{
  "id": "malware_detection_name",
  "kind": "datatype",
  "status": "draft",
  "name": "Antivirus detection name",
  "doc": "Name that an antivirus or anti-malware engine gives to the threat it detects in a file, URL or process, as shown in scan results, quarantine logs and the per-engine results of VirusTotal (last_analysis_results.result). Every vendor has its own scheme: most build on the CARO naming convention of type, platform, family and variant, but the order, separators and suffixes differ, and generic or machine-learning detections carry no family. The same file therefore gets different names from different engines; VirusTotal counts the tokens of these names to suggest one threat label (popular_threat_classification). The format is not fixed, so there is no regexp.",
  "children": [
    "microsoft_malware_name"
  ],
  "is_pii": false,
  "categories": [
    "software"
  ],
  "langs": [
    "common"
  ],
  "classification": "categorical",
  "examples": [
    {
      "value": "Gen:Variant.Marsilia.217465",
      "description": "BitDefender detection of a .NET trojan sample in VirusTotal",
      "valid": true
    },
    {
      "value": "MSIL/Agent.YUF Trojan",
      "description": "ESET-NOD32 detection of the same sample",
      "valid": true
    },
    {
      "value": "Backdoor.Win32.Xkcp.eas",
      "description": "Kaspersky detection of the same sample",
      "valid": true
    },
    {
      "value": "Trojan:Win32/Wacatac.B!ml",
      "description": "Microsoft detection of the same sample (microsoft_malware_name)",
      "valid": true
    }
  ],
  "links": [
    {
      "type": "other",
      "url": "https://virustotal.readme.io/reference/files"
    },
    {
      "type": "doc",
      "url": "https://learn.microsoft.com/en-us/defender-xdr/malware-naming"
    }
  ],
  "quality": {
    "score": 50,
    "missing": [
      "regexp",
      "negative example",
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/software/malware_detection_name.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/software/malware_detection_name.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/malware_detection_name.yaml"
  },
  "urls": {
    "html": "https://registry.apicrafter.io/datatype/malware_detection_name",
    "json": "https://registry.apicrafter.io/api/v1/datatypes/malware_detection_name.json"
  }
}