Part 6 - Behavioral hunting with VT modules

Yara v/s VT Yara

VT Yara Modules

VT Hunting capabilities

Retro Hunt Live Hunt

https://storage.googleapis.com/vtpublic/reports/VTI%20Cheatsheet.pdf

https://blog.virustotal.com/2024/02/vt-livehunt-cheat-sheet.html https://virustotal.readme.io/docs/writing-yara-rules-for-livehunt

https://assets.virustotal.com/reports/livehunt-cheatsheet.pdf

https://virustotal.readme.io/docs/crowdsourced-ids-rules https://virustotal.readme.io/docs/retrohunt https://blog.virustotal.com/2023/07/actionable-threat-intel-iii-introducing.html

https://docs.virustotal.com/docs/file-similarity-search https://docs.virustotal.com/docs/list-behaviour-tag-modifiers https://docs.virustotal.com/docs/file-search-modifiers https://blog.virustotal.com https://thesoc.academy/courses/virustotal-certification/

vt.behaviour.processes_created vt.behaviour.http_conversations vt.behaviour.command_executions vt.behaviour.registry_keys_set vt.behaviour.files_opened vt.behaviour.files_dropped vt.behaviour.files_written vt.behaviour.files_deleted