VirusTotal Cog

The VirusTotal cog integrates with VirusTotal’s API to automatically scan file attachments for malware and viruses.

Features

Automatic Scanning

  • Scans attachments with risky file extensions for malware (can be turned off with Auto Check File Hash)
  • SHA256 hash-based lookups
  • Files unknown to VirusTotal are uploaded for a full scan (can be turned off with Auto Upload Unknown Files)
  • VirusTotal API integration
  • Detection from multiple security vendors

Manual Check

  • Right click any message → Apps → VirusTotal: Check attachment to check all of its attachments, whatever the file type

File Analysis

  • Identifies risky file extensions
  • Checks attachment hashes against database
  • Provides detailed scan results
  • Color-coded threat levels

Access Control

  • Exclude specific channels from scanning
  • Exclude trusted roles from scanning
  • Exclude individual users from scanning
  • Configurable per-server

Commands

VirusTotal operates automatically on file uploads. Configuration is done via /config cog VirusTotal

  • VirusTotal: Check attachment - Right click a message → Apps → VirusTotal: Check attachment to check every attachment on that message, whatever its file type. Works even when auto check is off; follows the auto upload setting for unknown files.

Configuration

Setup VirusTotal scanning:

  • Enabled - Toggle file scanning
  • Auto Check File Hash - Automatically check risky attachments against VirusTotal (default: on)
  • Auto Upload Unknown Files - Upload files VirusTotal has not seen before for a full scan (default: on). Uploaded files become public on VirusTotal.
  • Excluded Channels - Channels to skip scanning
  • Excluded Roles - Trusted roles whose files skip scanning
  • Excluded Members - Users whose files skip scanning

VirusTotal API key required in bot configuration.

Best Practices

  1. Keep API key secure and private
  2. Monitor scan results and take action
  3. Inform users about automatic scanning
  4. Review exclusions regularly
  5. Check for recurring problematic uploads
  6. Educate users about suspicious files