Data in YARA Scan results

Kaspersky Endpoint Agent automatically transfers YARA scan results to Kaspersky Anti Targeted Attack Platform to build a threat development chain.

The data is temporarily stored locally in the queue for sending task execution results to the Kaspersky Anti Targeted Attack Platform server. The data is deleted from the temporary storage once it has been sent.

YARA scan results contain the following data:

• MD5 hash of the file
• SHA256 hash of the file
• Full name of the file
• File path
• File size
• Process name
• Process arguments
• Path to the process file
• Windows identifier (PID) of the process
• Windows identifier (PID) of the parent process
• User account that started the process
• Date and time when the process was started

Page top