{"id":"c9a88268-0047-4824-ba6e-4d81ce0b907c","title":"Antivirus Relevant File Paths Alerts","description":"Detects an Antivirus alert in a highly relevant file path or with a relevant file name.\nThis event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\n","author":"Florian Roth (Nextron Systems), Arnim Rupp","status":"test","level":"high","date":"2018-09-09","modified":"2024-11-02","tags":["attack.resource-development","attack.t1588"],"technique_ids":["T1588"],"logsource":{"category":"antivirus"},"falsepositives":["Unlikely"],"references":["https://www.nextron-systems.com/?s=antivirus"],"source_path":"rules/category/antivirus/av_relevant_files.yml","source_sha256":"024d55ff6e140aa552285b2561286fbb0264b4750fdf8f1585230d9b92ecdd09","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/antivirus/av_relevant_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Antivirus Relevant File Paths Alerts\nid: c9a88268-0047-4824-ba6e-4d81ce0b907c\nstatus: test\ndescription: |\n    Detects an Antivirus alert in a highly relevant file path or with a relevant file name.\n    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.\nreferences:\n    - https://www.nextron-systems.com/?s=antivirus\nauthor: Florian Roth (Nextron Systems), Arnim Rupp\ndate: 2018-09-09\nmodified: 2024-11-02\ntags:\n    - attack.resource-development\n    - attack.t1588\nlogsource:\n    category: antivirus\ndetection:\n    selection_path:\n        Filename|contains:\n            - ':\\PerfLogs\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\'\n            - '/www/'\n            # - '\\Client\\'\n            - '\\inetpub\\'\n            - '\\tsclient\\'\n            - 'apache'\n            - 'nginx'\n            - 'tomcat'\n            - 'weblogic'\n    selection_ext:\n        Filename|endswith:\n            - '.asax'\n            - '.ashx'\n            - '.asmx'\n            - '.asp'\n            - '.aspx'\n            - '.bat'\n            - '.cfm'\n            - '.cgi'\n            - '.chm'\n            - '.cmd'\n            - '.dat'\n            - '.ear'\n            - '.gif'\n            - '.hta'\n            - '.jpeg'\n            - '.jpg'\n            - '.jsp'\n            - '.jspx'\n            - '.lnk'\n            - '.msc'\n            - '.php'\n            - '.pl'\n            - '.png'\n            - '.ps1'\n            - '.psm1'\n            - '.py'\n            - '.pyc'\n            - '.rb'\n            - '.scf'\n            - '.sct'\n            - '.sh'\n            - '.svg'\n            - '.txt'\n            - '.vbe'\n            - '.vbs'\n            - '.war'\n            - '.wll'\n            - '.wsf'\n            - '.wsh'\n            - '.xll'\n            - '.xml'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","page":"techniques/enterprise/T1588/"}],"data_path":"data/detection-rules/c9a88268-0047-4824-ba6e-4d81ce0b907c.json","kind":"sigma"}