MalwareBazaar metadata query

malware_bazaar_hash_query

Queries abuse.ch's MalwareBazaar API for recently submitted samples and records the hashes and family labels it returns. Metadata only: no sample is requested, so nothing malicious touches this host. What is measured is whether the host can reach a malware repository at all.

Severity low how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1588.001	Obtain Capabilities: Malware	Resource Development	coverage statistics
T1596	Search Open Technical Databases	Reconnaissance	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other malware samples tests

Other tests in the Malware samples category.
Test	What it does	Severity
Live malware sample download and unpack malware_bazaar_live_sample	Downloads real malware samples from MalwareBazaar as password-protected ZIP archives and unpacks them into the sandbox, to see whether the download or…	critical
Offensive tooling download (mimikatz) offensive_tool_download	Downloads mimikatz and two PowerSploit scripts to a temporary file to see whether the proxy, DNS filter or on-access scanner intervenes. The files are…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.