Malware Detection

The Swimlane Malware Detection Connector provides basic tools to aid in malware detection.

Capabilities

This Connector provides the following capabilities:

Swimlane Malware Detection YARA Check

Tasks Setup

To run the YARA Scan task, you must write a yara rule which can either be sent to the integration as a file or a string.

Example:

rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        threat_level = 3
        in_the_wild = true
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
    condition:
        $a or $b or $c
}

Actions

Swimlane Malware Detection YARA Check

Swimlane connector with general malware detection tools. Scan strings or files using a YARA Rule.

Input

Argument Name	Type	Required	Description
yara_rule	string	Required	Either a file or a string containing a YARA Rule.
suspicious_data	string	Required	File or string of suspicious data.

Input Example

{"yara_rule":"rule foo: bar {strings: $a = \"lmn\" condition: $a}","suspicious_data":"lmn"}

Output

Parameter	Type	Description
matches	array	Output field: matches
matches.rule	string	Output field: matches.rule
matches.namespace	string	Name of the resource
matches.strings	array	Output field: matches.strings
matches.tags	array	Output field: matches.tags
matches.meta	string	Output field: matches.meta
matches.no_results	boolean	Result of the operation
no_matches	boolean	Output field: no_matches

Output Example

{"matches":[{"rule":"foo","namespace":"default","strings":[],"tags":[],"meta":"{}","no_results":false}],"no_matches":true}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT