{ "ml": { "v": "7", "id": 88936, "lvl": -1, "conf": 0, "prob": 0.0003003676829393953, "type": "zip", "version": "v18.18", "analyzed_at": "2026-09-12T09:26:55Z" }, "path": "getid3@v1.9.23", "raw": { "rev": "407ab", "files": [ { "id": 88936, "ctx": [ { "b": "p!H([3ig5a003aRq=-@000000000000012t2()OazdN=VwOD45x\u003e7*dxjVfRl]czGhE!W5i5ic!r0rm5XHYEDp!H([3ig5a2MN%Zq=\u0026EZy3(6I003!s001tC2()OazdN=VwOD45x\u003e7*dxjVfRl]czGhE!W5i5ic+ml%somj@B/rA6b40L6:owZbQHCItPI[bJq1EkFFD(4/sh:*QL{\u0026@", "ln": 0 }, { "b": "wPQHigC7psv(Dk7gb0oKBzknwfkUSrB.\u003eRwze163e[Gose]UGyrA6b40L6:owVY3Jz}^kW@V7}BzwZU]!\u0026EPPi$gJg*GQ[9/N0C00$D**l:(kYM[ohs*:0{p?:=u{", "ln": 468589 } ], "mol": "K(Li)O₅(Er₂LaAsDyI)H₁₀(Cm₁₇CrDb₁₄DsF₂₁Mg₂Os₁₇Po₁₇TiU)Md₆(HeBi₇Pa₂PtSi)", "pid": 10530, "rel": "fetched", "sha": "f73bbafc814cd30aae16ce044757d3afeb37fd7c8937a9b876563c3302273006", "via": "https://api.github.com/repos/JamesHeinrich/getID3/zipball/06c7482532ff2b3f9111b011d880ca6699c8542b", "path": "pkg:composer/james-heinrich/getid3@v1.9.23", "risk": 256, "size": 1558466, "type": "zip", "depth": 2, "facts": { "metrics": { "file": { "size": 1558466, "entropy": 8 }, "binary": { "peak_region_bytes": 1542144, "peak_region_entropy": 7.85 }, "archive": { "file_count": 118, "has_comment": 1, "comment_size": 40, "member_count": 123, "script_count": 99, "zip_bomb_ratio": 8.92, "compressed_size": 1533374, "directory_count": 5, "executable_count": 5, "extra_field_size": 1107, "noise_file_count": 0, "compression.ratio": 0.33, "hidden_file_count": 0, "uncompressed_size": 4641825, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 68, "rtlo_filename_count": 0, "format.regular_count": 118, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 5, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 5, "timing.mtime_dominant_count": 123, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 5, "compression.method_counts.deflate": 118 } } }, "traits": [ { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.66, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 104 } ] }, { "id": "objectives/evasion/process/injection/memory::packed-remote-memory-injector", "atk": "T1055,T1027", "mbc": "B0033", "conf": 0.98, "crit": 5, "desc": "Packed PE combines process-memory writing with remote thread execution", "from": [ { "off": 923862, "file": 89040 } ], "uses": [ 16, 224, 261, 342 ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::many-high-entropy-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.7, "crit": 1, "desc": "Many random-looking source identifier names", "from": [ { "file": 34 } ] }, { "id": "metadata/file/profile/language::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "from": [ { "file": 94 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-4", "conf": 0.8, "crit": 2, "desc": "English function-word token \"have\"", "from": [ { "file": 1 } ] }, { "id": "metadata/package/versioning::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product" }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/system/fingerprint/info::win32-deep-recon", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Deep Windows system reconnaissance", "from": [ { "off": 921950, "file": 89040 } ], "uses": [ 14, 96, 171, 314 ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/read::read-file", "conf": 0.9, "crit": 2, "desc": "Read data from file handle", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/mem/protect/modify::non-pagespeed-memory-protection", "conf": 0.9, "crit": 3, "desc": "Memory protection change outside PageSpeed", "from": [ { "file": 89040 }, { "file": 89042 } ], "uses": [ 87, 210 ] }, { "id": "metadata/file/profile/language::polish-common-word-ale", "conf": 1.0, "crit": 1, "desc": "Polish common word ale", "from": [ { "file": 92 } ] }, { "id": "objectives/anti-static/obfuscation/string/conceal::concat-bareword-fragments", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Concat bareword string fragments", "from": [ { "file": 64 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-volume-info", "conf": 0.9, "crit": 3, "desc": "Windows volume-information API name reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "Create registry key ANSI", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/spawn::open-process", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Open process handle", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysql-set-charset", "conf": 0.75, "crit": 3, "desc": "PHP MySQL UTF8 charset selection", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/security/auth/password::php-secret-literal-comparison", "conf": 0.94, "crit": 3, "desc": "PHP secret variable compared to literal", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/file/copy::copy-call", "conf": 0.9, "crit": 3, "desc": "Copies file via copy()", "from": [ { "file": 98 } ] }, { "id": "micro-behaviors/ui/window/probe::message-box-a", "conf": 0.9, "crit": 2, "desc": "MessageBoxA dialog API reference", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/data/decode/hex::chr-hexdec-call", "conf": 0.93, "crit": 3, "desc": "Converts hex values with PHP chr(hexdec())", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "conf": 0.74, "crit": 3, "desc": "Clears the clipboard to take ownership", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/info/thread::resume-thread", "conf": 0.9, "crit": 3, "desc": "Windows ResumeThread API name reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/move::move-file", "conf": 0.9, "crit": 2, "desc": "Move or rename file", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-close", "conf": 0.9, "crit": 2, "desc": "Close directory enumeration handle", "from": [ { "file": 104 } ] }, { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.9, "crit": 1, "desc": "File has 30 or more lines", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/sysinfo/config::set-system-time-api", "conf": 0.86, "crit": 3, "desc": "Windows API that sets system time", "from": [ { "file": 104 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "English function-word token \"with\"", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/resource::rich-header-present", "conf": 0.9, "crit": 2, "desc": "PE Rich header present (MSVC toolchain)" }, { "id": "metadata/signed/trust-level::unsigned", "conf": 1.0, "crit": 3, "desc": "Binary is not digitally signed", "from": [ { "file": 89040 }, { "file": 89041 }, { "file": 89042 }, { "file": 89044 }, { "file": 89045 } ], "uses": [ 205 ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/path/check::php-is-writable-call", "conf": 0.9, "crit": 3, "desc": "Checks path writability via PHP is_writable()", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/os/exception/error-handling::get-last-error", "conf": 0.7, "crit": 2, "desc": "Get system error code", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/read::file-content-read-operation", "conf": 0.82, "crit": 2, "desc": "File content read operation", "from": [ { "file": 15 } ], "uses": [ 9, 58, 115, 135, 184, 319, 330, 331 ] }, { "id": "micro-behaviors/data/string/split::strtok-import", "conf": 0.85, "crit": 3, "desc": "Native strtok delimiter parser import", "from": [ { "file": 108 } ] }, { "id": "metadata/package/versioning::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version" }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "conf": 0.6, "crit": 2, "desc": "Linux platform string", "from": [ { "file": 67 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::write-process-memory-binary", "atk": "T1055", "mbc": "C0032", "conf": 0.95, "crit": 2, "desc": "WriteProcessMemory API reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 34 } ] }, { "id": "micro-behaviors/communications/ip/resolve::dynamic-winsock-host-resolution", "conf": 0.95, "crit": 3, "desc": "Dynamically resolves Windows hostnames", "from": [ { "off": 883620, "file": 89040 }, { "off": 480632, "file": 89042 }, { "off": 217264, "file": 89045 } ], "uses": [ 53, 153, 183, 257, 332, 347 ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.7, "crit": 2, "desc": "Version information string", "from": [ { "file": 106 } ] }, { "id": "metadata/file/metrics::high-entropy-identifiers", "conf": 0.85, "crit": 2, "desc": "High entropy identifiers", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-first", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32First API name", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/traversal/drives::logical-drive-type-enumeration", "atk": "T1083", "conf": 0.92, "crit": 3, "desc": "Enumerates logical drives and queries drive types", "from": [ { "off": 921498, "file": 89040 } ], "uses": [ 154, 171 ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-take-ownership-privilege-name", "conf": 0.9, "crit": 3, "desc": "References SeTakeOwnershipPrivilege token", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/disk::freespace", "atk": "T1082", "conf": 0.5, "crit": 2, "desc": "Disk free space query", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/write/direct::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "from": [ { "file": 90 } ] }, { "id": "micro-behaviors/fs/file/copy::copyfile-a", "conf": 0.66, "crit": 3, "desc": "Copy files (Windows API ANSI)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/console::console-screen-buffer-info", "conf": 0.7, "crit": 2, "desc": "GetConsoleScreenBufferInfo API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write-file", "conf": 0.9, "crit": 2, "desc": "Write data to file handle", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.66, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/clipboard/access::win32-clipboard-access", "conf": 0.82, "crit": 3, "desc": "Win32 clipboard access", "from": [ { "off": 882468, "file": 89040 } ], "uses": [ 22, 260, 272, 324 ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-a", "atk": "T1574.002", "conf": 0.95, "crit": 3, "desc": "Dynamic library loading via LoadLibraryA", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/config::db-key-host", "conf": 0.85, "crit": 1, "desc": "Connection host key", "from": [ { "file": 12 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.8, "crit": 2, "desc": "English function-word token \"this\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/compress/library::gzuncompress-call", "conf": 0.9, "crit": 3, "desc": "PHP zlib uncompress call", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-aton-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_aton", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.62, "crit": 2, "desc": "References the CRT fread file-read routine", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/stat::get-file-size", "conf": 0.65, "crit": 2, "desc": "Get file size", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/encode/url::urlencode-call", "conf": 0.85, "crit": 3, "desc": "URL-encodes data via PHP urlencode", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/device/storage::windows-physicaldrive-path", "atk": "T1561", "mbc": "E1561", "conf": 0.94, "crit": 3, "desc": "Windows raw PhysicalDrive device path", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/section/metrics::multiple-nonstandard-section-names", "conf": 0.9, "crit": 3, "desc": "Multiple nonstandard PE section names", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "conf": 0.92, "crit": 2, "desc": "Dynamically resolve own modules and exports", "from": [ { "file": 89040 }, { "file": 89042 }, { "file": 89044 }, { "off": 217124, "file": 89045 } ], "uses": [ 167, 286, 318 ] }, { "id": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "atk": "T1005", "conf": 0.9, "crit": 2, "desc": "GetThreadContext import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "from": [ { "off": 447408, "file": 89042 }, { "off": 214312, "file": 89045 } ], "uses": [ 71, 266, 309 ] }, { "id": "metadata/lang/compiler/native::mingw-runtime-marker", "conf": 0.85, "crit": 3, "desc": "libgcc / libstdc++ runtime marker", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/resources/limits::set-time-limit", "conf": 0.7, "crit": 3, "desc": "Sets the PHP script execution time limit", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name", "conf": 0.9, "crit": 3, "desc": "References high-risk Windows token privilege", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/url/media::compressed-audio-file-url", "conf": 0.9, "crit": 3, "desc": "HTTP URL targets compressed audio file", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::get-thread-context-text", "atk": "T1005", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "GetThreadContext dynamic API string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/help::options-title", "conf": 0.5, "crit": 2, "desc": "Options: label", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/data/compress/library::gzinflate-call", "conf": 0.9, "crit": 3, "desc": "PHP zlib inflate call", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/process/info/thread::get-current-thread-id", "conf": 0.9, "crit": 2, "desc": "Get current thread ID", "from": [ { "file": 104 } ] }, { "id": "metadata/file/metrics::script-many-shell-command-strings-100", "conf": 0.88, "crit": 3, "desc": "Script has 100+ shell-command-like strings", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "atk": "T1083", "conf": 1.0, "crit": 2, "desc": "Enumerates directories with PHP functions", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::php-base64-decode-call", "mbc": "C0053", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_decode()", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/socket/options::sockopt-constant-names", "conf": 0.9, "crit": 2, "desc": "Many SO_ socket option constant names", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/format/media/raster::declared-image-mime-type", "conf": 0.82, "crit": 3, "desc": "Declares an image MIME type", "from": [ { "file": 75 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::host-identity-query", "conf": 0.86, "crit": 3, "desc": "Queries a host identity value", "from": [ { "file": 89040 } ], "uses": [ 234 ] }, { "id": "metadata/file/encoded::php-high-entropy-region", "conf": 0.95, "crit": 2, "desc": "PHP contains a high-entropy content region", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "SHA1 hash computation", "from": [ { "file": 89 } ] }, { "id": "micro-behaviors/os/random/crypto::rand-symbol", "conf": 0.3, "crit": 2, "desc": "Random number generation (rand)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-handler-registration-api", "conf": 0.9, "crit": 3, "desc": "Registers PHP error or session handler", "from": [ { "file": 78 } ] }, { "id": "metadata/binary/metrics/anomaly::high-export-count-marker", "conf": 1.0, "crit": 1, "desc": "High export count metric", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/window/probe::get-active-window", "conf": 0.9, "crit": 2, "desc": "GetActiveWindow API reference", "from": [ { "file": 109 } ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect", "mbc": "C0021", "conf": 0.95, "crit": 3, "desc": "Modify memory page protection", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/handle::set-std-handle", "conf": 0.9, "crit": 2, "desc": "Set standard I/O handle", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/serialize/object::unserialize", "atk": "T1059", "mbc": "E1059", "conf": 0.65, "crit": 3, "desc": "PHP object deserialization call", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-addr-symbol", "conf": 0.66, "crit": 3, "desc": "Parse IP with inet_addr", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::write-process-memory-text", "atk": "T1055", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "WriteProcessMemory API string reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "atk": "T1082", "conf": 0.9, "crit": 2, "desc": "Query Windows version info", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-string", "conf": 0.9, "crit": 3, "desc": "IsDebuggerPresent API name in PE strings", "from": [ { "file": 104 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "English function-word token \"that\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/params::request-dup", "conf": 0.85, "crit": 3, "desc": "Reads combined PHP request data via $_REQUEST", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::get-memory-status-legacy", "atk": "T1082", "conf": 0.9, "crit": 2, "desc": "Legacy system memory query", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-logical-drive-strings", "atk": "T1083", "mbc": "E1083", "conf": 0.9, "crit": 3, "desc": "GetLogicalDriveStrings API reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/security/runtime-restrictions::reads-multiple-php-restrictions", "conf": 0.8, "crit": 3, "desc": "Reads multiple PHP runtime restriction settings", "from": [ { "off": 1998, "file": 88961, "line": 42 }, { "off": 5417, "file": 89005, "line": 121 }, { "off": 1361, "file": 89036, "line": 54 }, { "off": 1406, "file": 89039, "line": 53 } ], "uses": [ 105, 196 ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-serializer-call", "conf": 0.9, "crit": 3, "desc": "Calls a URL query serializer", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-symbol-lifecycle", "conf": 0.92, "crit": 3, "desc": "Winsock client symbol lifecycle", "from": [ { "off": 291664, "file": 89040 } ], "uses": [ 177, 243, 276, 277, 344 ] }, { "id": "micro-behaviors/mem/create/shared::nt-map-view-section-api-string", "conf": 0.9, "crit": 3, "desc": "References NtMapViewOfSection native API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/copy::php-upload-temp-file-access", "conf": 0.9, "crit": 3, "desc": "PHP accesses uploaded temporary file path", "from": [ { "file": 15 } ] }, { "id": "metadata/build/reproducible::zero-header-timestamp", "conf": 0.9, "crit": 1, "desc": "PE header timestamp is zero", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/os/security/runtime-restrictions::reads-php-safe-mode", "conf": 0.9, "crit": 3, "desc": "Reads PHP safe_mode setting", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-memory-allocation-protection-api-pair", "conf": 0.9, "crit": 3, "desc": "Imports virtual-memory allocation and protection APIs", "from": [ { "file": 89040 }, { "file": 89042 }, { "off": 217212, "file": 89045 } ], "uses": [ 87, 270 ] }, { "id": "micro-behaviors/data/db/mysql::php-mysqli-select-db", "conf": 0.85, "crit": 3, "desc": "Selects MySQL database with mysqli_select_db()", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/fs/file/stat::fileperms-call", "conf": 0.9, "crit": 3, "desc": "Reads file permission mode", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/fs/file/binary::seek-and-descriptor-io", "conf": 0.8, "crit": 3, "desc": "Reads or writes a seeked file descriptor", "from": [ { "off": 736353, "file": 89040 }, { "file": 89041 }, { "file": 89042 }, { "file": 89044 } ], "uses": [ 161, 187, 331 ] }, { "id": "micro-behaviors/data/string/conversion::chr-call", "mbc": "C0000", "conf": 0.65, "crit": 3, "desc": "Converts a character code with PHP chr()", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/socket/init::sendto-api", "conf": 0.88, "crit": 3, "desc": "Winsock UDP send import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "conf": 1.0, "crit": 1, "desc": "Call to GetDriveTypeA by raw bytes", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/registry/keys::system-services-registry-path", "conf": 0.9, "crit": 3, "desc": "Windows system services registry path", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/help::options-title-string", "conf": 0.5, "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/fs/read/file::file-get-contents", "mbc": "C0051", "conf": 0.75, "crit": 2, "desc": "File read via file_get_contents", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/fs/file/rename::any-rename", "conf": 0.9, "crit": 3, "desc": "Rename or move file on Windows", "from": [ { "file": 89040 }, { "file": 89045 } ], "uses": [ 24, 297 ] }, { "id": "objectives/impact/dos/attack/flood::flood-packet-count-prompt", "atk": "T1498", "mbc": "B0033", "conf": 0.85, "crit": 3, "desc": "Prompts for a packet count to send", "from": [ { "file": 34 } ] }, { "id": "micro-behaviors/os/syscall/raw::nt-query-info-ssn", "atk": "T1106", "mbc": "F0004", "conf": 0.85, "crit": 3, "desc": "NtQueryInformationProcess API reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "off": 446490, "file": 89042 }, { "off": 214312, "file": 89045 } ], "uses": [ 71, 114, 255, 266 ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.66, "crit": 2, "desc": "References POSIX write API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/sql::sql-drop-object", "conf": 0.8, "crit": 3, "desc": "DROP SQL object syntax reference", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/terminate/kill::exit-process", "conf": 0.9, "crit": 2, "desc": "Exit current process", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/stat::clearstatcache-call", "conf": 0.9, "crit": 3, "desc": "Clears cached file metadata", "from": [ { "file": 100 } ] }, { "id": "objectives/evasion/process/injection/cluster::memory-injection-pattern", "atk": "T1055", "mbc": "B0033", "conf": 0.85, "crit": 3, "desc": "Memory protection and injection API cluster", "from": [ { "off": 0, "file": 89040 }, { "file": 89042 } ], "uses": [ 1, 10 ] }, { "id": "micro-behaviors/fs/directory/readdir::php-opendir", "conf": 1.0, "crit": 3, "desc": "Opens directory with PHP opendir", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/init::winsock-datagram-transfer", "conf": 0.88, "crit": 3, "desc": "Winsock datagram transfer APIs", "from": [ { "off": 289008, "file": 89040 } ], "uses": [ 111, 202, 344 ] }, { "id": "micro-behaviors/process/sync/mutex::open-mutex", "mbc": "C0042", "conf": 0.85, "crit": 3, "desc": "OpenMutex API call", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-next", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32Next API name", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/section/names::writable-rdata", "conf": 0.72, "crit": 3, "desc": "Writable .rdata section permissions", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/callback/dispatch::php-array-callback-sort-api", "conf": 0.9, "crit": 3, "desc": "Sorts PHP arrays using a comparison callback", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "conf": 0.7, "crit": 2, "desc": "Read startup info via GetStartupInfoA", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/privilege/token::backup-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Backup privilege name string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-import", "conf": 0.9, "crit": 3, "desc": "References the IsDebuggerPresent API", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/fs/read/file::fopen-dup", "conf": 0.6, "crit": 2, "desc": "File open operation", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "conf": 0.9, "crit": 2, "desc": "Get Windows installation directory", "from": [ { "file": 104 } ] }, { "id": "well-known/lib/runtime/cygwin::cygwin-runtime-basename", "conf": 0.99, "crit": 3, "desc": "Cygwin POSIX runtime DLL basename", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::set-thread-context-text", "atk": "T1055", "mbc": "C0032", "conf": 0.9, "crit": 3, "desc": "SetThreadContext dynamic API string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator" }, { "id": "micro-behaviors/fs/traversal/drives::set-current-directory", "conf": 0.9, "crit": 3, "desc": "Switch current working directory", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysqli-connect", "conf": 0.9, "crit": 3, "desc": "Opens MySQL with PHP mysqli_connect()", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "conf": 0.8, "crit": 1, "desc": "Inline PE header walk sequence", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/os/privilege/token::restore-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Restore privilege name string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysqli-admin-surface", "conf": 0.93, "crit": 3, "desc": "PHP MySQLi administration surface", "from": [ { "off": 6853, "file": 88948, "line": 171 } ], "uses": [ 17, 107, 142, 280 ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-file-walker", "conf": 0.92, "crit": 3, "desc": "Directory walker using Win32 find APIs", "from": [ { "off": 920722, "file": 89040 } ], "uses": [ 25, 176, 357 ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/sql::sql-truncate-object", "conf": 0.8, "crit": 3, "desc": "TRUNCATE SQL object syntax reference", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Encoded URL documentation context", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/embedded/payload/header::x86-inline-e-lfanew-pe-walk", "atk": "T1620", "mbc": "B0005", "conf": 0.97, "crit": 3, "desc": "x86 e_lfanew to PE signature walk", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "conf": 0.7, "crit": 2, "desc": "Windows gethostbyname API string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/traversal/drives::logical-drive-enumeration", "atk": "T1083", "conf": 0.89, "crit": 3, "desc": "Enumerate logical drives", "from": [ { "file": 89040 } ], "uses": [ 97, 335 ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 20 } ] }, { "id": "metadata/binary/resource::small-pe-no-resources", "conf": 0.82, "crit": 3, "desc": "Small PE lacks resource section" }, { "id": "micro-behaviors/fs/file/timestamp::php-touch-call", "atk": "T1070.006", "conf": 0.9, "crit": 3, "desc": "PHP touch() sets file timestamps", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/process/io/buffer::ob-get-contents", "conf": 0.6, "crit": 2, "desc": "Gets output buffer contents", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/section/metrics::pe-multiple-executable-writable-sections", "conf": 0.95, "crit": 3, "desc": "Two or more executable writable sections", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/thread/priority::set-priority-class", "conf": 0.85, "crit": 3, "desc": "Raise process priority class", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/binary::file-position-api", "conf": 0.78, "crit": 3, "desc": "References a file-position API", "from": [ { "off": 911822, "file": 89040 }, { "file": 89044 } ], "uses": [ 220, 293, 299 ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/lock/flock::flock-exclusive-blocking", "conf": 0.82, "crit": 3, "desc": "Blocking exclusive file lock", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/fs/enumerate/volume::get-disk-free-space", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "GetDiskFreeSpace API import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-traversal-text", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Process32 snapshot traversal API text", "from": [ { "file": 104 } ] }, { "id": "metadata/file/profile/language::lang-indonesian--atom-2", "conf": 0.8, "crit": 1, "desc": "Indonesian function-word token \"dan\"", "from": [ { "file": 92 } ] }, { "id": "micro-behaviors/os/module/load::get-proc-address-import", "conf": 0.9, "crit": 2, "desc": "Resolve exports with GetProcAddress", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/os/env/access::get-environment-strings-wide", "conf": 0.84, "crit": 2, "desc": "Read wide environment block", "from": [ { "file": 109 } ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/message::find-atom-a", "conf": 0.9, "crit": 3, "desc": "Find an ANSI Windows atom", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-drive-type", "atk": "T1083", "conf": 0.9, "crit": 2, "desc": "Query drive type by symbol", "from": [ { "file": 104 } ] }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/stdio::php-echo-statement", "conf": 0.95, "crit": 3, "desc": "Emits data with a PHP echo statement" }, { "id": "micro-behaviors/communications/http/request/params::request-param-assignment", "conf": 0.8, "crit": 3, "desc": "PHP request data assigned to variable", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "atk": "T1082", "conf": 0.85, "crit": 2, "desc": "Query user locale identifier", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "conf": 0.9, "crit": 2, "desc": "Begin directory enumeration ANSI", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/init::recv-api", "conf": 0.9, "crit": 3, "desc": "Winsock receive import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/env/access::php-server-superglobal", "conf": 0.85, "crit": 3, "desc": "Reads PHP $_SERVER execution environment data", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/msdos/internal::check-command-com", "conf": 0.8, "crit": 3, "desc": "Check for COMMAND.COM execution (COMM)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "from": [ { "file": 89040 } ], "uses": [ 269 ] }, { "id": "micro-behaviors/process/thread/create::create-thread", "atk": "T1129", "conf": 0.95, "crit": 2, "desc": "Create thread in current process", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtualprotect-rwx-stack-arg-x86", "atk": "T1620", "conf": 0.9, "crit": 3, "desc": "VirtualProtect RWX stack argument", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "conf": 0.76, "crit": 1, "desc": "Winsock startup API string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/read/file::fread", "mbc": "C0051", "conf": 0.75, "crit": 2, "desc": "File read via fread", "from": [ { "file": 25 } ] }, { "id": "metadata/file/profile/identity::static-html-shell", "conf": 0.95, "crit": 1, "desc": "Static HTML document shell", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/string/conversion::ord-call", "mbc": "C0000", "conf": 0.65, "crit": 3, "desc": "PHP ord() character-to-code conversion", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.66, "crit": 2, "desc": "CRT or POSIX file-write capability", "from": [ { "off": 737745, "file": 89040 }, { "file": 89041 }, { "file": 89042 }, { "file": 89044 } ], "uses": [ 120, 275 ] }, { "id": "micro-behaviors/data/format/html::html-document-string-literal", "conf": 0.6, "crit": 3, "desc": "Contains an HTML document string literal", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/embedded/payload/section::large-data-section", "conf": 0.75, "crit": 3, "desc": "Large .data section in PE binary", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/os/env/access::php-server-script-name", "conf": 0.85, "crit": 3, "desc": "Reads PHP request script path", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/info/thread::thread-context-api-reference-get", "atk": "T1055.003", "conf": 0.94, "crit": 3, "desc": "GetThreadContext API name reference", "from": [ { "file": 104 } ] }, { "id": "objectives/lateral-movement/usb-worm/autorun::native-drive-enumeration-file-copy", "atk": "T1091", "conf": 0.96, "crit": 4, "desc": "Native drive enumeration with file-copy capability", "from": [ { "file": 89040 } ], "uses": [ 48, 337 ] }, { "id": "micro-behaviors/time/query::get-system-time-as-filetime", "conf": 0.9, "crit": 2, "desc": "Get system time as FILETIME", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-ansi", "conf": 0.7, "crit": 2, "desc": "Get module file path (ANSI)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "conf": 0.9, "crit": 3, "desc": "Set thread CPU affinity", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/security/runtime-restrictions::reads-php-open-basedir", "conf": 0.9, "crit": 3, "desc": "Reads PHP open_basedir setting", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/fs/file/rename::rename-call", "conf": 0.6, "crit": 3, "desc": "Renames/moves file via rename()", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-current-directory", "conf": 0.85, "crit": 2, "desc": "Read current working directory", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-a", "conf": 0.85, "crit": 3, "desc": "Open named file mapping", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/directories::get-system-directory", "conf": 0.9, "crit": 2, "desc": "Get Windows system directory path", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/resource::minimal-resources", "conf": 0.8, "crit": 2, "desc": "Tiny resource section (no version/icon)", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/communications/socket/init::recvfrom-api", "conf": 0.88, "crit": 3, "desc": "Winsock UDP receive import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "B0033", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "from": [ { "file": 104 } ] }, { "id": "well-known/lib/runtime/cygwin::cygwin-runtime-product", "conf": 0.99, "crit": 3, "desc": "Cygwin product version identity" }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 2, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.9, "crit": 2, "desc": "Windows file creation/open API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 1, "desc": "Encoded URL public documentation", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/format/media/raster::png-iend-chunk-literal", "conf": 0.86, "crit": 1, "desc": "References PNG image-end chunk marker", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-protect-ex", "conf": 0.95, "crit": 3, "desc": "Modify memory protection with VirtualProtectEx", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/directories::windows-directory-api-strings", "conf": 0.84, "crit": 1, "desc": "Windows directory API strings", "from": [ { "off": 921726, "file": 89040 } ], "uses": [ 136, 231 ] }, { "id": "micro-behaviors/os/random/crypto::srand-symbol", "conf": 0.4, "crit": 2, "desc": "Random seed initialization (srand)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/config::db-key-database", "conf": 0.85, "crit": 1, "desc": "Connection database key", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process-name-text", "mbc": "B0033", "conf": 0.92, "crit": 3, "desc": "TerminateProcess API name in binary strings", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer", "conf": 0.9, "crit": 2, "desc": "Set file position", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/env/vars/access::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/timestamp::set-file-time", "atk": "T1070.006", "conf": 0.85, "crit": 3, "desc": "Modify file creation/access/write times", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/serialize/object::serialize-symbol", "conf": 0.7, "crit": 3, "desc": "References PHP serialize() or a serialize method", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/env/vars/user-paths::userprofile-var", "conf": 0.5, "crit": 3, "desc": "USERPROFILE path environment variable", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "conf": 0.4, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/encode/base64::php-base64-encode", "conf": 0.9, "crit": 3, "desc": "Calls PHP base64_encode()", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::exe-dup", "conf": 0.5, "crit": 1, "desc": "References a Windows .exe filename or extension", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/fs/file/write/direct::php-fwrite", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP fwrite()", "from": [ { "file": 9 } ] }, { "id": "metadata/hardening/memory::extreme-wx-section-count-10", "conf": 0.97, "crit": 4, "desc": "Ten or more writable executable sections", "from": [ { "file": 104 } ] }, { "id": "metadata/lang/compiler/native::mingw-pseudo-reloc-error-message", "conf": 0.9, "crit": 3, "desc": "MinGW pseudo-relocation error diagnostic", "from": [ { "file": 106 } ] }, { "id": "metadata/hardening/memory::three-plus-wx-sections", "conf": 0.95, "crit": 3, "desc": "Three or more writable executable sections", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/metrics/threshold::many-exports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ exports", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/info/thread::thread-context-api-reference-set", "atk": "T1055.003", "conf": 0.94, "crit": 3, "desc": "SetThreadContext API name reference", "from": [ { "file": 104 } ] }, { "id": "metadata/package/documentation/source-documentation::readme-markdown-basename", "conf": 0.99, "crit": 1, "desc": "README Markdown basename", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::polish-common-word-tak", "conf": 1.0, "crit": 1, "desc": "Polish common word tak", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "conf": 0.82, "crit": 2, "desc": "GetSystemDirectory API string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-microsoft-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 1, "desc": "Encoded URL references Microsoft documentation", "from": [ { "file": 34 } ] }, { "id": "micro-behaviors/process/io/buffer::ob-start", "conf": 0.7, "crit": 2, "desc": "Starts output buffering", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Query computer/host name", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/options::setsockopt-windows", "atk": "T1040", "conf": 0.92, "crit": 3, "desc": "Configures Windows socket options", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/fs/file/open::createfile-api", "conf": 0.9, "crit": 1, "desc": "CreateFile API string reference", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/ui/window/probe::get-last-active-popup", "conf": 0.9, "crit": 2, "desc": "GetLastActivePopup API reference", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/fs/file/open::open", "conf": 0.66, "crit": 2, "desc": "Open files", "from": [ { "off": 735217, "file": 89040 }, { "file": 89041 }, { "file": 89042 }, { "file": 89044 } ], "uses": [ 288, 349 ] }, { "id": "micro-behaviors/process/thread/priority::set-thread-priority", "conf": 0.85, "crit": 3, "desc": "SetThreadPriority API symbol", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/handle::kernel-device-handle", "conf": 0.9, "crit": 3, "desc": "Opens a Windows kernel device handle", "from": [ { "file": 104 } ] }, { "id": "objectives/discovery/system/fingerprint/info::win32-system-profiling", "atk": "T1082", "conf": 0.85, "crit": 3, "desc": "Win32 host profiling via multiple APIs", "from": [ { "off": 921726, "file": 89040 }, { "file": 89042 }, { "off": 261986, "file": 89045 } ], "uses": [ 14, 27, 46, 49, 79, 92, 96, 131, 136, 200, 211, 231, 234, 314 ] }, { "id": "micro-behaviors/communications/socket/init::connect-api", "conf": 0.9, "crit": 3, "desc": "Winsock outbound connect import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "from": [ { "file": 95 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "conf": 0.8, "crit": 2, "desc": "Duplicate object handle", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/disk/raw::windows-physicaldrive-write-profile", "conf": 0.9, "crit": 3, "desc": "Opens and writes a Windows physical drive", "from": [ { "off": 151382, "file": 89040 }, { "file": 89042 }, { "off": 217408, "file": 89045 } ], "uses": [ 50, 61, 206 ] }, { "id": "micro-behaviors/communications/socket/init::bind-api", "conf": 0.9, "crit": 3, "desc": "Winsock bind import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/serialize/json-read::php-json-decode", "conf": 0.9, "crit": 3, "desc": "PHP JSON deserialization", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/format/media/raster::png-chunk-parser", "conf": 0.9, "crit": 3, "desc": "Source parses PNG image-data and image-end chunks", "from": [ { "off": 24150, "file": 89016, "line": 457 } ], "uses": [ 209, 268 ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.66, "crit": 3, "desc": "Converts host to network long", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/init::getpeername-api", "conf": 0.85, "crit": 3, "desc": "Query connected peer endpoint", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/sync/mutex::mutex-api", "mbc": "C0042", "conf": 0.85, "crit": 2, "desc": "Mutex creation/access API", "from": [ { "file": 89040 } ], "uses": [ 127, 304 ] }, { "id": "micro-behaviors/data/db/mysql::mysql-alter-table-sql", "conf": 0.8, "crit": 3, "desc": "ALTER TABLE schema modifications", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "conf": 0.5, "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/info/thread::suspend-thread-import", "atk": "T1055.003", "conf": 0.9, "crit": 3, "desc": "Suspend a Windows thread via imported API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/module/load::get-proc-address-reference", "conf": 0.88, "crit": 2, "desc": "GetProcAddress API reference", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/temp/directory::tempnam-call", "mbc": "E1083", "conf": 0.8, "crit": 3, "desc": "PHP tempnam() call", "from": [ { "file": 11 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/clipboard/access::set-clipboard-data-text", "conf": 0.78, "crit": 3, "desc": "Places data onto the Windows clipboard", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/inject/runtime/call::write-process-memory-dup", "atk": "T1055", "mbc": "C0032", "conf": 0.95, "crit": 3, "desc": "WriteProcessMemory API reference", "from": [ { "file": 89040 } ], "uses": [ 38, 91 ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::pipe-path-prefix", "atk": "T1559", "conf": 0.8, "crit": 3, "desc": "Named pipe path prefix", "from": [ { "file": 104 } ] }, { "id": "metadata/library/data::psl-github-io", "conf": 0.9, "crit": 1, "desc": "Public suffix github.io", "from": [ { "file": 94 } ] }, { "id": "micro-behaviors/time/query::get-timezone-information", "conf": 0.9, "crit": 3, "desc": "Query timezone configuration", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 95 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "conf": 0.5, "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 106 } ] }, { "id": "objectives/discovery/system/locale::windows-locale-fingerprint", "atk": "T1082", "mbc": "E1082", "conf": 0.9, "crit": 2, "desc": "Imports APIs that query multiple Windows locale settings", "from": [ { "off": 217284, "file": 89045 } ], "uses": [ 175, 354, 369 ] }, { "id": "micro-behaviors/data/format/media/raster::png-idat-chunk-literal", "conf": 0.86, "crit": 1, "desc": "References PNG image-data chunk marker", "from": [ { "file": 80 } ] }, { "id": "micro-behaviors/process/create/spawn::create-process-a", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Create process (ANSI)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/mem/protect/modify::virtual-alloc", "atk": "T1587.001", "conf": 0.9, "crit": 2, "desc": "Allocate virtual memory", "from": [ { "file": 104 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/clipboard/access::get-clipboard-data-text", "conf": 0.76, "crit": 3, "desc": "Reads current Windows clipboard contents", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/control/signal::ignore-user-abort", "conf": 0.85, "crit": 3, "desc": "Keeps PHP running after client disconnect", "from": [ { "file": 25 } ] }, { "id": "metadata/package/versioning::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.66, "crit": 2, "desc": "References fwrite file-write API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/init::send-api", "conf": 0.9, "crit": 3, "desc": "Winsock send import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/socket/init::shutdown-api", "conf": 0.85, "crit": 3, "desc": "Winsock shutdown import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/mem/create/shared::nt-open-section-api-string", "conf": 0.9, "crit": 3, "desc": "References NtOpenSection native API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::php-escapeshellarg", "atk": "T1059.006", "conf": 0.85, "crit": 3, "desc": "PHP shell argument escaping call", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysqli-query", "conf": 0.9, "crit": 3, "desc": "Executes a MySQL query through PHP MySQLi", "from": [ { "file": 12 } ] }, { "id": "metadata/binary/layout::pe-tls-callback-table", "conf": 0.9, "crit": 3, "desc": "PE TLS callback table present", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/create/direct::native-process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "References a native child-process launch call", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/post::enctype-attr", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "HTML form encoding attribute", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::create-pipe", "atk": "T1559", "conf": 0.9, "crit": 2, "desc": "Create anonymous pipe", "from": [ { "file": 104 } ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain-ansi", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 1, "desc": "ANSI module-path and file-I/O import chain", "from": [ { "file": 89040 }, { "file": 89042 }, { "off": 217408, "file": 89045 } ], "uses": [ 9, 59, 194, 206, 215 ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.7, "crit": 3, "desc": "Get module handle ANSI", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "conf": 1.0, "crit": 3, "desc": "Uses named pipe IPC APIs", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.66, "crit": 3, "desc": "References C fopen file-open API", "from": [ { "file": 104 } ] }, { "id": "metadata/lang/compiler/native::mingw-pseudo-reloc-protocol-message", "conf": 0.95, "crit": 3, "desc": "MinGW pseudo-relocation protocol diagnostic", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/process/debug/event::output-debug-string", "conf": 0.82, "crit": 3, "desc": "References the Windows debugger output API", "from": [ { "file": 104 } ] }, { "id": "metadata/lang/compiler/native::mingw-built-pe", "conf": 0.92, "crit": 3, "desc": "PE binary built with MinGW/GCC", "from": [ { "file": 89042 } ], "uses": [ 66 ] }, { "id": "micro-behaviors/communications/socket/init::winsock-server-symbol-lifecycle", "conf": 0.9, "crit": 3, "desc": "Winsock server socket lifecycle", "from": [ { "off": 297168, "file": 89040 } ], "uses": [ 177, 247, 276, 303, 311, 344 ] }, { "id": "micro-behaviors/fs/file/binary::ftell-import", "conf": 0.7, "crit": 2, "desc": "References the CRT ftell position routine", "from": [ { "file": 108 } ] }, { "id": "objectives/impact/infect/script::php-overwrite-file-mode", "conf": 0.82, "crit": 1, "desc": "fopen() with w/x/c overwrite mode", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/socket/listen::winsock-listener-imports", "atk": "T1071", "mbc": "C0001", "conf": 0.92, "crit": 3, "desc": "Winsock server listener imports", "from": [ { "off": 297168, "file": 89040 } ], "uses": [ 247, 303, 311, 328 ] }, { "id": "metadata/binary/anomaly/signing::small-high-entropy-data-section", "conf": 0.9, "crit": 3, "desc": "Small high-entropy writable .data section", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.9, "crit": 2, "desc": "Move or rename file with options", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/shell/lang::shell-stderr-redirect", "atk": "T1059.004", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Shell stderr redirected to stdout", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "conf": 0.5, "crit": 2, "desc": "References the CRT fseek file-position routine", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/message::get-atom-name-a", "conf": 0.9, "crit": 3, "desc": "Read an ANSI Windows atom name", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/os/privilege/token::windows-user-sid-reference", "conf": 0.9, "crit": 3, "desc": "References the Windows user account SID", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/delete::delete-win", "conf": 0.66, "crit": 3, "desc": "Delete files (Windows API)", "from": [ { "file": 89040 }, { "file": 89045 } ], "uses": [ 322 ] }, { "id": "micro-behaviors/communications/socket/init::accept-api", "conf": 0.9, "crit": 3, "desc": "Winsock accept import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/sync/mutex::create-mutex", "mbc": "C0042", "conf": 0.9, "crit": 3, "desc": "CreateMutex API call", "from": [ { "file": 104 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 104 } ] }, { "id": "metadata/file/string/identity::chunk-token", "conf": 0.95, "crit": 1, "desc": "Bundler chunk identifier", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/data/string/split::php-str-split-call", "conf": 0.9, "crit": 3, "desc": "PHP str_split string operation", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/help::help-long-flag", "conf": 0.6, "crit": 2, "desc": "--help flag", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/fs/file/timestamp::php-filemtime-call", "conf": 0.9, "crit": 3, "desc": "Reads file modification time", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/socket/init::listen-api", "conf": 0.9, "crit": 3, "desc": "Winsock listen import", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.8, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/control/signal::ignore-user-abort-true-call", "conf": 0.9, "crit": 3, "desc": "Enables ignore_user_abort(true) background run", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/os/sysinfo/hardware::get-system-info", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Calls Windows GetSystemInfo API", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/security/auth/verify::lsa-logon-user", "atk": "T1056.004", "conf": 0.9, "crit": 3, "desc": "LSA interactive logon entry point", "from": [ { "file": 104 } ] }, { "id": "metadata/package/error-handling::catch-keyword", "conf": 0.5, "crit": 2, "desc": "Contains a catch error handler", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/request/params::files", "atk": "T1105", "conf": 0.85, "crit": 3, "desc": "Reads PHP file-upload data via $_FILES", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.78, "crit": 3, "desc": "Get module handle Unicode", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.7, "crit": 2, "desc": "Formatted input from file", "from": [ { "file": 104 } ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.9, "crit": 2, "desc": "Get tick count", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/delete::deletefile-a", "conf": 0.66, "crit": 3, "desc": "Delete files (Windows API ANSI)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/info/timing::get-process-times", "conf": 0.85, "crit": 3, "desc": "GetProcessTimes process timing query", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/clipboard/access::open-clipboard-text", "conf": 0.74, "crit": 1, "desc": "OpenClipboard string reference", "from": [ { "file": 104 } ] }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "atk": "T1070.006", "conf": 0.78, "crit": 1, "desc": "PE header timestamp predates 2000", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/communications/http/post::multipart-form", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 1, "desc": "multipart/form-data content type", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysql-select-db", "conf": 0.8, "crit": 3, "desc": "PHP mysql_select_db database