Metacrafter Registry

Datatypes

Antivirus detection name

ID malware_detection_name

DatatypeNot PIIcategoricalDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Name that an antivirus or anti-malware engine gives to the threat it detects in a file, URL or process, as shown in scan results, quarantine logs and the per-engine results of VirusTotal (last_analysis_results.result). Every vendor has its own scheme: most build on the CARO naming convention of type, platform, family and variant, but the order, separators and suffixes differ, and generic or machine-learning detections carry no family. The same file therefore gets different names from different engines; VirusTotal counts the tokens of these names to suggest one threat label (popular_threat_classification). The format is not fixed, so there is no regexp.

Categories
Software development
Countries
Global (not tied to a country)
Languages
Common to most languages
Quality
50/100 · missing: regexp, negative example, mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules
no detection rule yet
Supported by tools
no tool record lists this type yet

Examples

ValueDescription
Gen:Variant.Marsilia.217465BitDefender detection of a .NET trojan sample in VirusTotal
MSIL/Agent.YUF TrojanESET-NOD32 detection of the same sample
Backdoor.Win32.Xkcp.easKaspersky detection of the same sample
Trojan:Win32/Wacatac.B!mlMicrosoft detection of the same sample (microsoft_malware_name)

Child datatypes

IDNameCategoriesCountriesDescription
microsoft_malware_name Microsoft malware name draft software global Name that Microsoft Defender and other Microsoft anti-malware products give to a detected threat, following the CARO scheme in the form...

Sources

Use this record