1 / 15 non-empty0 critical0 high1 medium0 low0 info
mediumprocess-without-exe-pathRunning processes with no exe path13 rows
The OS reports the process is running but no path on disk backs it. Consistent with memfd, unlinked binaries, or filesystems the user can't read. Investigate.
MITRE T1055defense-evasion
pidnameusernamecmdline
468chrome_crashpad_pq-cybarg
519Google Chrome Hepq-cybarg
520Google Chrome Hepq-cybarg
594Google Chrome Hepq-cybarg
631Google Chrome Hepq-cybarg
632Google Chrome Hepq-cybarg
674Google Chrome Hepq-cybarg
729Google Chrome Hepq-cybarg
10973web_app_shortcutanalyst
22360bashanalyst
32434bashanalyst
36099bashanalyst
79075bashanalyst
clean(would-be: critical)shai-hulud-packagesnpm packages on the Shai-Hulud worm compromised-versions list0 rows
Cross-reference lockfile entries against the bundled Shai-Hulud package@version list. Every hit is high-severity.
MITRE T1195.002initial-accesssupply-chain
no rows for this case
clean(would-be: high)browser-spawns-shellShell processes parented by a browser0 rows
Browsers don't legitimately parent interactive shells. Hits suggest post-exploitation via a malicious extension, compromised renderer, or drive-by execution.
MITRE T1059initial-accessexecution
no rows for this case
clean(would-be: high)curl-pipe-bashRemote download piped into a shell0 rows
curl/wget/Invoke-WebRequest output piped to bash/sh/iex. Classic dropper pattern.
MITRE T1105initial-accessexecution
no rows for this case
clean(would-be: high)dynamic-linker-hijackLD_PRELOAD / DYLD_INSERT_LIBRARIES in environment0 rows
Dynamic-linker injection variable is set in the current process environment. Almost never legitimate on a workstation.
MITRE T1574.006defense-evasionprivilege-escalation
no rows for this case
clean(would-be: high)encoded-powershellPowerShell with -EncodedCommand argument0 rows
powershell.exe invocation carrying a base64-encoded payload. Common evasion; nearly always worth reading the decoded form.
MITRE T1059.001executiondefense-evasion
no rows for this case
clean(would-be: high)ssh-key-forced-commandauthorized_keys entries with forced commands0 rows
Keys with a `command="..."` constraint. Legitimate uses (rsync-only, git-shell) exist, but a forced-command shell is a classic SSH backdoor.
MITRE T1098.004persistencecredential-access
no rows for this case
clean(would-be: medium)shell-init-hookShell init hook variable set (BASH_ENV / ENV / PROMPT_COMMAND)0 rows
Variables read by shells on every startup. An attacker that writes to these gets execution on every new shell.
MITRE T1546.004persistenceexecution
no rows for this case
clean(would-be: medium)tor-exit-connectionEstablished connection to a Tor exit node0 rows
Cross-references current network connections with the Tor Project bulk-exit list (live intel feed). Not malicious per se, but unusual for most production workloads.
MITRE T1090.003command-and-controldefense-evasion
no rows for this case
clean(would-be: low)browser-extension-sweeping-permsBrowser extensions holding sweeping permissions0 rows
Extensions with <all_urls>, debugger, nativeMessaging, cookies, history, etc. Each is a high-trust component whose maintainer changes are easy to miss.
MITRE T1176initial-accesscredential-access
no rows for this case
clean(would-be: low)high-entropy-domainBrowser history with high-entropy subdomains (DGA candidates)0 rows
Domains whose left-most label has high Shannon entropy. Often AWS S3 / CDN URLs (false positives) but also a hallmark of domain-generation-algorithm C2.
MITRE T1568.002command-and-control
no rows for this case
clean(would-be: low)large-authorized-keysauthorized_keys files with many entries0 rows
>5 active keys in a single authorized_keys file. Audit each key against current personnel and active automation.
MITRE T1098.004persistencecredential-access
no rows for this case
clean(would-be: low)persistence-in-user-homePersistence entry referencing a user home directory0 rows
LaunchAgents / cron / systemd units / Run keys that point at binaries under /Users/<name>/ or /home/. Plausibly legitimate (many tools install per-user) but each is worth eyeballing.
MITRE T1547persistence
no rows for this case
clean(would-be: low)recent-executable-in-dropRecently-modified executable files in /tmp, Downloads, /Users/Shared, %TEMP%0 rows
Anything executable that appeared in a common drop location in the last 14 days. Most are benign developer artifacts; a quick scan often turns up persistence droppers.
MITRE T1564.001initial-accessdefense-evasion
no rows for this case
clean(would-be: low)uncommon-listenerListening sockets on ports outside the common service range0 rows
Sockets in LISTEN state on a port not in the standard service map. Often benign (dev servers, electron apps) but worth a manual check.
MITRE T1571command-and-controllateral-movement
no rows for this case