Skip to main content

Malware Scanning

Detect malware and malicious files across your endpoints using YARA-based signature scanning and on-demand threat analysis.

Comprehensive Detection

CastellanAI combines YARA signature scanning with threat intelligence from VirusTotal, MalwareBazaar, and AlienVault OTX.

Overview​

CastellanAI includes comprehensive malware detection with two integrated features:

FeatureDescription
Detection RulesYARA-based detection rules for signature matching
Threat ScannerOn-demand scans with real-time progress monitoring

Detection Rules​

Rules Dashboard​

Navigate to Detection Rules in the sidebar to view and manage malware detection rules.

Dashboard ElementDescription
Statistics CardsTotal, Enabled, Disabled, Valid, Invalid counts
Rule ListAll rules with name, category, threat level, status
FiltersSearch and filter rules by various criteria

Rule Categories​

Malware Categories​

CategoryDescription
MalwareGeneral malware signatures
RansomwareFile encryption and ransom-demanding malware
TrojanDisguised malware with hidden malicious functions
BackdoorHidden access points for attackers
Ransomware

Ransomware detections are always marked as Critical and trigger immediate alerts.

Filtering Rules​

FilterOptions
SearchSearch by rule name or description
CategoryFilter by malware category
Threat LevelCritical, High, Medium, Low
StatusEnabled or Disabled
📥 Importing YARA Rules
  1. Click Import Rules in the Detection Rules page
  2. Select YARA rule files (.yar, .yara, .txt)
  3. Review the import preview
  4. Click Import to add the rules
Community Rules

CastellanAI includes 70+ built-in rules. Import additional rules from the YARA-Rules repository for expanded coverage.

Threat Scanner​

Scanner Dashboard​

Navigate to Malware Analysis in the sidebar to access the threat scanner.

Scan Types​

Quick Scan​

Coverage: Common threat locations, running processes

Use When:

  • Daily monitoring
  • Quick security checks
  • After suspicious activity

Running a Scan​

  1. Click the appropriate scan type button
  2. Watch real-time progress:
MetricDescription
ProgressPercentage and files scanned
Files ProcessedTotal files examined
Threats FoundDetections as discovered
Scan DurationElapsed time
Real-Time Monitoring

Scans run via SignalR connection. Keep the dashboard open to monitor progress and receive immediate threat notifications.

Understanding Scan Results​

Results Summary​

ElementDescription
Summary StatisticsTotal files, threats found, scan duration
Threat BreakdownCount by severity (Critical, High, Medium, Low)
Detection ListEach threat with name, path, classification
MITRE ATT&CK MappingAttack technique classifications

Scan History​

Filter past scans by:

  • Scan Type - QuickScan, FullScan, DirectoryScan, FileScan
  • Status - Completed, Running, Failed
  • Risk Level - Filter by highest severity found

Responding to Detections​

Critical Threat Level​

Risk: Severe - Active threat

Recommended Action:

  • Isolate device immediately
  • Escalate to security team
  • Block network access
Immediate Response Required

Critical threats indicate active malware that may be spreading or causing damage.

Response Workflow​

Threat Intelligence Integration​

SourceCapability
VirusTotal70+ antivirus engine results for file hashes
MalwareBazaarKnown malware samples database
AlienVault OTXCommunity threat intelligence and IOCs

When threats are detected, CastellanAI automatically enriches findings with:

  • Multi-vendor detection consensus
  • Known malware family identification
  • Related indicators of compromise (IOCs)
  • Historical detection data

Handling False Positives​

🔧 False Positive Workflow

If a legitimate file is incorrectly flagged:

  1. Review the detection details thoroughly
  2. Check the file against VirusTotal (linked in detection details)
  3. If confirmed safe:
    • Mark as False Positive in the dashboard
    • Optionally disable the specific rule
    • Report to improve detection accuracy

See False Positives for detailed guidance.

Best Practices​

DoDon't
Run quick scans dailyIgnore low-severity detections
Run full scans weeklyDelete files without quarantine first
Keep rules updatedSkip checking related systems
Use threat intelligence contextAct without reviewing detection details
Quarantine before deletingDisable rules without investigation

What's Next?​

GuideDescription
Threat DetectionLearn about all detection methods
MITRE ATT&CKUnderstanding threat classifications
Taking ActionResponse procedures for threats
False PositivesManaging incorrect detections