# Spectra Intelligence Malware Hunting API — YARA, Search & IoC

> Hunt threats using Spectra Intelligence Malware Hunting APIs: YARA rules, advanced search, RHA1 similarity, IoC retrieval, and industry-specific malware statistics.

The Malware Hunting APIs enable threat researchers to search for samples, find similar files, create custom detection rules, and track malware families across the Spectra Intelligence repository.

## Common Use Cases

### Search for samples

- **[Advanced search (TCA-0320)](tca-0320.md)** - Build complex queries using keywords and operators to filter samples by classification, file type, threat name, and more.
- **[Indicators of Compromise (TCA-0330)](tca-0330.md)** - Retrieve structured IoC data for samples and URLs with filtering by classification, malware family, threat actor, and vertical.

### Find similar files

- **[Functionally similar files (TCA-0301)](tca-0301.md)** - Find files with similar code structure using ReversingLabs Hashing Algorithm (RHA1).
- **[Functionally similar files (analytics) (TCA-0321)](tca-0321.md)** - Get statistics on how many malicious, suspicious, and known files are functionally similar to a sample.
- **[Imphash similarity (TCA-0302)](tca-0302.md)** - Find Windows PE files sharing the same import hash.

### Create custom detection rules

- **[YARA hunting (TCA-0303)](tca-0303.md)** - Upload YARA rules to match against new samples entering the system.
- **[YARA retro hunting (TCA-0319)](tca-0319.md)** - Run YARA rules against the last 90 days of stored samples.

### Track malware families

These APIs provide statistics and search capabilities for the [Targeted and industry-specific file indicator feeds (TCF-0401-0406)](/docs/SpectraIntelligence/Feed/IndustryIndicators/tcf-0401-0406.md).

- **[Vertical feeds statistics (TCA-0307-0311, 0317)](tca-0307-0311_0317.md)** - Get weekly statistics on malware families by industry category.
- **[Vertical feeds search (TCA-0312-0316, 0318)](tca-0312-0316_0318.md)** - Search for new malware hashes by family name within industry-specific feeds.

## All Malware Hunting APIs


