Malware sample repositories

Detects malware sample repository indexes and manifests: malware-sample wording with per-sample hashes, family names, file types, storage paths or archive passwords. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a labelled sample field (hash type, family, file name/type, detection name, archive password, storage path) or a file hash (MD5/SHA1/SHA256 hex)), and 85 needs two distinct structures plus independent malware-handling (infected password, detonation, YARA, file format, family class) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Not detected

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

7

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:malware\s+(?:samples?|specimens?|repositor(?:y|ies)|vault|zoo|archive)|(?:sample|specimen)\s+(?:repository|vault|archive)\s+(?:index|manifest|listing)|live\s+malware\s+(?:collection|samples?))\b

Corroborative evidence keywords

password infected, detonate, quarantine, YARA, PE32, ELF, packed, dropper, ransomware, VirusTotal

Proximity: 300 characters

Should match

• The lab keeps its malware samples on an isolated analysis network. — Discovery probe (65) - wording only
• Malware sample repository index Family: QakBot File type: PE32 DLL — Medium-tier probe (75) - labelled sample fields without hashes
• Malware sample repository index - batch 2026-09 SHA256: 3f79bb7b435b05321651daefd374cdc681dc06faa65e374e38337b88ca046dea Family: QakBot File type: PE32 DLL Storage path: /vault/2026/09/3f79bb7b.zip Archive password: infected (password infected convention); do not detonate outside the sandbox. — High-tier probe (85) - hash plus several labelled sample fields and handling context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: malware samples must only be stored on the isolated research network and never emailed. — Policy text
• Malware sample repository template SHA256: ________ Family: [insert] — Blank template
• News report: researchers shared malware samples of a new loader; SHA256 3f79bb7b435b05321651daefd374cdc681dc06faa65e374e38337b88ca046dea circulated online. — News framing with a public hash

Known false positives

• Threat research blogs and news list sample hashes. Mitigation: News/press framing is excluded; enforcement needs labelled sample fields plus hashes.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• Criminal Code Act 1995 (Cth)