.92, "crit": 3, "desc": "Embeds an application Desktop Entry", "from": [ { "file": 136 } ] }, { "id": "micro-behaviors/communications/ipc/rpc::wallet-provider-eth-request-accounts", "conf": 0.9, "crit": 3, "desc": "Ethereum wallet account-request RPC method", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/mcp::mcp-tools-list-method", "conf": 0.8, "crit": 3, "desc": "MCP tools/list JSON-RPC method", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/server/request::express-json-body-parser", "conf": 0.86, "crit": 3, "desc": "Configures Express JSON body parser", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/crypto/symmetric/aes/runtime-library::createCipheriv", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "Creates cipher with initialization vector", "from": [ { "file": 50 } ] }, { "id": "well-known/lib/cloud/supabase::supabase-js-client-info-header", "conf": 0.96, "crit": 3, "desc": "Bundled Supabase JS SDK client header", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/request/client::node-http", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Node.js built-in http/https module usage", "from": [ { "file": 70 } ], "uses": [ 164 ] }, { "id": "metadata/library/structure::js-vite-modulepreload-polyfill", "conf": 0.96, "crit": 2, "desc": "Contains Vite/Rollup module-preload polyfill", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-window-stop", "conf": 0.82, "crit": 3, "desc": "Stops browser page loading", "from": [ { "file": 84 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-start", "conf": 0.86, "crit": 1, "desc": "Starts a synchronous function expression", "from": [ { "file": 83 } ] }, { "id": "micro-behaviors/communications/websocket/receive::websocket-message-event-handler", "atk": "T1071.001", "conf": 0.9, "crit": 3, "desc": "WebSocket or tunnel message event handler", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/browser::electron-renderer-detect", "atk": "T1082", "conf": 0.95, "crit": 3, "desc": "Detects Electron renderer process", "from": [ { "file": 143 } ] }, { "id": "metadata/library/web-frameworks::reader-read-call", "conf": 0.9, "crit": 1, "desc": "Reader read call", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/url/query::browser-url-query-enumeration", "conf": 0.86, "crit": 3, "desc": "Enumerates URL query parameters", "from": [ { "file": 104 } ] }, { "id": "objectives/discovery/system/fingerprint/runtime::deep-fingerprint-vector", "conf": 0.9, "crit": 1, "desc": "Identifying host-profiling vector", "from": [ { "off": 23924, "file": 45, "line": 669 }, { "off": 23493, "file": 74, "line": 587 }, { "file": 75 }, { "file": 94 } ], "uses": [ 145, 713 ] }, { "id": "micro-behaviors/communications/http/response::node-response-pipe", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Pipes a Node HTTP response stream", "from": [ { "file": 129 } ] }, { "id": "micro-behaviors/crypto/library/blockchain/client::ethereum-jsonrpc-method", "conf": 0.9, "crit": 3, "desc": "Ethereum JSON-RPC method field", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/directory/traverse::root-dirs-list", "conf": 0.8, "crit": 3, "desc": "List of root directories for scanning", "from": [ { "off": 29410, "file": 45, "line": 831 }, { "off": 2682, "file": 98, "line": 74 } ], "uses": [ 285 ] }, { "id": "micro-behaviors/data/decode/base64::dotnet-frombase64string-text", "conf": 0.9, "crit": 3, "desc": ".NET FromBase64String method reference" }, { "id": "micro-behaviors/communications/http/server/middleware::app-router-use-middleware-registration", "conf": 0.85, "crit": 3, "desc": "JavaScript app or router registers middleware", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/data/format/blob::browser-javascript-blob", "conf": 0.9, "crit": 3, "desc": "Creates JavaScript Blob from variable source", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-spawnsync", "conf": 0.98, "crit": 3, "desc": "Calls spawnSync() to run a child process", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-value-event-member-read", "conf": 0.9, "crit": 3, "desc": "Reads event/target value or innerText", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/data/string/concat::join-empty-separator-call", "conf": 0.82, "crit": 3, "desc": "Joins values without a separator", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/encode/char-code::multiple-fromcharcode-calls", "conf": 0.92, "crit": 3, "desc": "Calls String.fromCharCode multiple times", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-spawnsync-interpreter", "conf": 0.95, "crit": 3, "desc": "Runs an interpreter via spawnSync", "from": [ { "file": 70 } ], "uses": [ 175 ] }, { "id": "metadata/package/manifest/publishing::npm-public-publish-access", "conf": 0.9, "crit": 3, "desc": "npm package is configured for public publishing" }, { "id": "micro-behaviors/os/module/load::cjs-require-in-try", "conf": 0.9, "crit": 3, "desc": "CommonJS require inside a try block", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/data/buffer::indexed-byte-xor-nontrivial-mask", "conf": 0.92, "crit": 3, "desc": "XOR-mutates indexed byte with non-1 mask", "from": [ { "file": 133 } ] }, { "id": "metadata/package/testing/harness/runtime::test-basename-suffix", "conf": 1.0, "crit": 2, "desc": "Node.js test filename suffix", "from": [ { "file": 130 } ] }, { "id": "micro-behaviors/data/language::lang-turkish--atom-1", "conf": 0.8, "crit": 1, "desc": "Turkish function-word token", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/socket/connect::node-net-namespace-import", "conf": 0.9, "crit": 3, "desc": "Imports Node net as a namespace", "from": [ { "file": 4 } ] }, { "id": "metadata/package/manifest/publishing::has-publish-config", "conf": 0.85, "crit": 3, "desc": "npm manifest declares publishConfig" }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/json::json-object-variable-field", "conf": 0.84, "crit": 1, "desc": "JSON object includes a variable-valued field", "from": [ { "file": 30 } ] }, { "id": "micro-behaviors/data/db/web-storage::window-localstorage-getitem", "conf": 0.82, "crit": 3, "desc": "Reads window.localStorage with getItem", "from": [ { "file": 31 } ] }, { "id": "metadata/package/files/runtime::javascript-dist-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript/TypeScript file under dist", "from": [ { "file": 30 } ] }, { "id": "metadata/build/bundler::babel-helpers-import", "conf": 0.9, "crit": 2, "desc": "Imports Babel helper functions", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/string/concat::massive-concatenation-chain", "conf": 0.7, "crit": 3, "desc": "JavaScript massive string concatenation chain", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/response::javascript-response-redirect-call", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript response redirect method", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ifconfig-me", "conf": 0.85, "crit": 3, "desc": "ifconfig.me IP discovery", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "file": 43 } ], "uses": [ 105, 279 ] }, { "id": "metadata/package/testing/presence/scripted::wait-for-call", "conf": 0.6, "crit": 2, "desc": "waitFor() call", "from": [ { "file": 134 } ] }, { "id": "micro-behaviors/data/string/replace::chained-replace-calls", "conf": 0.9, "crit": 3, "desc": "Chains multiple JavaScript string replacements", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/os/random/crypto::node-random-generation", "conf": 0.72, "crit": 3, "desc": "Node.js cryptographic random-value generation", "from": [ { "file": 40 } ], "uses": [ 8, 552 ] }, { "id": "micro-behaviors/crypto/symmetric/decrypt::js-decrypt-helper-call", "mbc": "C0027", "conf": 0.94, "crit": 3, "desc": "JavaScript decrypt helper function call", "from": [ { "file": 88 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 78 } ] }, { "id": "metadata/permission/workspace::workspace-findFiles", "conf": 0.85, "crit": 3, "desc": "VSCode workspace.findFiles API call (file", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-execfilesync", "conf": 0.9, "crit": 3, "desc": "Executes a file synchronously", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/env/modify::env-path-assignment", "conf": 0.9, "crit": 3, "desc": "JavaScript PATH environment assignment", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem-call", "conf": 0.9, "crit": 3, "desc": "Calls localStorage or sessionStorage setItem", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::js-platform-linux-check", "conf": 0.6, "crit": 2, "desc": "process.platform Linux check", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/communications/socket/listen::node-server-listen-all-interfaces", "atk": "T1046", "mbc": "C0001", "conf": 0.95, "crit": 3, "desc": "Node server listens on all interfaces", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/fs/write/file/direct::write-file-sync", "conf": 0.95, "crit": 3, "desc": "Node fs writes to a file synchronously", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-lower", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 1, "desc": "websocket lowercase reference", "from": [ { "file": 45 } ] }, { "id": "objectives/discovery/system/fingerprint/browser::browser-hardware-profile", "atk": "T1082", "conf": 0.94, "crit": 3, "desc": "Collects multiple browser hardware and locale attributes", "from": [ { "off": 4163, "file": 51, "line": 99 }, { "off": 341229, "file": 67, "line": 180 }, { "off": 991, "file": 110, "line": 1 } ], "uses": [ 36, 284, 369, 565, 735 ] }, { "id": "micro-behaviors/process/terminate/kill::js-sigkill-process", "conf": 0.86, "crit": 3, "desc": "Node sends SIGKILL to process", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/data/source/unsafe::member-write-call", "conf": 0.9, "crit": 3, "desc": "Calls write on a zlib-style handle", "from": [ { "file": 69 } ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-local-ip-discovery", "atk": "T1016", "conf": 0.94, "crit": 3, "desc": "WebRTC local IP discovery", "from": [ { "off": 28663, "file": 83, "line": 6 }, { "file": 139 } ], "uses": [ 11, 194, 253, 728 ] }, { "id": "micro-behaviors/process/create/spawn::spawn-call", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "Calls imported Node child_process spawn", "from": [ { "file": 42 } ], "uses": [ 4, 111 ] }, { "id": "micro-behaviors/process/interpreter/jscript::createobject-call", "conf": 0.85, "crit": 3, "desc": "JScript CreateObject call", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 1, "desc": "child_process module name literal", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/credentials::fetch-credentials-include", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Fetch sends browser credentials", "from": [ { "file": 78 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-typed-array-reconstruction", "conf": 0.96, "crit": 3, "desc": "Rebuilds Base64 data as typed bytes", "from": [ { "file": 62 } ], "uses": [ 2, 603, 702 ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::os-arch-call", "conf": 0.75, "crit": 2, "desc": "Queries the CPU architecture with os.arch()", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "from": [ { "file": 70 } ] }, { "id": "micro-behaviors/communications/http/response::http-redirect-helper-call", "conf": 0.92, "crit": 3, "desc": "Calls HTTP response redirect method", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/fs/read/file::node-sensitive-file-read", "conf": 0.88, "crit": 3, "desc": "Node reads a sensitive config path", "from": [ { "file": 96 } ] }, { "id": "micro-behaviors/process/create/agent::remote-agent-task-command", "atk": "T1219", "mbc": "B0022", "conf": 0.92, "crit": 1, "desc": "Remote agent task command", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::slash-bash-command-literal", "atk": "T1059", "mbc": "C0017", "conf": 0.88, "crit": 1, "desc": "Chat slash-bash command literal", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-invoke", "conf": 0.86, "crit": 3, "desc": "Immediately invokes a synchronous function", "from": [ { "file": 83 } ], "uses": [ 297, 633 ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 1 } ], "uses": [ 111, 537, 658 ] }, { "id": "micro-behaviors/data/decode/base64::buffer-from-base64", "conf": 0.8, "crit": 3, "desc": "Base64 decoding via Buffer.from (JS)", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/process/create/system::js-execfile-call", "atk": "T1059", "mbc": "E1059", "conf": 0.88, "crit": 3, "desc": "Executes file via Node.js execFile", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 33 } ] }, { "id": "metadata/package/versioning::npm-has-version", "conf": 1.0, "crit": 2, "desc": "package.json defines a package version" }, { "id": "micro-behaviors/data/encode/char-code::charcode-byte-array-assignment", "conf": 0.94, "crit": 3, "desc": "Assigns character code to array element", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/ip/endpoint::http-port-80", "conf": 0.6, "crit": 1, "desc": "HTTP service port number", "from": [ { "file": 143 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connection-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 1, "desc": "WebSocket connection upgrade header", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/hardware/input/event::browser-mousemove-listener", "conf": 0.9, "crit": 3, "desc": "Registers a DOM mousemove listener", "from": [ { "file": 102 } ] }, { "id": "micro-behaviors/fs/chmod/executable/mode::node-chmod-exec-mode-text", "atk": "T1222", "mbc": "E1222", "conf": 0.82, "crit": 3, "desc": "Node chmod with owner-executable octal mode", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::os-homedir-call", "atk": "T1033", "conf": 0.7, "crit": 3, "desc": "os.homedir() user home directory", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/javascript-features::spread-operator", "conf": 0.9, "crit": 1, "desc": "ES6 spread operator (in array/object context)", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-upgrade-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 1, "desc": "WebSocket HTTP upgrade header", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/header/custom::application-user-agent", "conf": 0.86, "crit": 3, "desc": "Application-specific User-Agent header", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-pkce-code-verifier", "conf": 0.8, "crit": 3, "desc": "OAuth PKCE code-verifier field", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/user/query::os-userinfo-call", "atk": "T1033", "conf": 0.8, "crit": 3, "desc": "os.userInfo() user query", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/shell/build::package-manager-install-argv", "atk": "T1059", "conf": 0.94, "crit": 1, "desc": "Package-manager install argument vector", "from": [ { "file": 66 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-location-assign", "conf": 0.82, "crit": 3, "desc": "Navigates browser location", "from": [ { "file": 46 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-2", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"dan\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-textarea-selector", "conf": 0.9, "crit": 1, "desc": "Browser selector targets textarea elements", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/server/listener::server", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Runs an HTTP server", "from": [ { "file": 45 }, { "file": 75 }, { "file": 96 }, { "file": 101 } ], "uses": [ 233 ] }, { "id": "micro-behaviors/fs/file/read::readfilesync-call", "conf": 0.9, "crit": 3, "desc": "Calls readFileSync", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/encode/hex::js-to-string-hex", "conf": 0.95, "crit": 3, "desc": "Calls JavaScript toString with hex encoding", "from": [ { "file": 40 } ] }, { "id": "metadata/file/profile/locale::language-label-table-name", "conf": 0.95, "crit": 2, "desc": "Contains a UI language-label table", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/url/object-url::browser-object-url", "conf": 0.88, "crit": 3, "desc": "Browser creates an object URL", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/process/terminate/command::js-taskkill-force-command", "conf": 0.9, "crit": 3, "desc": "JavaScript force-kills a Windows process", "from": [ { "file": 69 } ] }, { "id": "metadata/file/profile/language::lang-italian", "conf": 0.8, "crit": 3, "desc": "Italian language detection", "from": [ { "off": 25739, "file": 67, "line": 3 } ], "uses": [ 37, 370 ] }, { "id": "micro-behaviors/fs/chmod/modify::node-chmod-call", "conf": 0.85, "crit": 3, "desc": "Node calls chmod to change permissions", "from": [ { "file": 1 } ] }, { "id": "objectives/credential-access/cloud/token/oauth::secondme-refresh-token-marker", "atk": "T1528", "conf": 0.9, "crit": 1, "desc": "OAuth refresh-token marker", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/server/middleware::wildcard-cors-map-entry", "conf": 0.95, "crit": 3, "desc": "JavaScript defines wildcard CORS map entry", "from": [ { "file": 70 } ] }, { "id": "objectives/discovery/system/fingerprint/network::webrtc-ice-candidate-address-read", "atk": "T1016", "conf": 0.9, "crit": 1, "desc": "Reads an ICE candidate address", "from": [ { "file": 78 } ] }, { "id": "objectives/discovery/system/activity::significant-recon", "conf": 1.0, "crit": 3, "desc": "Significant system reconnaissance activity", "from": [ { "file": 45 }, { "off": 71812, "file": 75, "line": 1944 } ], "uses": [ 84, 172 ] }, { "id": "metadata/file/profile/language::lang-german--atom-1", "conf": 0.8, "crit": 2, "desc": "German function-word token \"nicht\"", "from": [ { "file": 62 } ] }, { "id": "micro-behaviors/data/serialize/json::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-page-url-href-argument-read", "conf": 0.9, "crit": 3, "desc": "Passes location.href as a call argument" }, { "id": "micro-behaviors/communications/http/url/path::js-relative-route-fetch", "conf": 0.86, "crit": 3, "desc": "JavaScript fetches a relative application route" }, { "id": "micro-behaviors/hardware/display/screen::node-screenshots-monitor-all", "atk": "T1113", "mbc": "B0002", "conf": 0.9, "crit": 3, "desc": "node-screenshots monitor enumeration", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::navigator-device-memory-read", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Reads browser-reported device memory", "from": [ { "file": 62 } ] }, { "id": "objectives/credential-access/wallet/provider::ethereum-provider-or-request", "atk": "T1555.003", "conf": 0.75, "crit": 3, "desc": "Ethereum provider access or request", "from": [ { "off": 150369, "file": 109, "line": 28 } ], "uses": [ 78 ] }, { "id": "metadata/package/manifest/entrypoint::bin-field-declared", "conf": 0.95, "crit": 1, "desc": "Manifest declares a bin entry" }, { "id": "metadata/package/scripts/develop::pkg-start-script-field", "conf": 0.6, "crit": 3, "desc": "\"start\": script in package.json" }, { "id": "micro-behaviors/ui/window/manage/control::scroll-into-view-call", "conf": 0.9, "crit": 3, "desc": "Scrolls a DOM element into view", "from": [ { "file": 102 } ] }, { "id": "metadata/library/structure::js-image-data-url", "conf": 0.9, "crit": 2, "desc": "JavaScript image data URL literal", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.7, "crit": 3, "desc": "Invokes PowerShell with command-line options", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/http/download/write::script-fetches-and-writes-remote-content", "atk": "T1105", "conf": 0.94, "crit": 3, "desc": "JavaScript saves fetched remote content", "from": [ { "file": 168 } ], "uses": [ 99, 104, 272 ] }, { "id": "micro-behaviors/os/network/interface::internal-interface-filter", "atk": "T1016", "conf": 0.92, "crit": 1, "desc": "Filters internal network interfaces", "from": [ { "file": 69 } ] }, { "id": "metadata/package/testing/presence/harness::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" }, { "id": "metadata/package/dependencies/manifest::npm-phantom-runtime-dependency", "conf": 0.82, "crit": 3, "desc": "Declared runtime dependency lacks module import", "spans": [ [ 0, 39 ] ] }, { "id": "metadata/package/dependencies/manifest::npm-import-time-unused-runtime-dependency", "conf": 0.9, "crit": 3, "desc": "Package uses dynamic imports while a declared dependency appears unused", "from": [ { "file": 66 }, { "off": 104909, "file": 67, "line": 164 }, { "file": 74 }, { "file": 75 }, { "off": 33202, "file": 78, "line": 2 }, { "off": 15993, "file": 140, "line": 487 } ], "uses": [ 564, 745 ], "spans": [ [ 0, 39 ], [ 15993, 49 ], [ 15999, 43 ], [ 16006, 35 ], [ 33202, 39 ], [ 33206, 35 ], [ 33213, 27 ], [ 47346, 32 ] ] } ] } ] } }