Behavior hunting

Creating rules based on file behavior

The vt module provides a comprehensive view of a file, including its static properties, antivirus detection details, and also exposes information about how the file behaves.

To achieve this, we run the executable file through multiple sandbox environments, including our own Jujubox, CAPE, CAPA and other third-party solutions. The behavioral information generated by all those sandboxes is normalized into a common format, and mixed together as if it was generated by a single sandbox. This aggregated behavior report is what the vt module exposes to your rule.

Here are some examples of how this behavioral information can be used:

import "vt"  
  
rule drops_foo_exe {  
  condition:  
    for any file_dropped in vt.behaviour.files_dropped : (
      file_dropped.path contains "foo.exe"  
    )  
}

import "vt"  
  
rule mutex_hgl345 {  
  condition:  
    for any mutex in vt.behaviour.mutexes_created : (
       mutex == "HGL345"  
    )  
}

import "vt"  
  
rule persistence_and_self_deletion {  
  condition:  
    for any trait in vt.behaviour.traits : ( trait == vt.BehaviourTrait.PERSISTENCE ) and  
    for any trait in vt.behaviour.traits : ( trait == vt.BehaviourTrait.SELF_DELETE )  
}

Fields

The list below describes all the existing behaviour-related fields:

Detection

Files

Network

Permissions

Processes

Services

Registry

Windows specific

Android specific

Back to top