---
title: Malware Detection
slug: connectors/malware-detection
docTags: 
createdAt: 2026-06-09T16:29:38.649Z
---

The Swimlane Malware Detection Connector provides basic tools to aid in malware detection.

## Capabilities

This Connector provides the following capabilities:

- Swimlane Malware Detection YARA Check

## Tasks Setup

To run the YARA Scan task, you must write a [yara rule](https://yara.readthedocs.io/en/stable/) which can either be sent to the integration as a file or a string.

Example:

```markdown
rule silent_banker : banker
{
    meta:
        description = "This is just an example"
        threat_level = 3
        in_the_wild = true
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
    condition:
        $a or $b or $c
}
```

# Actions

## Swimlane Malware Detection YARA Check

Swimlane connector with general malware detection tools. Scan strings or files using a YARA Rule.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                   |
| ----------------- | -------- | ------------ | ------------------------------------------------- |
| `yara_rule`       | string   | Required     | Either a file or a string containing a YARA Rule. |
| `suspicious_data` | string   | Required     | File or string of suspicious data.                |

### Input Example

`{"yara_rule":"rule foo: bar {strings: $a = \"lmn\" condition: $a}","suspicious_data":"lmn"}`

### Output

| **Parameter**        | **Type** | **Description**               |
| -------------------- | -------- | ----------------------------- |
| `matches`            | array    | Output field: matches         |
| `matches.rule`       | string   | Output field: matches.rule    |
| `matches.namespace`  | string   | Name of the resource          |
| `matches.strings`    | array    | Output field: matches.strings |
| `matches.tags`       | array    | Output field: matches.tags    |
| `matches.meta`       | string   | Output field: matches.meta    |
| `matches.no_results` | boolean  | Result of the operation       |
| `no_matches`         | boolean  | Output field: no\_matches     |

### Output Example

`{"matches":[{"rule":"foo","namespace":"default","strings":[],"tags":[],"meta":"{}","no_results":false}],"no_matches":true}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |