vti-dorks

KO | EN

gitlite — search

#ai #typescript #llm #golang #android #rust #docker #macos #nodejs #awesome #vue #security #ios #openai

(★ 333)

Awesome VirusTotal Intelligence Search Queries

File Explorer

Download Latest Version (.zip)

LICENSE
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# vti-dorks
Awesome VirusTotal Enterprise Search Queries (formerly Virustotal Intelligence or VTI)

## Purpose

This repo lists useful Virustotal Enterprise search queries that are useful for threat hunting purposes. Please provide your favorite search queries as pull requests.

## Generic
Show uploads named "payload" that have less than 5 antivirus eignes detecting them.
```
name:payload positives:5-
```
Show uploads named "exploit" that have less than 5 antivirus eignes detecting them. False positives are PDFs, web pages or documents with exploit descriptions.
```
name:exploit positives:5-
```
Show uploads that contain the keyword "obfus" in the filename and exclude android samples. (android samples obstruct view) The keyword "obfus" is often found in obfuscated malware samples. 
```
name:obfus NOT tag:android
```
Show executable files that identify as Microsoft software but are packed with an unusual packer and have less than 10 positive antivirus matches
```
metadata:"Microsoft Corporation" AND tag:peexe AND ( packer:rar OR packer:upx OR packer:themida OR packer:asprox ) AND positives:10-
```
Unknown origin - no description yet 
```
name:myvtfile.exe
```
Malware hosted on a government URL
```
itw:".gov" positives:5+
```
Find PE files submitted to VT, within n-seconds of compilation, that trigger at least 5 detections
```
subspan:300- positives:5+
```
You can tune it a bit using:
`submitter:US` - US submitter
`submitter:web` - web submitter
`submissions:2-` - submitted less then 2 times

## Mimikatz

Show samples with filenames starting with "mimi" (rare) that have less than 5 antivirus engines with matches. 
```
name:mimi* positives:5-
```
Show samples with filenames ending with "katz.exe" (rare) that have less than 5 antivirus engines with matches. 
```
name:*katz.exe positives:5-
```
Show samples with some antivirus engines matches. These are often obfuscated Mimikatz variants.
```
engines:mimikatz positives:5-
```

## Special Threat Related

Example way to find Shamoon using the resource names:
```
resource:"PKCS7" and resource:"X509"
```
Reference: https://unit42.paloaltonetworks.com/unit42-shamoon-2-return-disttrack-wiper/

## Location Based
Show samples submitted from Germany with low antivirus coverage that could be successful phishing campaigns.  
```
submitter:DE positives:2+ positives:10- (tag:doc OR tag:docx)
```
Show samples submitted from Taiwan with low antivirus coverage that could be successful NEW phishing campaigns (only 1 submitter).  
```
submitter:TW positives:1+ positives:20- filename:*.eml submissions:1
```
Malicious submissions from Qatar are rare and often interesting if you're after threats in the Middle Eastern region. 
```
submitter:QA positives:2+
```
Show samples submitted from Israel with the keyword "Syria" in the filename that have 2 or more antivirus engines matching. 
```
submitter:IL name:syria positives:2+
```

## macOS
Hunting signed macOS DMGs with minimum detections (often caused by heuristics) 
```
ls:2019-01-16+ type:dmg positives:2+ tag:signed
```
## ELF
Hunting for ELF binaries belonging to the MIRAI family
```
tag:elf AND p:2+ AND engines:Mirai
```
Hunting for ELF binaries excluding MIRAI and DDOS malware
```
tag:elf AND p:5+ NOT engines:Mirai NOT engines:DDOS
```

## Sandbox result searches
VTi has several Sandboxes that will scan the behavior of the submitted files; searching for categories combined with tags can be useful.

Search for ransomware using the Lastline sandbox:
```
lastline:RANSOM 
```
Searching for stealers in the pe format on C2AE sandbox. (STEALER/MALWARE/TROJAN are some keywords used by this sandbox)
```
c2ae:STEALER and tag:peexe
```

## Content Searches (New Feature)

Content searches cannot be combined with other conditions.

Search for well-known mimikatz keyword in any type of sample. 
```
content:"sekurlsa::logonpasswords"
```
Detects phishing documents that ask the user to activate macros
```
content:"click enable editing"
content:"click enable content"
```
Detects exploit codes 
```
content:"] Shellcode"
```

## Sample Similarities and Pivoting

Content searches for malware similarities.

VT Feature Hash is an internal hash used by Virustotal.
```
similar-to:<hashofthefile>
```

Code Blocks is used to look for samples that contain the same pieces of code.
```
code-similar-to:<hashofthefile>
```

ImpHash is a well-known hash calculated with the Import Address Table to identify samples using the same imported functions.
```
imphash:<IATHash>
```

PE Rich Hash is a hash calculated from Rich Header.
```
rich_pe_header_hash:<Richhash>
```

TLSH is used to generate hash values which can then be analyzed for similarities.
```
tlsh:<tlshash>
```

SSDEEP is a fuzzing algorithm that can be used for the same purpose. 
```
ssdeep:<ssdeep_hash>
```

The other functions are used to identify similarity based on behavior identified with sandbox analysis. 
```
behash:<hashofthefile>
```

Files with a visually similar icon or thumbnail.
```
main_icon_dhash:<icon_hash>
```

.NET files that were built in one project have the same GUID value
```
netguid:<GUID>
```

Permhash is used to hash the declared permissions applied to Chromium-based browser extensions and APKs
```
permhash:<permhash>
```

vti-dorks

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

vti-dorks

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README