# Need help finding Pcap with no signatures **URL:** \ **Category:** Tutorials, Tips & Tricks\ **Created:** [December 22, 2022, 7:27pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227 "2022-12-22T19:27:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![NoahWolf](https://avatars.discourse-cdn.com/v4/letter/n/a6a055/32.png) [@NoahWolf](https://community.emergingthreats.net/u/NoahWolf)\ **Post date:** [December 22, 2022, 7:27pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/1 "2022-12-22T19:27:38Z")
Hey everybody, I have been using Virustotal to try and find Pcap without a signature. This is the query I have been using: “have:pcap tag:malware positives:10+m AND NOT have:crowdsourced\_ids AND NOT engines:formbook”. I generally have to go through 50-100 submissions before I find one with no signatures written for it. Does anybody have any tips or tricks to help finding any Pcap that needs signatures written for them? ---
**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Post date:** [December 23, 2022, 8:44pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/2 "2022-12-23T20:44:51Z")
Hey Noah, I contacted VT about this and they said that the query is correct and that there might be a bug on their end. They didn’t provide a timeline but I’ll update this thread once we hear back. I’ll also try the query every couple of days in case it gets resolved before we hear anything. Happy Holidays, Isaac ---
**Author:** ![cosmicgumbo](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@cosmicgumbo](https://community.emergingthreats.net/u/cosmicgumbo)\ **Post date:** [December 29, 2022, 4:54pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/3 "2022-12-29T16:54:38Z")
Hey, I know it’s a little late and I am by no means an expert myself but I usually sweep [https://tria.ge](https://tria.ge) in a similar way and my best methods seem to be downloading interesting pcaps and running them through Dalton quickly to see if it’s interesting. It’s not completely efficient but it works well enough for myself. Link to the Dalton project: [GitHub - secureworks/dalton: Suricata and Snort IDS rule and pcap testing system](https://github.com/secureworks/dalton) Hope this helps but if it doesn’t, I would like to know a more efficient way as well! ---
**Author:** ![cosmicgumbo](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@cosmicgumbo](https://community.emergingthreats.net/u/cosmicgumbo)\ **Post date:** [December 31, 2022, 9:12pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/4 "2022-12-31T21:12:38Z")
I continued to think on this and I kind of like the idea of automating this with a CLI tool that checks pcaps against rules. I can’t do VT myself since I don’t have access but I think triage has an API I can work with. I might poke around with how the output would be most useful. ---
**Author:** ![NoahWolf](https://avatars.discourse-cdn.com/v4/letter/n/a6a055/32.png) [@NoahWolf](https://community.emergingthreats.net/u/NoahWolf)\ **Post date:** [January 10, 2023, 1:20pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/5 "2023-01-10T13:20:28Z")
Hey Isaac, Thank you for your feedback. ---
**Author:** ![NoahWolf](https://avatars.discourse-cdn.com/v4/letter/n/a6a055/32.png) [@NoahWolf](https://community.emergingthreats.net/u/NoahWolf)\ **Post date:** [January 10, 2023, 1:25pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/6 "2023-01-10T13:25:31Z")
If you end up doing a script that’s public, I would love to contribute. ---
**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Post date:** [January 10, 2023, 4:03pm UTC](https://community.emergingthreats.net/t/need-help-finding-pcap-with-no-signatures/227/7 "2023-01-10T16:03:33Z")
@NoahWolf - I just did a search in VT today and It looks like they’ve fixed the issue. I never got a response back but after clicking on a few random results it appears to be working correctly. 🎉