{"id":13842621,"url":"https://github.com/Neo23x0/vti-dorks","last_synced_at":"2025-07-11T15:32:19.301Z","repository":{"id":41067114,"uuid":"163669434","full_name":"Neo23x0/vti-dorks","owner":"Neo23x0","description":"Awesome VirusTotal Intelligence Search Queries","archived":false,"fork":false,"pushed_at":"2023-05-16T07:49:17.000Z","size":43,"stargazers_count":327,"open_issues_count":2,"forks_count":49,"subscribers_count":27,"default_branch":"master","last_synced_at":"2024-10-28T19:55:58.579Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Neo23x0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2018-12-31T13:01:08.000Z","updated_at":"2024-10-21T16:28:16.000Z","dependencies_parsed_at":"2024-01-31T03:48:30.609Z","dependency_job_id":"d234463f-cd8e-463c-bd6b-b2aa5ad2f132","html_url":"https://github.com/Neo23x0/vti-dorks","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2Fvti-dorks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2Fvti-dorks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2Fvti-dorks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Neo23x0%2Fvti-dorks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Neo23x0","download_url":"https://codeload.github.com/Neo23x0/vti-dorks/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225736954,"owners_count":17516259,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:41.445Z","updated_at":"2024-11-21T13:30:46.254Z","avatar_url":"https://github.com/Neo23x0.png","language":null,"funding_links":[],"categories":["Others (1002)","Others"],"sub_categories":[],"readme":"# vti-dorks\nAwesome VirusTotal Enterprise Search Queries (formerly Virustotal Intelligence or VTI) \n\n## Purpose\n\nThis repo lists useful Virustotal Enterprise search queries that are useful for threat hunting purposes. Please provide your favorite search queries as pull requests. \n\n## Generic\nShow uploads named \"payload\" that have less than 5 antivirus eignes detecting them.\n```\nname:payload positives:5-\n```\nShow uploads named \"exploit\" that have less than 5 antivirus eignes detecting them. False positives are PDFs, web pages or documents with exploit descriptions.\n```\nname:exploit positives:5-\n```\nShow uploads that contain the keyword \"obfus\" in the filename and exclude android samples. (android samples obstruct view) The keyword \"obfus\" is often found in obfuscated malware samples. \n```\nname:obfus NOT tag:android\n```\nShow executable files that identify as Microsoft software but are packed with an unusual packer and have less than 10 positive antivirus matches\n```\nmetadata:\"Microsoft Corporation\" AND tag:peexe AND ( packer:rar OR packer:upx OR packer:themida OR packer:asprox ) AND positives:10-\n```\nUnknown origin - no description yet \n```\nname:myvtfile.exe\n```\nMalware hosted on a government URL\n```\nitw:\".gov\" positives:5+\n```\nFind PE files submitted to VT, within n-seconds of compilation, that trigger at least 5 detections\n```\nsubspan:300- positives:5+\n```\nYou can tune it a bit using:\n`submitter:US` - US submitter\n`submitter:web` - web submitter\n`submissions:2-` - submitted less then 2 times\n\n## Mimikatz\n\nShow samples with filenames starting with \"mimi\" (rare) that have less than 5 antivirus engines with matches. \n```\nname:mimi* positives:5-\n```\nShow samples with filenames ending with \"katz.exe\" (rare) that have less than 5 antivirus engines with matches. \n```\nname:*katz.exe positives:5-\n```\nShow samples with some antivirus engines matches. These are often obfuscated Mimikatz variants.\n```\nengines:mimikatz positives:5-\n```\n\n## Special Threat Related\n\nExample way to find Shamoon using the resource names:\n```\nresource:\"PKCS7\" and resource:\"X509\"\n```\nReference: https://unit42.paloaltonetworks.com/unit42-shamoon-2-return-disttrack-wiper/\n\n## Location Based\nShow samples submitted from Germany with low antivirus coverage that could be successful phishing campaigns.  \n```\nsubmitter:DE positives:2+ positives:10- (tag:doc OR tag:docx)\n```\nShow samples submitted from Taiwan with low antivirus coverage that could be successful NEW phishing campaigns (only 1 submitter).  \n```\nsubmitter:TW positives:1+ positives:20- filename:*.eml submissions:1\n```\nMalicious submissions from Qatar are rare and often interesting if you're after threats in the Middle Eastern region. \n```\nsubmitter:QA positives:2+\n```\nShow samples submitted from Israel with the keyword \"Syria\" in the filename that have 2 or more antivirus engines matching. \n```\nsubmitter:IL name:syria positives:2+\n```\n\n## macOS\nHunting signed macOS DMGs with minimum detections (often caused by heuristics) \n```\nls:2019-01-16+ type:dmg positives:2+ tag:signed\n```\n## ELF\nHunting for ELF binaries belonging to the MIRAI family\n```\ntag:elf AND p:2+ AND engines:Mirai\n```\nHunting for ELF binaries excluding MIRAI and DDOS malware\n```\ntag:elf AND p:5+ NOT engines:Mirai NOT engines:DDOS\n```\n\n## Sandbox result searches\nVTi has several Sandboxes that will scan the behavior of the submitted files; searching for categories combined with tags can be useful.\n\nSearch for ransomware using the Lastline sandbox:\n```\nlastline:RANSOM \n```\nSearching for stealers in the pe format on C2AE sandbox. (STEALER/MALWARE/TROJAN are some keywords used by this sandbox)\n```\nc2ae:STEALER and tag:peexe\n```\n\n## Content Searches (New Feature)\n\nContent searches cannot be combined with other conditions. \n\nSearch for well-known mimikatz keyword in any type of sample. \n```\ncontent:\"sekurlsa::logonpasswords\"\n```\nDetects phishing documents that ask the user to activate macros\n```\ncontent:\"click enable editing\"\ncontent:\"click enable content\"\n```\nDetects exploit codes \n```\ncontent:\"] Shellcode\"\n```\n\n## Sample Similarities and Pivoting\n\nContent searches for malware similarities.\n\nVT Feature Hash is an internal hash used by Virustotal.\n```\nsimilar-to:\u003chashofthefile\u003e\n```\n\nCode Blocks is used to look for samples that contain the same pieces of code.\n```\ncode-similar-to:\u003chashofthefile\u003e\n```\n\nImpHash is a well-known hash calculated with the Import Address Table to identify samples using the same imported functions.\n```\nimphash:\u003cIATHash\u003e\n```\n\nPE Rich Hash is a hash calculated from Rich Header.\n```\nrich_pe_header_hash:\u003cRichhash\u003e\n```\n\nTLSH is used to generate hash values which can then be analyzed for similarities.\n```\ntlsh:\u003ctlshash\u003e\n```\n\nSSDEEP is a fuzzing algorithm that can be used for the same purpose. \n```\nssdeep:\u003cssdeep_hash\u003e\n```\n\nThe other functions are used to identify similarity based on behavior identified with sandbox analysis. \n```\nbehash:\u003chashofthefile\u003e\n```\n\nFiles with a visually similar icon or thumbnail.\n```\nmain_icon_dhash:\u003cicon_hash\u003e\n```\n\n.NET files that were built in one project have the same GUID value\n```\nnetguid:\u003cGUID\u003e\n```\n\nPermhash is used to hash the declared permissions applied to Chromium-based browser extensions and APKs\n```\npermhash:\u003cpermhash\u003e\n```\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNeo23x0%2Fvti-dorks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FNeo23x0%2Fvti-dorks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNeo23x0%2Fvti-dorks/lists"}