Introducing Autocomplete for VirusTotal Intelligence queries

 TL;DR: We implemented an Autocomplete feature for VirusTotal Intelligence queries 

VirusTotal Intelligence is one of the most powerful, flexible and intuitive tools for security researchers around the world. It was designed with the idea of providing (almost) unlimited possibilities to VirusTotal users when searching across the VirusTotal dataset at Google speed ©. Most of the time our users simply search for some observable (hash, domain, IP address or URL) to get everything we know about it, however there are more than 50 modifiers that can be used (and combined) in any query to get what we are exactly looking for.

This is a very real need. Let’s say we search for a given string we know is related to some malware family, returning a few thousand results. How to further specify where we want this string to be found inside the sample? Should it be in the content of the malware, in its metadata, maybe in a signature? You get the idea, and this is not limited to string searches. You can check malware with a certain number of positive verdicts, seen during a particular time window, signed with a given key, triggering a specific crowdsourced YARA rule, etc. Our 2019 VirusTotal for investigators workshop (you can find the video here) dives into some interesting search modifier use cases. Here you can find a full list of Intelligence modifiers you can use in your queries, understanding and using them in your queries provides analysts with an incredibly powerful resource. 

 However, learning them by heart is not easy. At VirusTotal we spend most of our time dealing with them and still we hesitate from time to time. That’s why we implemented an Autocomplete feature that will offer you different possibilities on what modifier to use depending on what you are typing:

Even if you are already an expert, this will save you some time by tabbing your way around the query. For the modifiers that require a value, we will also provide you with all the possibilities:

The Autocomplete Intelligence suggestions are based on a static list where we include all (syntactically correct) modifiers you can use in any query. We also added some interesting popular queries you might consider using, hopefully providing some inspiration for your searches.

The new Autocomplete is part of our pack of features designed to help security researchers working with VirusTotal Intelligence. As always, we are glad to hear your suggestions and feedback to keep improving.

Happy hunting!