From cd3e304f27e2f6bb62c432dc0116c83e7b2c4109 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Tue, 27 Jun 2023 17:18:20 -0400 Subject: [PATCH] Update README-DeepBlueHash.md --- READMEs/README-DeepBlueHash.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/READMEs/README-DeepBlueHash.md b/READMEs/README-DeepBlueHash.md index c17a8f6..09d2063 100644 --- a/READMEs/README-DeepBlueHash.md +++ b/READMEs/README-DeepBlueHash.md @@ -6,12 +6,18 @@ Parses the Sysmon event logs, grabbing the SHA256 hashes from process creation ( ## VirusTotal and Safelisting setup -**Note**: Virustotal has changed their free API, and now severely limits the number of lookups you can do for free. It was one every 15 seconds, but is now: +**Note**: Virustotal has changed their free API for some users. My old account has this limitation: - Daily quota 1 lookups / day - Monthly quota 31 lookups / month -I reached to to them to see how much a paid API will cost for this purpose. I may retire this tool if the cost is prohibitive. +New accounts get this: + + - Request rate 4 lookups / min + - Daily quota 500 lookups / day + - Monthly quota 15.5 K lookups / month + +Not sure why that is, so FYI. Setting up VirusTotal hash submissions and safelisting: