Command:
download=SHA256_HASH
Example:
download=2676f127b2b71d44f494027fbac4a20bc8be2257fe8a201b28b9780056bde24f
Command:
hash_info=HASH
Example (MD5, SHA1, SHA256):
hash_info=2676f127b2b71d44f494027fbac4a20bc8be2257fe8a201b28b9780056bde24f
Command:
type_info=FILE_TYPE
Example:
type_info=docx
Command:
tag_info=TAG
Example:
tag_info=Lazarus
Command:
yara=YARA_RULE
Example:
yara=win_remcos_g0
Command (TLSH / SSDEEP):
sim_hash=HASH_VALUE
Example (TLSH):
sim_hash=2676f127b2b71d44f494027fbac4a20bc8be2257fe8a201b28b9780056bde24f
Command:
cn_serial=SERIAL_NUMBER
Example:
cn_serial=51CD5393514F7ACE2B407C3DBFB09D8D
Command:
country=COUNTRY_CODE
Example (e.g., IN, US, RU):
country=IN
| Tag Examples |
|---|
| exe |
| dll |
| 32 |
| 64 |
| AgentTesla |
| CobaltStrike |
| elf |
| mirai |
| signed |
| zip |
| Rule Name Examples |
|---|
| Skystars_Malware_Imphash |
| pe_imphash |
| DebuggerCheck__API |
| NETexecutableMicrosoft |
| MD5_Constants |
| maldoc_find_kernel32_base_method_1 |
| unixredflags3 |
| maldoc_getEIP_method_1 |
| meth_get_eip |
| INDICATOR_SUSPICIOUS_Binary_References_Browsers |
| RIPEMD160_Constants |
| SHA1_Constants |
| linux_generic_ipv6_catcher |
| INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients |