Forum Discussion

genckelmendi's avatar
genckelmendi
Copper Contributor
Apr 09, 2023

Advanced hunting that queries VirusTotal detections

MDATP supports VirusTotal detection ratio for most executions. But how to query VirusTotal details using advanced hunting? For example,

 

DeviceProcessEvents

| where VirusTotalDetections > 5

 

How to extract and translate the "VirusTotal detection ratio" parameter from execution GUI tree to advanced hunting query? Thank you.

    • cyb3rmik3's avatar
      cyb3rmik3
      Iron Contributor

      Interesting question genckelmendi. It seems that this information is not being parsed and is being presented "as/is" given that it is a dynamic value (detection ratio is not static) updated each time the page loads.

       

      Be that as it may, I would place my bet that this information would be found in AlertEvidence table, which I checked, but AdditionalFields doesn't seem to have this information.

       

      :sad:

       

      If I have answered your question, please mark your post as Solved

      If you like my response, please consider giving it a like

      • genckelmendi's avatar
        genckelmendi
        Copper Contributor

        Thank you cyb3rmik3 , likewise I still haven't found a way around this. By dynamic, you mean that MDATP requests detection ratio from VT each time it loads process tree?

Resources