VirusTotal Livehunt is a service that continuously scans all incoming indicators and notifies you when any of them matches your rules.
Livehunt not only monitors files, but also domains, URLs, and IP addresses.
In this post we detail a few practical examples along with useful tips.
This YARA module was created for VT Hunting services to provide all available context data, which is structured in two main sections: metadata and behaviour.
You can find more information about the VT module here.
Analysts can create rules to hunt based on the metadata information that VirusTotal gathers and processes.
We are referring to hunting files by characteristics, reputation, and even contextual details.
This would allow analysts to detect files of a certain type that were submitted several times from a given country, and that more than 5 antiviruses have flagged as malicious.
This example defines a rule focused on detecting potentially malicious DOCX files with macros.
DOCX. The next condition matches files flagged as malicious by more than 5 antivirus engines in VirusTotal.
This filters out most of the benign files, and can be adjusted according to the investigation.
The following rule is designed to identify PowerShell execution by manipulating metadata fields of.
This technique is frequently utilized by malware to avoid detection and initiate attacks.
Dynamic analysis can bring great value on top of static one.
This key allows programs to automatically execute once when a user logs in, often exploited by malware to maintain presence on a system.
This directory is often used to host scripts that automatically execute during user login, making it a common target for malware seeking persistence or automatic execution.
The second condition is very similar but checks the file path for files written during detonation.
The VirusTotal YARA module brings you unprecedented flexibility in crafting Livehunt rules combining traditional file content analysis with rich metadata information and behavioral patterns from dynamic analysis.
If you have any suggestions or want to share feedback please feel free to reach out here.
This Cyber News was published on blog.virustotal.com. Publication date: Tue, 06 Feb 2024 14:43:05 +0000