3.4. Automated Analysis

While data is being imported into Cyber Triage, the automated analysis begins. The artifacts traverse down automated analysis pipelines so that they can be scored as Bad, Suspicious, Good, or Unknown.

Cyber Triage uses various sources of threat intelligence to score the artifacts. This section outlines the various methods and configurations that maybe required.

3.4.1. Executable Malware Analysis

A Cyber Triage license comes with access to 40+ malware scanning engines through our Internet-based API. You will be prompted to use this for each host that you add. Our API is backed by Reversing Labs.

If you are offline, you can manually upload file hashes. See Offline Malware Scanning.

Note

There are two malware scanning services with Cyber Triage. To use the Recorded Future Sandbox, you will manually upload a file. It does not happen automatically. See Scanning Files in the Recorded Future Sandbox. Note that this service has different privacy terms than the malware analysis methods.

3.4.1.1. What is Analyzed

For privacy reasons, Cyber Triage does not send all files for malware scanning. Only the following are:

• Executable PE files, such as .exe and .dll files

• Files that are under the malware scanning size limit from Reversing Labs

• Files not found in a local copy of the NSRL

• Files not found in a local cache of previous lookups. These results can be flushed at any time and no guarantee is made about how long results will reside.

3.4.1.2. Initial Setup

No setup is required except to make sure that Cyber Triage can communicate with our servers. Refer to Listening Ports for specific host names.

3.4.1.3. Malware Analysis Settings

Malware analysis is configured when adding a host or you can rescan files later.

You will be prompted to choose how the files will be analyzed for malware.

Malware Analysis Options

Query Using Hashes: This will send only a cryptographic hash (SHA256, MD5, etc.) of the files to the service. If the service previously analyzed this file and has results, they will be returned.

Note that any minor change to malware will change its hash and it will not be flagged as malware using this technique.

If the file’s hash is not known to Cyber Triage, then you need to decide what you want the application to do:

• Upload to server for analysis: This will send the full file to the service for analysis. The raw content will not be visible to others. The analysis results will be available to other ReversingLabs customers though if they happen to query for the same hash value.

• Query ImpHash to find similar files: This will use a fuzzy match algorithm called ImpHash, which is based on executable import tables, to look at similar executables that were already analyzed and identify if any of them were identified as malware.

• Mark file as suspicious: This will mark all ‘unknown’ files as suspicious so that you can manually review each of them. You will have the option to upload individual files afterwards by selecting the file and choosing an “Upload” option.

• Do nothing: Ignore the unknown files.

The panel also shows a Local Analysis section confirming that local Yara rules and the local NIST NSRL/cached analysis results will be used, in addition to whatever online option you choose above.

3.4.1.3.1. Common Privacy Questions

Because some responders are sensitive about uploading files and how it could be associated with them, here are some notes about common questions:

• When you query by SHA256/MD5 or ImpHash hash value, there is no link stored between your organization and the hash value.

• Only EXE and DLL files can be uploaded. This reduces a PII leak risk.

• No one else can download the uploaded files.

• Only other commercial ReversingLabs customers will have access to the analysis results if they query based on hash value. ReversingLabs does not have a public API.

3.4.1.3.2. ImpHash Results

ImpHash is a fuzzy matching algorithm that can be quite powerful if you do not want to upload content. But, it is not as precise as using a cryptographic hash such as SHA-256 or MD5.

ImpHash works by looking at the “import table” of an executable file. This is where the file lists out which DLLs it is going to depend on. The theory behind ImpHash is that attackers may change a few bits in the file, but the import table stays the same. So, you can find variations of an attacker’s tools by relying on its ImpHash value.

Cyber Triage uses ImpHash to query Reversing Labs and it will return a list of SHA-256 hashes of files that it knows about that use the same import table. Cyber Triage then queries for the results of those files to see if any were previously identified as malicious.

There are some caveats:

• There are some ImpHash values that are shared by tens of thousands of files. Cyber Triage is not getting the results for all of those files. You would go through all of your hash lookups. Cyber Triage will examine a subset of them. In our experience, .Net applications will end up with the same ImpHash value.

• It is possible for some files with the same ImpHash to be identified as Bad and some as OK. In that case, Cyber Triage will mark this file as suspicious and the message will say what percentage of similar files were scored as bad.

3.4.1.4. Seeing Progress

You can see what files were analyzed or not by going to the host’s Overview tab and pressing Malware Scan Details under Status. The Analysis Status panel shows counts for files analyzed, pending, skipped, and more.

3.4.1.5. Types of Limits

Each license has a limit with respect to how many lookups and uploads can be done in a certain amount of time. The system has several dimensions to make it fair for all customers and to ensure you can finish examinations.

First, there are categories of analysis types, each with their own limits.

• Each Hash lookup will count towards your hash lookup category

• Each File upload and ImpHash Query will count towards the upload category.

Within each category, there are three types of limits to ensure you can analyze as many hosts as possible:

• Licensed Base - Each Cyber Triage license comes with a maximum number of hash lookups and file uploads that reset weekly. These are hard limits. For example, Standard Pro comes with 20,000 hash lookups per week.

• Licensed Flex - These allow you to go a bit over your licensed base limits to finish processing a host. Each license comes with 1,000 flex lookups to use over the course of a calendar month. You cannot analyze a host using only flex. You need to have at least one base or boost lookup to start and then flex will be used.

• Boost - You can purchase additional lookups and file uploads when you have big incidents and need to temporarily go beyond your usual limits. See the next section for details on adding and purchasing Boost codes.

When a host is added, Cyber Triage uses the limits in the following order:

• First, it uses any Licensed Base remaining in the current weekly period.

• Next, it uses any Boost codes that have been added. If there are multiple codes, it will first use the one that expires soonest.

• Lastly, it will use Licensed Flex.

At any point, you can see your usage by pressing Malware Scan Details under a host’s Status, then choosing the Online Cyber Triage Limits tab. It shows lookups/uploads used, reset frequency, and next reset date for each limit type, and has an Add Boost Code button.

This panel will also show you how many lookups on average you use. This can help you determine when you will run out, but of course every host is different and some require more lookups than others.

3.4.1.6. Adding a Boost Code

Boost codes are valid for 30-days after they are added to Cyber Triage.

• They can be used on only a single examiner system.

• When added to a Team deployment, all clients will use the Boost code (analysis is done on the server)

You can purchase a Boost code via credit card at CyberTriage.com.

Once you have the code, you can enter it in several places. Cyber Triage will prompt you before and after adding a host to let you know that you are low. If you did not get a prompt, you can either get to:

• Open the Options panel and navigate to “Automated Analysis” / “Malware”.

• Choose “View Status” .

• Then choose “Online Cyber Triage Limits” and press “Add Boost”.

You’ll enter a key that looks like either:

• b826a555-951f-42ca-86ce-439a81106688

• CT-8ed86eb5-17fc-4b3a-9b75-ce638c11b070

3.4.1.7. Resuming Malware Scanning

If you run out of malware lookups while analyzing a host, you have two options:

• Wait until your time period resets (usually weekly). You can determine this date from the Malware Details panel.

• Add the Boost code as outlined above now.

Once you have lookups available, open the host’s Overview tab, press the Restart Analysis button under Status, and choose Resume Malware Scan from the dialog. The software should also prompt you when you re-open the host and it did not previously complete the analysis.

The same dialog also has Restart Malware Scan, Restart Yara Scan, and Restart Bad List Scan buttons to fully re-run those specific analysis pipelines from scratch.

3.4.1.8. Offline Malware Scanning

If you run in an airgapped environment, you can still use the malware scanning service. The basic process is to wait for the ingest to finish and then export hashes to a text file that can be uploaded to our site.

• Go to the host’s Overview tab and press the Offline Malware button under Status.

Status

• On the Export Hashes tab, press the Export Hashes button and pick a folder.

Offline Analysis

• That will produce a JSON text file with the hashes and license information.

• You can then copy that file to an Internet-connected computer and upload it to https://rep1.cybertriage.com.
  Copy and paste the text file into that page.

Reputation Service

• It will download another JSON file that you can then copy back into Cyber Triage^® and import using the Import Malware Results tab of the same Offline Malware dialog that you used to export the original set of hashes.

3.4.1.9. Local Copy of NSRL

Cyber Triage^® will use its Online Malware Scanning Service by default to assign a threat score to files. The service uses the NIST NSRL to identify files that ship with known applications (such as Microsoft Windows). If you are not using the online service, you can configure a local copy of the NIST NSRL.

The steps to do this include:

1. Download the latest NSRL index. You will want the file named NSRL-version-computer-Autopsy.zip.

2. Unzip the file

3. Open the Cyber Triage^® Options panel and choose “Automated Analysis” / “NSRL”.

4. Enable Use Local NSRL, and browse to where you unzipped the .idx file to.

Options (Use Local NSRL)

3.4.1.10. Seeing Malware Scan Results

You can see the details of the malware scanning when you select an item that has a file, go to the “File” tab below and choose Malware.

You will see how many engines flagged it as malware. Some special notes:

• We are not allowed to display which engines thought it was malware. This is part of the agreement with ReversingLabs.

• We use feedback from ReversingLabs to know which engines are the most reliable. It is possible that you will see an item that has several engines that flagged the file, but it is not scored as bad. That is because they are not the highest quality engines.

You can always search VirusTotal for those files to see which of its engines flag the file.

3.4.2. Document Malware Analysis

Office and PDF files are common vectors for phishing attempts to gain initial access to systems. Cyber Triage has basic analysis methods for detecting suspicious documents. These files are not uploaded to ReversingLabs, like executables can be, because they may contain sensitive information.

Cyber Triage will review Office and PDF files and mark them suspicious if they have:

• Automatic actions that require no user interaction (such as those that occur when a document or page is opened)

• Scripts (JavaScript, Macros, etc.) with certain actions.

Please contact us for a more specific list.

3.4.3. Yara Signatures

Cyber Triage can use Yara rules identify files that have patterns that have been associated with malicious activity. This allows you to import threat intelligence rules that you created or that others shared.

3.4.3.1. Configure Yara Signatures

Cyber Triage has a folder where you can place Yara rules. You can find that folder by going to the Options panel and choosing “Automated Analysis” / “Yara”.

Options Panel

The default path is %localappdata%\cybertriage\config\yara_rules. However, this location can be changed by changing the data folder location in the Cyber Triage^® options panel. Use Copy to copy the path, or Open Rules Files Folder to open it directly.

Cyber Triage^® will not search sub directories for Yara files. If you would like to organize your Yara rules with sub directories, then you’ll need to have a Yara file in the root directory that uses an include statements to refer to the other files.

Note

You will not be able to import the entire Yara Rules GitHub repository. This repository has links between its .yar files and causes many false positives. You should copy in only the rules that you are searching for.

Note

You cannot use rules that use external variables. There is no way to currently pass that value into the rule. These are used in some rule sets, such as those from Thor (https://github.com/Neo23x0/signature-base).

Note

If you are looking for a smaller, curated set of Yara rules, consider Yara-Forge.

Cyber Triage^® uses libyara 3.8.1. Documentation can be found at: https://yara.readthedocs.io/en/v3.8.1/

3.4.3.1.1. File Location in Team Deployment

When running in a Team environment, nearly all of the Yara analysis happens on the server. The exception is memory images. Volatility is run within the client. So, if you are in a Team environment and adding memory images, you need to have the Yara rules in your local AppData folder.

3.4.3.2. What is Analyzed

Collected file content will be analyzed using the configured Yara rules in the analysis pipelines. Cyber Triage will score files as Bad if they match a Yara signature.

Each time a session is ingested or a Yara rescan is initiated Cyber Triage^® will take all .yar files in the above folder and compile them into a single compiled Yara file.

If a file matches a Yara signature and has not already been marked as malware, then it will get a Bad score and the rule name will be specified.

