Full list of VirusTotal Intelligence behaviour

One of the search modifiers available in VirusTotal Intelligence is behaviour_tags or behaviour_tag . This modifier will search for files tagged with the literal provided due to their behaviour while being executed in our sandboxes.

Here is the full list of tags supported:


big_upstream	calls_wmi	checks_bios	checks_cpu_name
checks_disk_space	checks_gps	checks_hostname	checks_memory_available
checks_network_adapters	checks_pci_bus	checks_usb_bus	checks_user_input
clipboard	crypto	decrypts_exe	detect_debug_environment
direct_cpu_clock_access	eval_function	executes_dropped_file	ftp_communication
hosts_modifier	idle	installs_browser_extension	irc_communication
listens	long_sleeps	macro_anti_analysis	macro_copy_file
macro_create_dir	macro_create_file	macro_create_ole	macro_download_url
macro_enum_windows	macro_environ	macro_handle_file	macro_hide_app
macro_open_file	macro_powershell	macro_registry	macro_run_dll
macro_run_file	macro_save_workbook	macro_send_keys	macro_write_file
mysql_communication	obfuscated	password_dialog	persistence
qr_code	reflection	repeated_clock_access	runtime_modules
self_delete	sends_sms	service_scan	sets_process_name
smtp_communication	ssh_communication	sudo	suspicious_dns
suspicious_udp	telephony	telnet_communication	tunneling