Results for “virustotal”

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.

• Adding threat context to security alerts
• Processing indicators from phishing email submissions
• Standardizing bulk indicator lookups from threat feeds

Build an automated workflow that collects suspicious files, checks known malware records, and submits unknown samples to isolated analysis environments. Generate verdicts and indicators of compromise, then send results to security monitoring systems.

• Automating analysis of quarantined email attachments
• Batch-processing files quarantined by endpoint security
• Extracting threat indicators during incident investigations

Use when you need to check an IP, domain, file hash, or URL against VirusTotal's reputation database. Returns detection ratio, verdict, community score, and key findings. Commonly invoked by investigation skills (/ip-investigation, /domain-investigation, /hash-investigation, /url-investigation) and by analysts enriching IOCs. Other agents/skills can chain this for VirusTotal enrichment.

The English summary is being prepared. Showing the original description.

Investigate suspicious mobile apps by examining permissions, network traffic, and runtime behavior. Use observed evidence to identify signs of data theft, SMS interception, credential stealing, or communication with attacker control servers, then classify the suspected malware.

• Triaging suspicious APK or IPA samples
• Investigating possible data leaks from mobile apps
• Checking for SMS interception and credential theft

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.

The English summary is being prepared. Showing the original description.

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

The English summary is being prepared. Showing the original description.

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

The English summary is being prepared. Showing the original description.

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

The English summary is being prepared. Showing the original description.

Set up an email reporting button and an automated security response workflow. Classify reported messages, extract attack indicators, remove confirmed phishing emails, and send feedback to the people who reported them.

• Deploying a phishing reporting button in Outlook
• Automating triage of a dedicated reporting mailbox
• Retracting confirmed phishing emails across inboxes

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Analyze Windows Amcache records to investigate applications, deleted executable traces, and drivers. Extract file details, compare SHA-1 hashes with malware databases, and combine records into a timeline to support incident investigations.

• Investigating traces of deleted executables
• Checking software installed during an incident
• Comparing file hashes with malware databases

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.

• Triaging a suspicious email reported by a user
• Checking whether a sender domain was spoofed
• Tracing the delivery route of a phishing email

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes

Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.

• Mapping an organization's publicly exposed infrastructure
• Connecting public company records and social profiles
• Investigating image locations and video evidence

Threat intelligence fusion skill for collecting, normalizing, deduplicating, enriching, and operationalizing IOCs and TTPs from OTX, MISP, abuse.ch, VirusTotal, Shodan, GreyNoise, Censys, CISA KEV, NVD, vendor blogs, and internal telemetry. Use to build STIX/TAXII feeds, ATT&CK-mapped actor profiles, prioritized blocklists, and detection-ready intel packages.

The English summary is being prepared. Showing the original description.

Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.

The English summary is being prepared. Showing the original description.