For memory images, the same Yara rules will be used by the yarascan Volatility module. Documentation to the yarascan Volatility module can be found here: https://github.com/volatilityfoundation/volatility/wiki/Command-Reference-Mal#yarascan

3.4.4. Configure Native AI

Cyber Triage can use GenAI (hosted on Cyber Triage’s servers, not used for training) to automatically summarize and enrich data during ingest. This is enabled by default; you can disable it from the Options panel, and it can also be overridden per-incident via the Incident AI Settings when creating an incident (see Creating an Incident).

Configure the global defaults from the Options panel under “AI” / “Native AI”:

• Summary: generates host- and incident-level summaries of the bad and suspicious items. Sends non-anonymized artifacts. Results are shown in the Host and Incident Overview panels.

• Enrichment: gets additional information about an individual artifact. Sends only anonymized data (no user names, times, or internal addresses). Results are shown in the right-hand item detail (Summary) panel, with fields such as Identification, Path, Risk Level, and Next Steps.

Native AI settings

Example GenAI Enrichment result in the item detail panel

By default, AI processing happens within Cyber Triage’s own Google Cloud account - the underlying AI vendor (Anthropic, OpenAI, etc.) does not see your data or prompts and cannot use them. Under Location, you can choose between Cyber Triage Cloud (cybertriage.com) or a Custom location.

The sibling “External AI (MCP)” options page lets you connect your own MCP client (such as Claude Desktop) to Cyber Triage - see Claude Desktop, Code, and other MCP Clients for how to enable and configure it.

3.4.5. Hayabusa

Cyber Triage integrates the open source Hayabusa (https://github.com/Yamato-Security/hayabusa) tool to analyze event logs. For most users, no configuration is required.

But, there are some options if you want to customize it:

• You can disable one of the Hayabusa rules so that it does not score an event log entry. To do this, add the ‘Rule ID’ that you want to suppress to the ‘exclude_rules.txt’ file. You can find that file by going to Options / Automated Analysis / Hayabusa. This change will take effect for hosts added after that change.

Options Panel - Hayabusa

• You can also add your own rules by placing .yml files into the ct_custom_rules folder in the same folder that is opened via the Options panel.

  • For details on how to create Hayabusa rules please refer to Hayabusa documentation (https://github.com/Yamato-Security/hayabusa-rules?tab=readme-ov-file#about-creating-rule-files).

  • Cyber Triage will only run Hayabusa rules with a rule status of “stable” or “test” as they are less false positive prone.

  • Cyber Triage will only apply scores to Hayabusa rules with a rule level of “critical” or “high” as they are less false positive prone.

  • Cyber Triage will create unscored events for Hayabusa rules with a rule level of “medium”. These events will have the rule details attached just like a scored event.

  • Cyber Triage does not currently support correlation rules at this time. All correlation rules in the Hayabusa rule repo are covered by custom Cyber Triage rules (password guessing/user enumeration)

  • NOTE: Cyber Triage does not blindly collect all event logs. It collects high value event logs which have full coverage of all Hayabusa rules. If you create a custom Hayabusa rule that targets a new event log you will need to create a custom Cyber Triage collection rule (Customize File Collection) to collect that event log before it can be processed by Cyber Triage.

3.4.6. Bad and Good Lists

Cyber Triage can use lists of indicators to identify a file as good or bad. You can import lists from threat intelligence feeds and manually add items during your analysis.

3.4.6.1. Configure Bad and Good Lists

The Options Panel has tabs for both Good and Bad Lists. From there, you can add and remove entries.

Bad List panel

3.4.6.1.1. Manually Adding a List Entry From Options

From within the appropriate Good or Bad List panel, you can choose New Entry to manually enter the relevant details. Choose a Scope of Global (applies to all future hosts) or Incident (applies only to future hosts in that incident), then a Type (e.g. Path) and the matching rule, an optional Description, and whether to score only when the path is used (such as in a startup program) or also when a file exists at that path.

Create a Bad List Entry

3.4.6.1.2. Importing Bad and Good Lists

You can bulk add Bad List items by pressing the Import button, choosing a Scope (Global or Incident), a Threat intelligence source, and a Type of entry (e.g. Path). Supported threat intelligence sources include:

• Cyber Triage Bad List CSV

• Openphish (for Bad List items)

• Cyber Triage Bad Items JSON (that was generated as a report from another Cyber Triage host).

Press Generate Sample File for an example of the expected CSV format.

Import Bad List

Use the Generate Sample File button to generate a sample CSV file to determine what columns need to exist.

3.4.6.1.3. Removing Bad and Good List Entries

One or more Good or Bad List entries can be removed from their respective tables by highlighting the entry and selecting Remove selected item(s).

3.4.6.1.4. Editing Lists From The Main UI

When analyzing host data, such as viewing all triggered tasks, you can add or remove the items from Good or Bad Lists. These options are available from the “…” menu.

To add an item to the Good List, choose the “…” menu and select Add to Good List, then choose Incident Level or Global Level.

Add Item to Good List

Similarly, you can remove Good List entries from the “…” menu by choosing Remove from Good List.

Remove Item from Good List

3.4.7. Configure Baselines (Gold Images)

To reduce false positives, you can configure a host as a ‘baseline’ and any of its contents will not be scored as bad or suspicious in future hosts.

Some important notes about baselines:

• Baselines are applied when a host is added. When you add a baseline, it will not be applied to already ingested hosts. Only future ones.

• If you add multiple baselines, they will all be applied to all future hosts. You cannot pick a specific one.

• Not all artifacts are included in a baseline. Only the following are:

  • Triggered Tasks

  • Processes

  • Connections

  • Listening Ports

  • Files that were collected (this does not include ALL files. Just the ones that were part of the triage collection).

To add a baseline host:

1. You must first add the host to Cyber Triage. For example:

   • Run the Collector on the live host, save the results to a file, and import it. See Collector Output.

   • Add a disk image of the gold image. See Disk Image.

2. After you have added the host, you can specify it as a baseline by going to the options panel and choosing ‘Automated Analysis’ / ‘Baseline Hosts’.

3. Then choose ‘New Baseline’ and select it from the dialog.

You do not need to do anything to use the baselines. They are all automatically applied to all future hosts that are added. Matching items will have a BASELINE_MATCH entry (green check mark) in their Analysis Results, noting which baseline it matched. This is one factor among possibly several analysis results for an item, so a baseline match does not guarantee the item will be scored as Good overall.

Technical Details: Cyber Triage is using the data in its correlation database for the baseline, not the original host database. You can delete the original host from Cyber Triage and still use it as a baseline as long as you do not also delete from the correlation database.

3.4.8. Previous Incidents

Cyber Triage tracks what items you manually scored as Bad and will ensure that they are marked as Bad in future hosts.

The propagation is done via an exact match algorithm, which often relies on file hashes. For example, if a file with the same name as a previously Bad item is seen again, then it will not get scored if the hash values are different.

If you are seeing false positives from this feature (because an item is no longer considered Bad), you can suppress future items from getting the Bad score by scoring it as Good in the current incident. Cyber Triage will then prompt you to see if you want to stop automatically scoring it in the future.

You can see the list of suppressed items in the Options panel under “Automated Analysis” / “Past Scores”.

Past Score Propagation panel

3.4.9. Dynamic DNS

Cyber Triage^® will mark hostnames as suspicious if they are part of a dynamic DNS setup, which can be used by malware to avoid network-based detection. If a hostname uses dynamic DNS, then it will be marked as Suspicious.

Cyber Triage^® ships with a set of Dynamic DNS providers that it will detect. You can add more providers by going to Options, Dynamic DNS. The domains hosted by dynamic DNS providers are detected using the DNS server for the domain. To add a provider, you add the DNS server names.

Dynamic DNS providers

3.4.10. Ransomware

Cyber Triage^® has several ransomware-specific detection techniques. Ransomware incidents are much like any other incident where attackers laterally move through an environment, but the difference is on their final action (where they encrypt the data instead of just stealing it).

The ransomware-specific techniques include:

• Detection of ransomware notes based on known naming patterns

• Detection of possible ransomware notes based on heuristics

• Detection of data recovery techniques disabling, such as Volume Shadow and Microsoft Backup

Cyber Triage^® focuses on making sure you quickly determine when the encryption started so that you can work backwards to determine how ransomware was deployed.

Cyber Triage^® does not have decryption features.