--- id: "microsoft_malware_name" kind: "datatype" status: "draft" is_pii: false categories: ["software"] langs: ["common"] quality: 68 url: "https://registry.apicrafter.io/datatype/microsoft_malware_name" --- # Microsoft malware name (`microsoft_malware_name`) > **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions. Name that Microsoft Defender and other Microsoft anti-malware products give to a detected threat, following the CARO scheme in the form Type:Platform/Family.Variant!Suffix. Type says what the threat does (Trojan, Backdoor, Ransom, HackTool, PUA and others), Platform names the operating system, script language, macro type or file format it targets (Win32, AndroidOS, MSIL, O97M), Family groups related samples, the Variant letters are assigned in sequence (.A, .B, ... .AF), and a suffix after ! is an internal Microsoft indicator. VirusTotal shows it as the result of the Microsoft engine. - Parent datatype: `malware_detection_name` - Personal data (PII): no - Categories: Software development (software) - Countries: global - Languages: Common to most languages (common) - Classification: categorical ## Detection Regular expression (Python `re`): ``` ^[A-Za-z]+:[A-Za-z0-9_]+/[A-Za-z0-9_-]+(?:\.[A-Za-z0-9]+)*(?:![A-Za-z0-9]+)?$ ``` ## Examples - `Trojan:Win32/Wacatac.B!ml` โ€” Microsoft detection of a .NET trojan sample in VirusTotal - `Gen:Variant.Marsilia.217465` (invalid example) โ€” BitDefender name, which has no platform part after a slash - `MSIL/Agent.YUF Trojan` (invalid example) โ€” ESET-NOD32 name, with the type after the name ## Sources - doc: ## Quality Score 68/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage. JSON: ยท Edit: