Full list of VirusTotal Intelligence behaviour

One of the search modifiers available in VirusTotal Intelligence is behaviour_tags or behaviour_tag . This modifier will search for files tagged with the literal provided due to their behaviour while being executed in our sandboxes.

Here is the full list of tags supported:


detect_debug_environment	direct_cpu_clock_access	long_sleeps	self_delete
hosts_modifier	installs_browser_extension	password_dialog	sudo
persistence	sends_sms	checks_gps	ftp_communication
ssh_communication	telnet_communication	smtp_communication	mysql_communication
irc_communication	suspicious_dns	suspicious_udp	big_upstream
tunneling	crypto	telephony	runtime_modules
reflection