{"id":"78bc5783-81d9-4d73-ac97-59f6db4f72a8","title":"Relevant Anti-Virus Signature Keywords In Application Log","description":"Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.\n","author":"Florian Roth (Nextron Systems), Arnim Rupp","status":"test","level":"high","date":"2017-02-19","modified":"2024-12-25","tags":["attack.resource-development","attack.t1588"],"technique_ids":["T1588"],"logsource":{"product":"windows","service":"application"},"falsepositives":["Some software piracy tools (key generators, cracks) are classified as hack tools"],"references":["https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31","https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed","https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01","https://www.nextron-systems.com/?s=antivirus"],"source_path":"rules/windows/builtin/application/Other/win_av_relevant_match.yml","source_sha256":"6df8054945d5ff36517fa7bc65f89c1a2cfc3d806bfd2b7adcdb65fe80dbb446","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/Other/win_av_relevant_match.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Relevant Anti-Virus Signature Keywords In Application Log\nid: 78bc5783-81d9-4d73-ac97-59f6db4f72a8\nstatus: test\ndescription: |\n    Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.\nreferences:\n    - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31\n    - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed\n    - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01\n    - https://www.nextron-systems.com/?s=antivirus\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2017-02-19\nmodified: 2024-12-25\ntags:\n    - attack.resource-development\n    - attack.t1588\nlogsource:\n    product: windows\n    service: application\ndetection:\n    keywords:\n        - 'Adfind'\n        - 'ASP/BackDoor '\n        - 'ATK/'\n        - 'Backdoor.ASP'\n        - 'Backdoor.Cobalt'\n        - 'Backdoor.JSP'\n        - 'Backdoor.PHP'\n        - 'Blackworm'\n        - 'Brutel'\n        - 'BruteR'\n        - 'Chopper'\n        - 'Cobalt'\n        - 'COBEACON'\n        - 'Cometer'\n        - 'CRYPTES'\n        - 'Cryptor'\n        - 'Destructor'\n        - 'DumpCreds'\n        - 'Exploit.Script.CVE'\n        - 'FastReverseProxy'\n        - 'Filecoder'\n        - 'GrandCrab '\n        - 'HackTool'\n        - 'HKTL'\n        - 'HTool-'\n        - '/HTool'\n        - '.HTool'\n        - 'IISExchgSpawnCMD'\n        - 'Impacket'\n        - 'JSP/BackDoor '\n        - 'Keylogger'\n        - 'Koadic'\n        - 'Krypt'\n        - 'Lazagne'\n        - 'Metasploit'\n        - 'Meterpreter'\n        - 'MeteTool'\n        - 'mikatz'\n        - 'Mimikatz'\n        - 'Mpreter'\n        - 'MsfShell'\n        - 'Nighthawk'\n        - 'Packed.Generic.347'\n        - 'PentestPowerShell'\n        - 'Phobos'\n        - 'PHP/BackDoor '\n        - 'Potato'\n        - 'PowerSploit'\n        - 'PowerSSH'\n        - 'PshlSpy'\n        - 'PSWTool'\n        - 'PWCrack'\n        - 'PWDump'\n        - 'Ransom'\n        - 'Rozena'\n        - 'Ryzerlo'\n        - 'Sbelt'\n        - 'Seatbelt'\n        - 'SecurityTool '\n        - 'SharpDump'\n        - 'Shellcode'\n        - 'Sliver'\n        - 'Splinter'\n        - 'Swrort'\n        - 'Tescrypt'\n        - 'TeslaCrypt'\n        - 'TurtleLoader'\n        - 'Valyria'\n        - 'Webshell'\n        # - 'FRP.'\n        # - 'Locker'\n        # - 'PWS.'\n        # - 'PWSX'\n        # - 'Razy'\n        # - 'Ryuk'\n    filter_optional_generic:\n        - 'anti_ransomware_service.exe'\n        - 'Anti-Ransomware'\n        - 'Crack'\n        - 'cyber-protect-service.exe'\n        - 'encryptor'\n        - 'Keygen'\n    filter_optional_information:\n        Level: 4  # Information level\n    filter_optional_restartmanager:\n        Provider_Name: 'Microsoft-Windows-RestartManager'\n    condition: keywords and not 1 of filter_optional_*\nfalsepositives:\n    - Some software piracy tools (key generators, cracks) are classified as hack tools\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","page":"techniques/enterprise/T1588/"}],"data_path":"data/detection-rules/78bc5783-81d9-4d73-ac97-59f6db4f72a8.json","kind":"sigma"}