selection", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/socket/init::select-api", "conf": 0.88, "crit": 3, "desc": "Winsock select import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/pipe::peek-named-pipe", "atk": "T1559", "conf": 0.9, "crit": 3, "desc": "Peek at pipe data without reading", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.7, "crit": 2, "desc": "Read stream (fread)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-ws2-32-string", "conf": 0.76, "crit": 1, "desc": "Winsock library name string", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/mysql::php-mysql-query", "conf": 0.85, "crit": 3, "desc": "PHP mysql query execution APIs", "from": [ { "file": 21 } ] }, { "id": "micro-behaviors/communications/http/request/params::post-dup", "conf": 0.85, "crit": 3, "desc": "Reads PHP form parameters via $_POST", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "atk": "T1083", "mbc": "E1083", "conf": 0.75, "crit": 3, "desc": "References GetLogicalDrives API name", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-http-url", "conf": 0.9, "crit": 1, "desc": "Text contains raw external-IP HTTP URL", "from": [ { "file": 2 } ] }, { "id": "objectives/lateral-movement/usb-worm/autorun::compiled-drive-enumeration-api-strings", "atk": "T1091", "conf": 0.96, "crit": 1, "desc": "Compiled logical-drive enumeration API set", "from": [ { "file": 89040 } ], "uses": [ 97, 112 ] }, { "id": "micro-behaviors/fs/path/construct::realpath-call", "conf": 0.9, "crit": 3, "desc": "Resolves canonical filesystem path", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/delete/file::php-unlink", "conf": 1.0, "crit": 3, "desc": "Calls PHP unlink()", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url", "conf": 0.95, "crit": 3, "desc": "Contains an external-IP HTTP URL", "from": [ { "file": 88938 } ], "uses": [ 336 ] }, { "id": "micro-behaviors/process/info/commandline::get-command-line", "conf": 0.82, "crit": 2, "desc": "Query current process command line", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/info/thread::resume-thread-dup", "conf": 0.9, "crit": 3, "desc": "ResumeThread API import", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/layout::pe-multiple-tls-callbacks", "conf": 0.9, "crit": 3, "desc": "PE has multiple TLS callbacks", "from": [ { "file": 106 } ] }, { "id": "micro-behaviors/communications/socket/init::socket-api", "conf": 0.9, "crit": 3, "desc": "Winsock socket creation import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/message::add-atom-a", "conf": 0.9, "crit": 3, "desc": "Add an ANSI Windows atom", "from": [ { "file": 108 } ] }, { "id": "micro-behaviors/fs/traversal/drives::drive-context-switching", "atk": "T1083", "conf": 0.86, "crit": 3, "desc": "Drive context switching via cwd APIs", "from": [ { "file": 89040 } ], "uses": [ 141, 171, 198 ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostname-string", "conf": 0.7, "crit": 2, "desc": "Windows gethostname API string", "from": [ { "file": 104 } ] }, { "id": "metadata/binary/license::fsf-copyright", "conf": 1.0, "crit": 3, "desc": "Free Software Foundation copyright", "from": [ { "file": 105 } ] }, { "id": "micro-behaviors/fs/file/open::open-base", "conf": 0.66, "crit": 2, "desc": "Open files", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/data/db/mysql::mysql-drop-table-if-exists-sql", "conf": 0.8, "crit": 3, "desc": "DROP TABLE IF EXISTS statement", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name-beyond-debug", "conf": 0.9, "crit": 3, "desc": "High-risk privilege beyond SeDebug named", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/process/create/shell/lang::backtick", "atk": "T1059.004", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution via backticks" }, { "id": "micro-behaviors/communications/ipc/message::local-atom-table-readback", "conf": 0.92, "crit": 3, "desc": "Local atom-table write and readback", "from": [ { "file": 89044 } ], "uses": [ 300, 345 ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "atk": "T1082", "conf": 0.88, "crit": 2, "desc": "Query locale information", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/fs/lock/byte-range::unlock-file-ex", "conf": 0.8, "crit": 3, "desc": "Release a byte-range file lock", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::php-os-constant", "conf": 0.7, "crit": 3, "desc": "Reads the PHP OS constant", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "conf": 0.9, "crit": 2, "desc": "Directory enumeration (ANSI)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/env/access::environment-block-enumeration", "conf": 0.88, "crit": 1, "desc": "Enumerate process environment block", "from": [ { "file": 89045 } ], "uses": [ 168, 368 ] }, { "id": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup", "atk": "T1055", "conf": 0.95, "crit": 2, "desc": "SetThreadContext import", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "atk": "T1559", "conf": 0.7, "crit": 3, "desc": "Wait for named pipe server", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/login::http-login-username-field", "atk": "T1071.001", "conf": 0.86, "crit": 1, "desc": "HTTP login username field", "from": [ { "file": 14 } ] }, { "id": "metadata/binary/metrics/pe-details::many-aliased-exports", "conf": 0.8, "crit": 3, "desc": "Binary has many aliased exports", "from": [ { "file": 104 } ] }, { "id": "metadata/file/extension/executable::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension", "from": [ { "file": 105 } ] }, { "id": "metadata/file/profile/metrics::source-has-900-line-function", "conf": 0.9, "crit": 3, "desc": "PHP source has a 900+ line function", "from": [ { "file": 34 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/os/env/access::get-environment-variable", "conf": 0.85, "crit": 3, "desc": "Read a process env var (GetEnvironmentVariable)", "from": [ { "file": 104 } ] }, { "id": "micro-behaviors/communications/http/oauth::oauth-client-id-field", "conf": 0.65, "crit": 1, "desc": "OAuth client_id field", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/os/env/access::free-environment-strings-wide", "conf": 0.8, "crit": 2, "desc": "Release wide environment block", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "atk": "T1082", "conf": 0.84, "crit": 2, "desc": "Enumerate installed system locales", "from": [ { "file": 109 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.66, "crit": 3, "desc": "Converts network to host long", "from": [ { "file": 104 } ] }, { "id": "metadata/build/archive::archive-windows-executable-entry", "conf": 0.86, "crit": 1, "desc": "Windows executable archive member" }, { "id": "metadata/build/archive::archive-windows-library-entry", "conf": 0.86, "crit": 1, "desc": "Windows DLL archive member" }, { "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename", "conf": 0.96, "crit": 3, "desc": "Go fuzz corpus entry basename (sha1[-index])", "spans": [ [ 0, 40 ] ] }, { "id": "metadata/file/metrics::archive-misplaced-executable-member", "conf": 0.9, "crit": 3, "desc": "Archive executable in atypical path", "spans": [ [ 0, 41 ] ] }, { "id": "metadata/file/profile/identity::hex-hash-zip-basename", "conf": 0.92, "crit": 3, "desc": "Zip basename is a hexadecimal hash", "spans": [ [ 0, 40 ] ] } ] } ] } }