tags

Sandbox behavior tagged

tags field contains a list of labels summarizing key observations. It can be any of the following:

• external-resources external resources loaded.
• third-party-cookies external cookies loaded.
• iframespresence of IFRAMES in DOM.
• script-load external scripts loaded.
• base64-embedded
• opendir URL is an open directory.
• dom-modification DOM nodes have been added/removed.
• contains-pe
• contains-msi
• contains-dmg
• contains-apk
• contains-zip
• phishing phishing detected on target URL.
• proxy-auth proxy auth prompt detected.

Behaviour tags

{
    "data": {
        "attributes": {
            "tags": [
                "<string>",...
            ]
  `      }
    }
}`

Example

{
    "data": {
        "attributes": {
            "tags": [
                "DIRECT_CPU_CLOCK_ACCESS",
                "DETECT_DEBUG_ENVIRONMENT",
                "RUNTIME_MODULES",
                "PERSISTENCE"
            ]
        }
    }
}