VirusTotal Updates Livehunt for Process Tree Rules
The platform now allows users to write YARA rules that identify hierarchical process relationships in sandbox reports.
Updated on Oct. 27, 2026 in Job Search
Live Poll
Do you trust that modern security software keeps your local digital environment safe from evolving threats?
In October 2026, VirusTotal implemented support for YARA rules within Livehunt that can now analyze complex process trees. This update enables security researchers to track malicious activity by linking parent and child processes across sandbox reports.
Why it matters
Standard YARA rules previously struggled to identify hierarchical process relationships, which are critical for detecting sophisticated threats. This capability improves detection accuracy by allowing users to query specific parent and ancestor names.
Livehunt now integrates vt.behaviour.processes_list into every sandbox report, providing detailed process names, parent identifiers, and ancestor lineage. Each entry also includes granular data such as process IDs, exact timestamps, and comprehensive lists of file operations.
The players
VirusTotal
A Google-owned service that aggregates antivirus engines and scanners to analyze suspicious files and URLs for malware detection.
Livehunt
A premium VirusTotal feature that allows users to create custom YARA rules to receive real-time notifications when new files match specific criteria.
The details
Users can now leverage parent_name and ancestor_names fields to build hierarchical YARA rules. Security professionals are advised to identify candidate hashes using intelligence search before attempting to construct these more complex rules.
Timeline
October 2026: Livehunt implemented support for process tree YARA rules.
Market Landscape
This development follows the evolution of the YARA threat detection language by adding support for hierarchical data structures. It positions VirusTotal to better compete in a market increasingly focused on identifying multi-stage malware execution chains.
Security analysts can now improve their detection accuracy by incorporating process lineage into their automated threat hunting workflows. This change streamlines the identification of complex attack vectors that rely on multiple parent-child process interactions.
The takeaway
Security researchers should focus on normalizing process naming conventions within their own environments to ensure consistent rule application. Utilizing these new hierarchical rules provides a deeper layer of visibility into how malicious software behaves during its initial execution.
Further reading
For more information on the evolving tools used by security professionals, visit the Job Search section.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you trust that modern security software keeps your local digital environment safe from evolving threats?
