Process trees in Livehunt: YARA rules that know who launched what

Note: YARA-X v1.21.0 adds a parent_name field to the items in vt.behaviour.processes_list, and v1.22.0 adds ancestor_names. VirusTotal now fills that list for every sandbox report that includes a process tree, by flattening it. The result is one entry per process, and each entry knows the name of the process that created it and of the processes... Weiterlesen: Process trees in Livehunt: YARA rules that know who launched what