Detonate URL - Generic v1.5

Detonate URL through one or more active integrations that support URL detonation. Supported integrations: - SecneurX Analysis - ANY.RUN Cloud Sandbox - McAfee Advanced Threat Defense - WildFire - Lastline - Cuckoo Sandbox - Cisco Secure Malware Analytics (ThreatGrid) - JoeSecurity - CrowdStrike Falcon Sandbox - FireEye AX - VMRay Analyzer - Polygon - CrowdStrike Falcon Intelligence Sandbox - OPSWAT Filescan - VirusTotal - Anomali ThreatStream - Hatching Triage - ThreatGrid

Pack

CommonPlaybooks

Tasks

23

Inputs

• URL — The URL object of the URL to be detonated.
• anyrun_os — Specify ANY.RUN operation system type. Supports: windows, linux, android

Outputs

• ThreatGrid.Sample.id — The sample id.
• ThreatGrid.Sample.filename — The sample filename.
• ThreatGrid.Sample.state — The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail".
• ThreatGrid.Sample.status — The sample status.
• ThreatGrid.Sample.md5 — The sample md5.
• ThreatGrid.Sample.sha1 — The sample sha1.
• ThreatGrid.Sample.sha256 — The sample sha256.
• ThreatGrid.Sample.os — The sample os.
• ThreatGrid.Sample.submitted_at — The sample submission time.
• ATD.Task.taskId — The task ID of the sample uploaded.
• ATD.Task.jobId — The job ID of the sample uploaded.
• ATD.Task.messageId — The message Id relevant to the sample uploaded.
• ATD.Task.url — The URL detonated.
• ATD.Task.srcIp — Source IPv4 address.
• ATD.Task.destIp — Destination IPv4 address.
• ATD.Task.MD5 — MD5 of the sample uploaded.
• ATD.Task.SHA1 — SHA1 of the sample uploaded.
• ATD.Task.SHA256 — SHA256 of the sample uploaded.
• File.Name — Filename (only in case of report type=json).
• File.Type — File type e.g. "PE" (only in case of report type=json).
• File.MD5 — MD5 hash of the file (only in case of report type=json).
• File.SHA1 — SHA1 hash of the file (only in case of report type=json).
• File.SHA256 — SHA256 hash of the file (only in case of report type=json).
• File.EntryID — The Entry ID of the sample.
• File.Malicious — File Malicious object.
• DBotScore.Indicator — The indicator we tested (only in case of report type=json).
• DBotScore.Type — The type of the indicator (only in case of report type=json).
• DBotScore.Vendor — Vendor used to calculate the score (only in case of report type=json).
• DBotScore.Score — The actual score (only in case of report type=json).
• IP.Address — IP's relevant to the sample.
• InfoFile.EntryID — The EntryID of the report file.
• InfoFile.Extension — The extension of the report file.
• InfoFile.Name — The name of the report file.
• InfoFile.Info — The info of the report file.
• InfoFile.Size — The size of the report file.
• InfoFile.Type — The type of the report file.
• URL.Malicious — URL Malicious object.
• DBotScore.Reliability — The reliability of the source providing the intelligence data.
• URL.Data — The URL.
• Joe.Analysis.AnalysisID — The analysis ID.
• Joe.Analysis.Classification — The classification.
• Joe.Analysis.Comments — The comments.
• Joe.Analysis.detection — The detection.
• Joe.Analysis.duration — The duration.
• Joe.Analysis.encrypted — True if the analysis data is encrypted.
• Joe.Analysis.filename — The filename.
• Joe.Analysis.score — The score.
• Joe.Analysis.scriptname — The script name.
• Joe.Analysis.status — The status.
• Joe.Analysis.threatname — The threat name.
• Joe.Analysis.time — The time.
• Joe.Analysis.webid — The web ID.
• Joe.Analysis.runs.detection — The detection.
• Joe.Analysis.runs.error — The error.
• Joe.Analysis.runs.score — The score.
• Joe.Analysis.runs.sigma — The sigma.
• Joe.Analysis.runs.snort — The snort.
• Joe.Analysis.runs.system — The system.
• Joe.Analysis.runs.yara — The YARA.
• Joe.Submission.most_relevant_analysis.detection — The detection.
• Joe.Submission.most_relevant_analysis.score — The submission score.
• Joe.Submission.most_relevant_analysis.webid — The submission web ID.
• Joe.Submission.name — The submission name.
• Joe.Submission.status — The submission status.
• Joe.Submission.submission_id — The submission ID.
• Joe.Submission.time — The submission time.
• File.Size — File size (only in case of report type=json).
• File.Malicious.Vendor — The vendor that determined that a file is malicious.
• File.Malicious.Description — The reason that the vendor determined that the file is malicious.
• File.Malicious.Score — The score that the malicious file received from the vendor.
• URL.Malicious.Vendor — The vendor that determined that a URL is malicious.
• URL.Malicious.Description — The reason that the vendor determined that the URL is malicious.
• URL.Malicious.Score — The score that the malicious URL received from the vendor.
• Lastline.Submission.Status — Status of the submission.
• Lastline.Submission.DNSqueries — List of DNS queries done by the analysis subject.
• Lastline.Submission.NetworkConnections — List of network connections done by the analysis subject.
• Lastline.Submission.DownloadedFiles — List of files that were downloaded using the Microsoft Windows file-download API functions. Each element is a tuple of file-origin URL and a File element.
• Lastline.Submission.UUID — ID of the submission.
• Lastline.Submission.YaraSignatures.name — Yara signatures name.
• Lastline.Submission.YaraSignatures.score — The score according to the yara signatures. from 0 to 100.
• Lastline.Submission.YaraSignatures.internal — True if the signature is only for internal use.
• Lastline.Submission.Process.arguments — Argument of the process.
• Lastline.Submission.Process.process_id — The process ID.
• Lastline.Submission.Process.executable.abs_path — Absolute path of the executable of the process.
• Lastline.Submission.Process.executable.filename — Filename of the executable.
• Lastline.Submission.Process.executable.yara_signature_hits — Yara signature of the executable of the process.
• Cuckoo.Task.Category — Category of task.
• Cuckoo.Task.Machine — Machine of task.
• Cuckoo.Task.Errors — Errors of task.
• Cuckoo.Task.Traget — Traget of task.
• Cuckoo.Task.Package — Package of task.
• Cuckoo.Task.SampleID — Sample ID of task.
• Cuckoo.Task.Guest — Task guest.
• Cuckoo.Task.Custom — Custom values of task.
• Cuckoo.Task.Owner — Task owner.
• Cuckoo.Task.Priority — Priority of task.
• Cuckoo.Task.Platform — Platform of task.
• Cuckoo.Task.Options — Task options.
• Cuckoo.Task.Status — Task status.
• Cuckoo.Task.EnforceTimeout — Is timeout of task enforced.
• Cuckoo.Task.Timeout — Task timeout.
• Cuckoo.Task.Memory — Task memory.
• Cuckoo.Task.Tags — Task tags.
• Cuckoo.Task.ID — ID of task.
• Cuckoo.Task.AddedOn — Date on which the task was added.
• Cuckoo.Task.CompletedOn — Date on which the task was completed.
• Cuckoo.Task.Score — Reported score of the the task.
• Cuckoo.Task.Monitor — Monitor of the reported task.
• Domain.Name — The Domain name.
• Domain.DNS — A list of IP objects resolved by DNS.
• RegistryKey.Path — The path to the registry key.
• RegistryKey.Value — The value at the given RegistryKey.
• Process.Name — Process name.
• Process.PID — Process PID.
• Process.CommandLine — Process Command Line.
• Process.Path — Process path.
• Process.StartTime — Process start time.
• Process.EndTime — Process end time.
• Polygon.Analysis.ID — Analysis ID in THF.
• Polygon.Analysis.Name — File Name.
• Polygon.Analysis.Size — File Size.
• Polygon.Analysis.Started — Analysis start timestamp.
• Polygon.Analysis.Analyzed — Analysis finish timestamp.
• Polygon.Analysis.MD5 — Analyzed file MD5 hash.
• Polygon.Analysis.SHA1 — Analyzed file SHA1 hash.
• Polygon.Analysis.SHA256 — Analyzed file SHA256.
• Polygon.Analysis.Result — Analysis verdict.
• Polygon.Analysis.Status — The analysis status.
• Polygon.Analysis.Verdict — Analysis verdict.
• Polygon.Analysis.Probability — Verdict probability.
• Polygon.Analysis.Families — Malware families.
• Polygon.Analysis.Score — Polygon score.
• Polygon.Analysis.Internet-connection — Internet availability.
• Polygon.Analysis.Type — File type.
• Polygon.Analysis.DumpExists — Network activity dump exists.
• Polygon.Analysis.File — The information about files in analysis.
• Polygon.Analysis.URL — The information about URL indicators.
• Polygon.Analysis.IP — The information about IP indicators.
• Polygon.Analysis.Domain — The information about Domain indicators.
• Polygon.Analysis.RegistryKey — The information about registry keys which were modified during the analysis.
• Polygon.Analysis.Process — The information about processes started during the analysis.
• CrowdStrike.Submit.job_id — The The submitted report job ID.
• CrowdStrike.Submit.submission_type — The type of the submission.
• CrowdStrike.Submit.submission_id — The submission ID.
• CrowdStrike.Submit.environment_id — The submission environment ID.
• CrowdStrike.Submit.sha256 — The SHA256 hash of the file.
• CrowdStrike.Report.job_id — The report job ID.
• CrowdStrike.Report.environment_id — The report environment ID.
• CrowdStrike.Report.environment_description — The environment description.
• CrowdStrike.Report.size — The file size.
• CrowdStrike.Report.type — The file type.
• CrowdStrike.Report.type_short — The short description of the file type.
• CrowdStrike.Report.target_url — The target url.
• CrowdStrike.Report.state — The report state.
• CrowdStrike.Report.error_type — The error type.
• CrowdStrike.Report.error_origin — The error origin.
• CrowdStrike.Report.submit_name — The file name when submitted.
• CrowdStrike.Report.md5 — The MD5 hash of the file.
• CrowdStrike.Report.sha1 — The SHA1 hash of the file.
• CrowdStrike.Report.sha256 — The SHA256 hash of the file.
• CrowdStrike.Report.sha512 — The SHA512 hash of the file.
• CrowdStrike.Report.ssdeep — The SSDeep hash of the file.
• CrowdStrike.Report.imphash — The imphash hash of the file.
• CrowdStrike.Report.av_detect — The AV Multiscan range, for example 50-70 (min 0, max 100).
• CrowdStrike.Report.vx_family — The file malware famil.
• CrowdStrike.Report.url_analysis — Whether this report is url analysis.
• CrowdStrike.Report.analysis_start_time — The start time of the analysis.
• CrowdStrike.Report.threat_score — The file threat score.
• CrowdStrike.Report.interesting — Whether the file was found to be interesting.
• CrowdStrike.Report.threat_level — The file threat level.
• CrowdStrike.Report.verdict — The file verdict.
• CrowdStrike.Report.total_network_connections — The total number of network connections.
• CrowdStrike.Report.total_processes — The total number of processes.
• CrowdStrike.Report.total_signatures — The total number of signatures.
• CrowdStrike.Report.file_metadata — The file metadata.
• CrowdStrike.Report.network_mode — The network mode.
• CrowdStrike.Report.submissions.submission_id — The submission ID.
• CrowdStrike.Report.submissions.filename — The name of the file.
• CrowdStrike.Report.submissions.url — The url.
• CrowdStrike.Report.submissions.created_at — When the submission was created.
• File.MalwareFamily — The file family classification.
• WildFire.Report.MD5 — MD5 of the submission.
• WildFire.Report.SHA256 — SHA256 of the report.
• WildFire.Report.Status — The status of the submission.
• WildFire.Report.URL — URL of the submission.
• WildFire.Report.iocs — Associated IOCs.
• WildFire.Report.verdict — The verdict of the report.
• WildFire.Report.Platform — The platform of the report.
• WildFire.Report.Software — The software of the report.
• File.DigitalSignature.Publisher — The entity that signed the file for authenticity purposes.
• WildFire.Report.NetworkInfo.URL.Host — The submission related hosts.
• WildFire.Report.NetworkInfo.URL.Method — The submission related method.
• WildFire.Report.NetworkInfo.URL.URI — The submission related URI.
• WildFire.Report.NetworkInfo.URL.UserAgent — The submission related user agent.
• WildFire.Report.NetworkInfo.UDP.IP — The submission related IPs, in UDP protocol.
• WildFire.Report.NetworkInfo.UDP.Port — The submission related ports, in UDP protocol.
• WildFire.Report.NetworkInfo.UDP.JA3 — The submission related JA3s, in UDP protocol.
• WildFire.Report.NetworkInfo.UDP.JA3S — The submission related JA3Ss, in UDP protocol.
• WildFire.Report.NetworkInfo.UDP.Country — The submission related countries, in UDP protocol.
• WildFire.Report.NetworkInfo.TCP.IP — The submission related IPs, in TCP protocol.
• WildFire.Report.NetworkInfo.TCP.JA3 — The submission related JA3s, in TCP protocol.
• WildFire.Report.NetworkInfo.TCP.JA3S — The submission related JA3Ss, in TCP protocol.
• WildFire.Report.NetworkInfo.TCP.Country — The submission related Countries, in TCP protocol.
• WildFire.Report.NetworkInfo.TCP.Port — The submission related ports, in TCP protocol.
• WildFire.Report.NetworkInfo.DNS.Query — The submission DNS queries.
• WildFire.Report.NetworkInfo.DNS.Response — The submission DNS responses.
• WildFire.Report.NetworkInfo.DNS.Type — The submission DNS Types.
• WildFire.Report.Evidence.md5 — The submission evidence MD5 hash.
• WildFire.Report.Evidence.Text — The submission evidence text.
• WildFire.Report.detection_reasons.description — Reason for the detection verdict.
• WildFire.Report.detection_reasons.name — Name of the detection.
• WildFire.Report.detection_reasons.type — Type of the detection.
• WildFire.Report.detection_reasons.verdict — Verdict of the detection.
• WildFire.Report.detection_reasons.artifacts — Artifacts of the detection reasons.
• WildFire.Report.ProcessList.Service — The process service.
• WildFire.Report.ProcessList.ProcessCommand — The process command.
• WildFire.Report.ProcessList.ProcessName — The process name.
• WildFire.Report.ProcessList.ProcessPid — The process pid.
• WildFire.Report.ProcessList.ProcessFile — Lists files that started a child processes, including the process name and the action the process performed.
• WildFire.Report.ProcessTree.ProcessName — The process name.
• WildFire.Report.ProcessTree.ProcessPid — The process pid.
• WildFire.Report.ProcessTree.ProcessText — The action the process performed.
• WildFire.Report.ProcessTree.Process.ChildName — The child process name.
• WildFire.Report.ProcessTree.Process.ChildPid — The child process pid.
• WildFire.Report.ProcessTree.Process.ChildText — The action the child process performed.
• WildFire.Report.ExtractedURL.URL — The extracted URL.
• WildFire.Report.ExtractedURL.Verdict — The extracted verdict.
• WildFire.Report.Summary.Text — The summary of the report.
• WildFire.Report.Summary.Details — The details summary of the report.
• WildFire.Report.Summary.Behavior — The behavior summary of the report.
• WildFire.Report.ELF.ShellCommands — The shell commands.
• VirusTotal.Analysis.data.attributes.stats.harmless — Number of engines found the indicator harmless.
• VirusTotal.Analysis.data.attributes.stats.malicious — Number of engines found the indicator malicious.
• VirusTotal.Analysis.data.attributes.stats.suspicious — Number of engines found the indicator suspicious.
• VirusTotal.Analysis.data.attributes.stats.timeout — Number of engines found the indicator timeout.
• VirusTotal.Analysis.data.attributes.stats.undetected — Number of engines found the indicator undetected.
• VirusTotal.Analysis.data.attributes.date — Date of the analysis in epoch.
• VirusTotal.Analysis.data.attributes.status — Status of the analysis.
• VirusTotal.Analysis.data.id — ID of the analysis.
• VirusTotal.Analysis.data.type — Type of object (analysis).
• VirusTotal.Analysis.meta.url_info.id — ID of the url.
• VirusTotal.Analysis.meta.url_info.url — The URL.
• VirusTotal.Analysis.id — The analysis ID.
• VMRay.Job.JobID — The ID of a new job.
• VMRay.Job.SampleID — The ID of sample.
• VMRay.Job.Created — The timestamp of the created job.
• VMRay.Job.VMName — The name of virtual machine.
• VMRay.Job.VMID — The ID of virtual machine.
• VMRay.Sample.SampleID — The sample ID of the task.
• VMRay.Sample.Created — The timestamp of the created sample.
• VMRay.Sample.FileName — The file name of the sample.
• VMRay.Sample.MD5 — The MD5 hash of the sample.
• VMRay.Sample.SHA1 — The SHA1 hash of the sample.
• VMRay.Sample.SHA256 — The SHA256 hash of the sample.
• VMRay.Sample.SSDeep — The SSDeep of the sample.
• VMRay.Sample.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
• VMRay.Sample.VerdictReason — Description of the Verdict Reason.
• VMRay.Sample.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
• VMRay.Sample.Type — The file type.
• VMRay.Sample.Classifications — The classifications of the sample.
• VMRay.Submission.SubmissionID — The submission ID.
• VMRay.Submission.HadErrors — Whether there are any errors in the submission.
• VMRay.Submission.IsFinished — The status of submission. Can be, "true" or "false".
• VMRay.Submission.MD5 — The MD5 hash of the sample in submission.
• VMRay.Submission.SHA1 — The SHA1 hash of the sample in submission.
• VMRay.Submission.SHA256 — The SHA256 hash of the sample in submission.
• VMRay.Submission.Verdict — Verdict for the sample (Malicious, Suspicious, Clean, Not Available).
• VMRay.Submission.VerdictReason — Description of the Verdict Reason.
• VMRay.Submission.Severity — Severity of the sample (Malicious, Suspicious, Good, Blacklisted, Whitelisted, Unknown). Deprecated.
• VMRay.Submission.SSDeep — The SSDeep hash of the sample in submission.
• VMRay.Submission.SampleID — The ID of the sample in submission.
• VMRay.Sample.IOC.URL.AnalysisID — The IDs of the other analyses that contain the given URL.
• VMRay.Sample.IOC.URL.URL — The URL.
• VMRay.Sample.IOC.URL.Operation — The operation of the specified URL.
• VMRay.Sample.IOC.URL.ID — The ID of the URL.
• VMRay.Sample.IOC.URL.Type — The type of the URL.
• VMRay.Sample.IOC.Domain.AnalysisID — The IDs of the other analyses that contain the given domain.
• VMRay.Sample.IOC.Domain.Domain — The domain.
• VMRay.Sample.IOC.Domain.ID — The ID of the domain.
• VMRay.Sample.IOC.Domain.Type — The type of the domain.
• VMRay.Sample.IOC.IP.AnalysisID — The IDs of the other analyses that contain the given IP address.
• VMRay.Sample.IOC.IP.IP — The IP address.
• VMRay.Sample.IOC.IP.Operation — The operation of the given IP address.
• VMRay.Sample.IOC.IP.ID — The ID of the IP address.
• VMRay.Sample.IOC.IP.Type — The type of the IP address.
• VMRay.Sample.IOC.Mutex.AnalysisID — The IDs of other analyses that contain the given IP address.
• VMRay.Sample.IOC.Mutex.Name — The name of the mutex.
• VMRay.Sample.IOC.Mutex.Operation — The operation of the given mutex.
• VMRay.Sample.IOC.Mutex.ID — The ID of the mutex.
• VMRay.Sample.IOC.Mutex.Type — The type of the mutex.
• VMRay.Sample.IOC.File.AnalysisID — The IDs of other analyses that contain the given file.
• VMRay.Sample.IOC.File.Name — The name of the file.
• VMRay.Sample.IOC.File.Operation — The operation of the given file.
• VMRay.Sample.IOC.File.ID — The ID of the file.
• VMRay.Sample.IOC.File.Type — The type of the file.
• VMRay.Sample.IOC.File.Hashes.MD5 — The MD5 hash of the given file.
• VMRay.Sample.IOC.File.Hashes.SSDeep — The SSDeep hash of the given file.
• VMRay.Sample.IOC.File.Hashes.SHA256 — The SHA256 hash of the given file.
• VMRay.Sample.IOC.File.Hashes.SHA1 — The SHA1 hash of the given file.
• VMRay.ThreatIndicator.AnalysisID — The list of connected analysis IDs.
• VMRay.ThreatIndicator.Category — The category of threat indicators.
• VMRay.ThreatIndicator.Classification — The classifications of threat indicators.
• VMRay.ThreatIndicator.ID — The ID of the threat indicator.
• VMRay.ThreatIndicator.Operation — The operation that caused the indicators.
• ThreatStream.Analysis.ReportID — The report ID submitted to the sandbox.
• ThreatStream.Analysis.Status — The analysis status.
• ThreatStream.Analysis.Platform — The platform of the submission submitted to the sandbox.
• ThreatStream.Analysis.Category — The report category.
• ThreatStream.Analysis.Started — The detonation start time.
• ThreatStream.Analysis.Completed — The detonation completion time.
• ThreatStream.Analysis.Duration — The duration of the detonation (in seconds).
• ThreatStream.Analysis.VmName — The VM name.
• ThreatStream.Analysis.VmID — The VM ID.
• ThreatStream.Analysis.Verdict — The verdict of the sandbox detonation.
• ThreatStream.Analysis.Network.UdpSource — The UDP source.
• ThreatStream.Analysis.Network.UdpDestination — The UDP destination.
• ThreatStream.Analysis.Network.UdpPort — The UDP port.
• ThreatStream.Analysis.Network.IcmpSource — The ICMP source.
• ThreatStream.Analysis.Network.IcmpDestination — The ICMP destination.
• ThreatStream.Analysis.Network.IcmpPort — The ICMP port.
• ThreatStream.Analysis.Network.TcpSource — The TCP source.
• ThreatStream.Analysis.Network.TcpDestination — The TCP destination.
• ThreatStream.Analysis.Network.TcpPort — The TCP port.
• ThreatStream.Analysis.Network.HttpSource — The source of the HTTP address.
• ThreatStream.Analysis.Network.HttpDestinaton — The destination of the HTTP address.
• ThreatStream.Analysis.Network.HttpPort — The port of the HTTP address.
• ThreatStream.Analysis.Network.HttpsSource — The source of the HTTPS address.
• ThreatStream.Analysis.Network.HttpsDestinaton — The destination of the HTTPS address.
• ThreatStream.Analysis.Network.HttpsPort — The port of the HTTPS address.
• ThreatStream.Analysis.Network.Hosts — The network analysis hosts.
• FireEyeAX.Submissions.URL.Key — The submission key.
• FireEyeAX.Submissions.Severity — The severity level of the file.
• FireEyeAX.Submissions.InfoLevel — The info level of the report.
• Triage.sample-summaries.completed — Date the sample analysis was completed.
• Triage.sample-summaries.created — Date the analysis report was created.
• Triage.sample-summaries.custom — Custom sample analysis.
• Triage.sample-summaries.owner — Owner of the sample analysis.
• Triage.sample-summaries.sample — Unique identifier of the sample,.
• Triage.sample-summaries.score — Score of the sample on a scale of 0 to 10.
• Triage.sample-summaries.sha256 — SHA256 hash of the sample.
• Triage.sample-summaries.status — Status of the analysis.
• Triage.sample-summaries.target — Target for the analysis.
• Triage.sample-summaries.tasks — Tasks performed in the analysis.
• SecneurXAnalysis.Report.SHA256 — SHA256 value of the analyzed sample.
• SecneurXAnalysis.Report.Platform — Platform of the analyzed sample.
• SecneurXAnalysis.Report.Verdict — Summary result of the analyzed sample.
• SecneurXAnalysis.Report.Tags — More details of the analyzed sample.
• SecneurXAnalysis.Report.DnsRequests — List of DNS data observed in the analyzed sample.
• SecneurXAnalysis.Report.HttpRequests — List of HTTP data observed in the analyzed sample.
• SecneurXAnalysis.Report.JA3Digests — List of JA3 data observed in the analyzed sample.
• SecneurXAnalysis.Report.ProcessCreated — Process behaviour data observed in the analyzed sample.
• SecneurXAnalysis.Report.RegistrySet — List of Registry creations observed in the analyzed sample.
• SecneurXAnalysis.Report.RegistryDeleted — List of Registry deletions observed in the analyzed sample.
• SecneurXAnalysis.Report.FileCreated — List of File creations observed in the analyzed sample.
• SecneurXAnalysis.Report.FileDropped — List of File drops observed in the analyzed sample.
• SecneurXAnalysis.Report.FileDeleted — List of File deletions observed in the analyzed sample.
• SecneurXAnalysis.Report.FileModified — List of File changes observed in the analyzed sample.
• SecneurXAnalysis.Report.IOC — List of IOC's observed in the analyzed sample.
• SecneurXAnalysis.Report.Status — Analysis queued sample state.
• csfalconx.resource.id — Analysis ID.
• csfalconx.resource.verdict — Analysis verdict.
• csfalconx.resource.created_timestamp — Analysis start time.
• csfalconx.resource.environment_id — Environment ID.
• csfalconx.resource.environment_description — Environment description.
• csfalconx.resource.threat_score — Score of the threat.
• csfalconx.resource.submit_url — URL submitted for analysis.
• csfalconx.resource.submission_type — Type of submitted artifact, for example file, URL, etc.
• csfalconx.resource.sha256 — SHA256 hash of the submitted file.
• csfalconx.resource.ioc_report_strict_csv_artifact_id — ID of the IOC pack to download (CSV).
• csfalconx.resource.ioc_report_broad_csv_artifact_id — ID of the IOC pack to download (CSV).
• csfalconx.resource.ioc_report_strict_json_artifact_id — ID of the IOC pack to download (JSON).
• csfalconx.resource.ioc_report_broad_json_artifact_id — ID of the IOC pack to download (JSON).
• csfalconx.resource.ioc_report_strict_stix_artifact_id — ID of the IOC pack to download (STIX).
• csfalconx.resource.ioc_report_broad_stix_artifact_id — ID of the IOC pack to download (STIX).
• csfalconx.resource.ioc_report_strict_maec_artifact_id — ID of the IOC pack to download (MAEC).
• csfalconx.resource.ioc_report_broad_maec_artifact_id — ID of the IOC pack to download (MAEC).
• OPSWAT.Filescan.Submission.flow_id — The flow ID.
• OPSWAT.Filescan.Analysis.finalVerdict.verdict — The final verdict.
• OPSWAT.Filescan.Analysis.allTags — All tags.
• OPSWAT.Filescan.Analysis.overallState — Overall state of the scan.
• OPSWAT.Filescan.Analysis.subtaskReferences — Status of scan subtasks.
• OPSWAT.Filescan.Analysis.allSignalGroups — All signal groups.
• OPSWAT.Filescan.Analysis.resources — Resources.
• OPSWAT.Filescan.Analysis.taskReference.name — Name of the main scan task.
• OPSWAT.Filescan.Analysis.taskReference.additionalInfo — Additional informations about the main scan task.
• OPSWAT.Filescan.Analysis.taskReference.ID — ID of the main scan task.
• OPSWAT.Filescan.Analysis.taskReference.state — State of the main scan task.
• OPSWAT.Filescan.Analysis.taskReference.resourceReference — Resource reference of the main scan task.
• OPSWAT.Filescan.Analysis.taskReference.opcount — Counter.
• OPSWAT.Filescan.Analysis.taskReference.processTime — processTime.
• OPSWAT.Filescan.Analysis.file.name — The name of the file.
• OPSWAT.Filescan.Analysis.file.hash — The SHA256 of the file.
• OPSWAT.Filescan.Analysis.file.type — The type of the submission.
• ANYRUN.SandboxAnalysis.mitre.name — MITRE Technic text description.
• ANYRUN.SandboxAnalysis.mitre.phases — MITRE Technic phases.
• ANYRUN.SandboxAnalysis.mitre.id — MITRE Technic identifier.
• ANYRUN.SandboxAnalysis.debugStrings — Analysis debug information.
• ANYRUN.SandboxAnalysis.incidents.process — Analysis process.
• ANYRUN.SandboxAnalysis.incidents.events.time — Event time.
• ANYRUN.SandboxAnalysis.incidents.events.cmdline — Event command line.
• ANYRUN.SandboxAnalysis.incidents.events.image — Event image.
• ANYRUN.SandboxAnalysis.incidents.mitre.v — MITRE version.
• ANYRUN.SandboxAnalysis.incidents.mitre.sid — SID.
• ANYRUN.SandboxAnalysis.incidents.mitre.tid — TID.
• ANYRUN.SandboxAnalysis.incidents.count — Count of related incidents.
• ANYRUN.SandboxAnalysis.incidents.firstSeen — Incident first seen date.
• ANYRUN.SandboxAnalysis.incidents.source — Incident source.
• ANYRUN.SandboxAnalysis.incidents.desc — Incident description.
• ANYRUN.SandboxAnalysis.incidents.title — Incident title.
• ANYRUN.SandboxAnalysis.incidents.threatLevel — Incident threat level.
• ANYRUN.SandboxAnalysis.incidents.events.typeValue — Event type value.
• ANYRUN.SandboxAnalysis.incidents.events.key — Event key.
• ANYRUN.SandboxAnalysis.incidents.events.value — Event value.
• ANYRUN.SandboxAnalysis.incidents.events.name — Event name.
• ANYRUN.SandboxAnalysis.incidents.events.operation — Even operation.
• ANYRUN.SandboxAnalysis.incidents.events.cmdParent — Event parent cmd.
• ANYRUN.SandboxAnalysis.incidents.events.cmdChild — Event child cmd.
• ANYRUN.SandboxAnalysis.modified.registry.time — Registry time.
• ANYRUN.SandboxAnalysis.modified.registry.process — Registry process.
• ANYRUN.SandboxAnalysis.modified.registry.operation — Registry operation.
• ANYRUN.SandboxAnalysis.modified.registry.value — Registry value.
• ANYRUN.SandboxAnalysis.modified.registry.name — Registry name.
• ANYRUN.SandboxAnalysis.modified.registry.key — Registry key.
• ANYRUN.SandboxAnalysis.modified.files.process — File process.
• ANYRUN.SandboxAnalysis.modified.files.size — File size.
• ANYRUN.SandboxAnalysis.modified.files.filename — Filename.
• ANYRUN.SandboxAnalysis.modified.files.time — File creating time.
• ANYRUN.SandboxAnalysis.modified.files.info.mime — File MIME type.
• ANYRUN.SandboxAnalysis.modified.files.info.file — File content.
• ANYRUN.SandboxAnalysis.modified.files.permanentUrl — File url.
• ANYRUN.SandboxAnalysis.modified.files.hashes.ssdeep — File SSDeep.
• ANYRUN.SandboxAnalysis.modified.files.hashes.sha256 — File sha256 hash.
• ANYRUN.SandboxAnalysis.modified.files.hashes.sha1 — File sha1 hash.
• ANYRUN.SandboxAnalysis.modified.files.hashes.md5 — File md5 hash.
• ANYRUN.SandboxAnalysis.modified.files.threatLevel — File threat level.
• ANYRUN.SandboxAnalysis.modified.files.type — File type.
• ANYRUN.SandboxAnalysis.network.threats — Analysis network threats.
• ANYRUN.SandboxAnalysis.network.connections.reputation — Network connection reputation.
• ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3SFullstring — Network connection ja3S.
• ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3S — Network connection ja3S.
• ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3Fullstring — Network connection ja3F.
• ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.ja3 — Network connection ja3F.
• ANYRUN.SandboxAnalysis.network.connections.time — Network connection time.
• ANYRUN.SandboxAnalysis.network.connections.asn — Network connection ASN.
• ANYRUN.SandboxAnalysis.network.connections.country — Network connection country.
• ANYRUN.SandboxAnalysis.network.connections.protocol — Network connection protocol.
• ANYRUN.SandboxAnalysis.network.connections.port — Network connection port.
• ANYRUN.SandboxAnalysis.network.connections.ip — Network connection ip.
• ANYRUN.SandboxAnalysis.network.connections.process — Network connection processes.
• ANYRUN.SandboxAnalysis.network.connections.tlsFingerprint.jarm — Network connection jarm.
• ANYRUN.SandboxAnalysis.network.httpRequests.country — HTTP Request country.
• ANYRUN.SandboxAnalysis.network.httpRequests.reputation — HTTP Request reputation.
• ANYRUN.SandboxAnalysis.network.httpRequests.process — HTTP Request related process.
• ANYRUN.SandboxAnalysis.network.httpRequests.httpCode — HTTP Request status code.
• ANYRUN.SandboxAnalysis.network.httpRequests.status — HTTP Request status.
• ANYRUN.SandboxAnalysis.network.httpRequests.user-agent — HTTP Request User-Agent header value.
• ANYRUN.SandboxAnalysis.network.httpRequests.proxyDetected — HTTP Request is proxy detected.
• ANYRUN.SandboxAnalysis.network.httpRequests.port — HTTP Request port.
• ANYRUN.SandboxAnalysis.network.httpRequests.ip — HTTP Request ip.
• ANYRUN.SandboxAnalysis.network.httpRequests.url — HTTP Request url.
• ANYRUN.SandboxAnalysis.network.httpRequests.host — HTTP Request host.
• ANYRUN.SandboxAnalysis.network.httpRequests.method — HTTP Request method.
• ANYRUN.SandboxAnalysis.network.httpRequests.time — HTTP Request time estimate.
• ANYRUN.SandboxAnalysis.network.dnsRequests.reputationNumber — DNS Request reputation number.
• ANYRUN.SandboxAnalysis.network.dnsRequests.reputation — DNS Request reputation.
• ANYRUN.SandboxAnalysis.network.dnsRequests.ips — DNS Request IPs.
• ANYRUN.SandboxAnalysis.network.dnsRequests.domain — DNS Request domain.
• ANYRUN.SandboxAnalysis.network.dnsRequests.time — DNS Request time estimate.
• ANYRUN.SandboxAnalysis.malconf — Analysis malconf.
• ANYRUN.SandboxAnalysis.processes.synchronization — Analysis processes synchronization.
• ANYRUN.SandboxAnalysis.processes.modules — Analysis processes modules.
• ANYRUN.SandboxAnalysis.processes.hasMalwareConfig — Process has malware config.
• ANYRUN.SandboxAnalysis.processes.parentUUID — Process parent UUID.
• ANYRUN.SandboxAnalysis.processes.status — Process status.
• ANYRUN.SandboxAnalysis.processes.scores.specs.malwareConfig — Process malware config.
• ANYRUN.SandboxAnalysis.processes.scores.specs.privEscalation — Process priv escalation.
• ANYRUN.SandboxAnalysis.processes.scores.specs.stealing — Process stealing.
• ANYRUN.SandboxAnalysis.processes.scores.specs.networkLoader — Process network loader.
• ANYRUN.SandboxAnalysis.processes.scores.specs.network — Process network.
• ANYRUN.SandboxAnalysis.processes.scores.specs.lowAccess — Process low access.
• ANYRUN.SandboxAnalysis.processes.scores.specs.knownThreat — Process known threat.
• ANYRUN.SandboxAnalysis.processes.scores.specs.injects — Process inject.
• ANYRUN.SandboxAnalysis.processes.scores.specs.exploitable — Process exploitable.
• ANYRUN.SandboxAnalysis.processes.scores.specs.executableDropped — Process executable dropped.
• ANYRUN.SandboxAnalysis.processes.scores.specs.debugOutput — Process debug output.
• ANYRUN.SandboxAnalysis.processes.scores.specs.crashedApps — Process crashed apps.
• ANYRUN.SandboxAnalysis.processes.scores.specs.autoStart — Process auto start.
• ANYRUN.SandboxAnalysis.processes.scores.loadsSusp — Process loads susp.
• ANYRUN.SandboxAnalysis.processes.scores.injected — Process injected.
• ANYRUN.SandboxAnalysis.processes.scores.dropped — Process dropped.
• ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevelText — Process threat level text.
• ANYRUN.SandboxAnalysis.processes.scores.verdict.threatLevel — Process threat level.
• ANYRUN.SandboxAnalysis.processes.scores.verdict.score — Process score.
• ANYRUN.SandboxAnalysis.processes.context.userName — Process context username.
• ANYRUN.SandboxAnalysis.processes.context.integrityLevel — Process context integrity level.
• ANYRUN.SandboxAnalysis.processes.context.rebootNumber — Process context reboot number.
• ANYRUN.SandboxAnalysis.processes.versionInfo.version — Process version.
• ANYRUN.SandboxAnalysis.processes.versionInfo.description — Process description.
• ANYRUN.SandboxAnalysis.processes.versionInfo.company — Process company.
• ANYRUN.SandboxAnalysis.processes.mainProcess — Process main process.
• ANYRUN.SandboxAnalysis.processes.fileType — Process file type.
• ANYRUN.SandboxAnalysis.processes.fileName — Process filename.
• ANYRUN.SandboxAnalysis.processes.commandLine — Process cmd.
• ANYRUN.SandboxAnalysis.processes.image — Process image.
• ANYRUN.SandboxAnalysis.processes.uuid — Process uuid.
• ANYRUN.SandboxAnalysis.processes.ppid — Process PPID.
• ANYRUN.SandboxAnalysis.processes.important — Process important.
• ANYRUN.SandboxAnalysis.processes.pid — Process PID.
• ANYRUN.SandboxAnalysis.processes.exitCode — Process exit code.
• ANYRUN.SandboxAnalysis.processes.times.terminate — Process time terminate.
• ANYRUN.SandboxAnalysis.processes.times.start — Process time start.
• ANYRUN.SandboxAnalysis.processes.resolvedCOM.title — Process resolved COM title.
• ANYRUN.SandboxAnalysis.processes.synchronization.operation — Process sync operation.
• ANYRUN.SandboxAnalysis.processes.synchronization.type — Process sync type.
• ANYRUN.SandboxAnalysis.processes.synchronization.name — Process sync name.
• ANYRUN.SandboxAnalysis.processes.synchronization.time — Process sync time.
• ANYRUN.SandboxAnalysis.processes.modules.image — Process module image.
• ANYRUN.SandboxAnalysis.processes.modules.time — Process module time.
• ANYRUN.SandboxAnalysis.processes.scores.monitoringReason — Process monitoring reason.
• ANYRUN.SandboxAnalysis.processes.times.monitoringSince — Process monitoring since.
• ANYRUN.SandboxAnalysis.counters.synchronization.type.event — Process sync event.
• ANYRUN.SandboxAnalysis.counters.synchronization.type.mutex — Process sync mutex.
• ANYRUN.SandboxAnalysis.counters.synchronization.operation.create — Process sync operation create.
• ANYRUN.SandboxAnalysis.counters.synchronization.operation.open — Process sync operation open.
• ANYRUN.SandboxAnalysis.counters.synchronization.total — Process sync total.
• ANYRUN.SandboxAnalysis.counters.registry.delete — Registry delete.
• ANYRUN.SandboxAnalysis.counters.registry.write — Registry write.
• ANYRUN.SandboxAnalysis.counters.registry.read — Registry reed.
• ANYRUN.SandboxAnalysis.counters.registry.total — Registry total.
• ANYRUN.SandboxAnalysis.counters.files.malicious — File malicious count.
• ANYRUN.SandboxAnalysis.counters.files.suspicious — File suspicious count.
• ANYRUN.SandboxAnalysis.counters.files.text — File text.
• ANYRUN.SandboxAnalysis.counters.files.unknown — File unknown count.
• ANYRUN.SandboxAnalysis.counters.network.threats — Network threats count.
• ANYRUN.SandboxAnalysis.counters.network.dns — Network dns count.
• ANYRUN.SandboxAnalysis.counters.network.connections — Network connections count.
• ANYRUN.SandboxAnalysis.counters.network.http — Network networks count.
• ANYRUN.SandboxAnalysis.counters.processes.malicious — Malicious processes count.
• ANYRUN.SandboxAnalysis.counters.processes.suspicious — Suspicious processes count.
• ANYRUN.SandboxAnalysis.counters.processes.monitored — Monitored processes count.
• ANYRUN.SandboxAnalysis.counters.processes.total — Total processes count.
• ANYRUN.SandboxAnalysis.environments.hotfixes.title — Environment hotfixes title.
• ANYRUN.SandboxAnalysis.environments.software.version — Environment software version.
• ANYRUN.SandboxAnalysis.environments.software.title — Environment software title.
• ANYRUN.SandboxAnalysis.environments.internetExplorer.kbnum — Environment Internet Explorer KBNUM.
• ANYRUN.SandboxAnalysis.environments.internetExplorer.version — Environment Internet Explorer version.
• ANYRUN.SandboxAnalysis.environments.os.bitness — Environment OS version.
• ANYRUN.SandboxAnalysis.environments.os.softSet — Environment OS software set.
• ANYRUN.SandboxAnalysis.environments.os.servicePack — Environment OS service pack.
• ANYRUN.SandboxAnalysis.environments.os.major — Environment OS major version.
• ANYRUN.SandboxAnalysis.environments.os.productType — Environment OS product type.
• ANYRUN.SandboxAnalysis.environments.os.variant — Environment OS variant.
• ANYRUN.SandboxAnalysis.environments.os.product — Environment OS product.
• ANYRUN.SandboxAnalysis.environments.os.build — Environment OS build.
• ANYRUN.SandboxAnalysis.environments.os.title — Environment OS title.
• ANYRUN.SandboxAnalysis.analysis.content.dumps — Content dumps.
• ANYRUN.SandboxAnalysis.analysis.content.screenshots.thumbnailUrl — Screenshots thumbnail url.
• ANYRUN.SandboxAnalysis.analysis.content.screenshots.permanentUrl — Screenshots permanent url.
• ANYRUN.SandboxAnalysis.analysis.content.screenshots.time — Screenshots time.
• ANYRUN.SandboxAnalysis.analysis.content.screenshots.uuid — Screenshots uuid.
• ANYRUN.SandboxAnalysis.analysis.content.sslkeys.present — SSL keys present.
• ANYRUN.SandboxAnalysis.analysis.content.pcap.permanentUrl — Pcap dump permanent url.
• ANYRUN.SandboxAnalysis.analysis.content.pcap.present — Pcap present.
• ANYRUN.SandboxAnalysis.analysis.content.video.permanentUrl — Video permanent url.
• ANYRUN.SandboxAnalysis.analysis.content.video.present — Video present.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.ssdeep — Main object ssdeep.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha256 — Main object sha256.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.sha1 — Main object sha1.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.hashes.md5 — Main object md5.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.url — Main object url.
• ANYRUN.SandboxAnalysis.analysis.content.mainObject.type — Main object type.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.knownThreat — Specs known threat.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.malwareConfig — Specs malware Config.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.notStarted — Specs not started.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.privEscalation — Specs priv escalation.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.torUsed — Specs TOR used.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.suspStruct — Specs susp structure.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.stealing — Specs stealing.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.staticDetections — Specs static detections.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.spam — Specs spam.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.serviceLauncher — Specs service launcher.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.rebooted — Specs rebooted.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.networkThreats — Specs network threats.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.networkLoader — Specs network loader.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.multiprocessing — Specs multiprocessing.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.memOverrun — Specs memory overrun.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.lowAccess — Specs low access.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.exploitable — Specs exploitable.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.executableDropped — Specs executable dropped.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.debugOutput — Specs debug output.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedTask — Specs crashed task.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.crashedApps — Specs crashed apps.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.cpuOverrun — Specs CPU overrun.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.autoStart — Specs suto start.
• ANYRUN.SandboxAnalysis.analysis.scores.specs.injects — Specs injects.
• ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevelText — Verdict threat level text.
• ANYRUN.SandboxAnalysis.analysis.scores.verdict.threatLevel — Verdict threat level.
• ANYRUN.SandboxAnalysis.analysis.scores.verdict.score — Verdict score.
• ANYRUN.SandboxAnalysis.analysis.options.automatization.uac — Options automatization UAC.
• ANYRUN.SandboxAnalysis.analysis.options.privateSample — Options private sample.
• ANYRUN.SandboxAnalysis.analysis.options.privacy — Options privacy.
• ANYRUN.SandboxAnalysis.analysis.options.network — Options network.
• ANYRUN.SandboxAnalysis.analysis.options.hideSource — Options hide source.
• ANYRUN.SandboxAnalysis.analysis.options.video — Options video.
• ANYRUN.SandboxAnalysis.analysis.options.presentation — Options presentation.
• ANYRUN.SandboxAnalysis.analysis.options.tor.used — Options tor used.
• ANYRUN.SandboxAnalysis.analysis.options.mitm — Options MITM proxy.
• ANYRUN.SandboxAnalysis.analysis.options.heavyEvasion — Options kernel heavy evasion.
• ANYRUN.SandboxAnalysis.analysis.options.fakeNet — Options fake network.
• ANYRUN.SandboxAnalysis.analysis.options.additionalTime — Options additions time.
• ANYRUN.SandboxAnalysis.analysis.options.timeout — Options timeout.
• ANYRUN.SandboxAnalysis.analysis.tags — Analysis tags.
• ANYRUN.SandboxAnalysis.analysis.stopExecText — Analysis stopExecText.
• ANYRUN.SandboxAnalysis.analysis.stopExec — Analysis creation stopExec.
• ANYRUN.SandboxAnalysis.analysis.creationText — Analysis creation creation text.
• ANYRUN.SandboxAnalysis.analysis.creation — Analysis creation date.
• ANYRUN.SandboxAnalysis.analysis.duration — Analysis duration.
• ANYRUN.SandboxAnalysis.analysis.sandbox.plan.name — Analysis sandbox user plan name.
• ANYRUN.SandboxAnalysis.analysis.sandbox.name — Analysis sandbox name.
• ANYRUN.SandboxAnalysis.analysis.reports.graph — Analysis reports graph.
• ANYRUN.SandboxAnalysis.analysis.reports.STIX — Analysis STIX report url.
• ANYRUN.SandboxAnalysis.analysis.reports.HTML — Analysis HTML report url.
• ANYRUN.SandboxAnalysis.analysis.reports.MISP — Analysis MISP report url.
• ANYRUN.SandboxAnalysis.analysis.reports.IOC — Analysis IOC report url.
• ANYRUN.SandboxAnalysis.analysis.permanentUrl — Analysis permanent url.
• ANYRUN.SandboxAnalysis.analysis.uuid — Analysis uuid.
• ANYRUN.SandboxAnalysis.status — Analysis status.
• ANYRUN.SandboxAnalysisReportVerdict — The analysis verdict.
• ANYRUN_DetonateUrlAndroid.TaskID — Task UUID.
• ANYRUN_DetonateUrlLinux.TaskID — Task UUID.
• ANYRUN_DetonateUrlWindows.TaskID — Task UUID.

Commands used

• joe-submit-url
• opswat-filescan-scan-url