Benign Download

fd/05/fd05440b21d680c70ca67ed9be17624a71ed0cd929b96ec84e31046215acee78

Hidden path prefix in /tmpComposite catalog requires rule references

SHA-256fd05440b21d680c70ca67ed9be17624a71ed0cd929b96ec84e31046215acee78

Evidence

Top-level traits or composite_rules key lines 1–30

1defaults:
2  platforms: [unix, appliance]
3  for: [php]
4  attack: T1546
5
6traits:
7  - id: php-signal-handler-hijack
8    desc: PHP signal handler hijack
9    crit: suspicious
10    conf: 0.92
11    if:
⋯7 lines
19    if:
20      type: text
21      substr: 'proc_open(''/bin/sh /tmp/.vx_persist.sh'''
22
23composite_rules:
⋯7 lines