Sigma rule: Relevant Anti-Virus Signature Keywords In Application Log

Rule

Title

Relevant Anti-Virus Signature Keywords In Application Log

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Arnim Rupp

Date

2017-02-19

Modified

2026-10-12

File

rules/windows/builtin/application/Other/win_av_relevant_match.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.

Log source

product

windows

service

application

Detection

keywords_generic:
    - 'Adfind'
    - 'ASP/BackDoor '
    - 'ATK/'
    - 'Backdoor.ASP'
    - 'Backdoor.Cobalt'
    - 'Backdoor.JSP'
    - 'Backdoor.PHP'
    - 'Blackworm'
    - 'Brutel'
    - 'BruteR'
    - 'Chopper'
    - 'Cobalt'
    - 'COBEACON'
    - 'Cometer'
    - 'CRYPTES'
    - 'Cryptor'
    - 'Destructor'
    - 'DumpCreds'
    - 'Exploit.Script.CVE'
    - 'FastReverseProxy'
    - 'Filecoder'
    - 'GrandCrab '
    - 'HackTool'
    - '_HKTL'
    - '-HKTL'
    - '.HKTL'
    - '/HKTL'
    - 'HKTL_'
    - 'HKTL-'
    - 'HKTL.'
    - 'HKTL/'
    - 'HTool-'
    - 'HTool.'
    - 'HTool/'
    - 'HTool_'
    - '-HTool'
    - '/HTool'
    - '.HTool'
    - '_HTool'
    - 'IISExchgSpawnCMD'
    - 'Impacket'
    - 'JSP/BackDoor '
    - 'Keylogger'
    - 'Koadic'
    - 'Krypt'
    - 'Lazagne'
    - 'Metasploit'
    - 'Meterpreter'
    - 'MeteTool'
    - 'mikatz'
    - 'Mimikatz'
    - 'Mpreter'
    - 'MsfShell'
    - 'Nighthawk'
    - 'Packed.Generic.347'
    - 'PentestPowerShell'
    - 'Phobos'
    - 'PHP/BackDoor '
    - 'Potato'
    - 'PowerSploit'
    - 'PowerSSH'
    - 'PshlSpy'
    - 'PSWTool'
    - 'PWCrack'
    - 'PWDump'
    - 'Ransom'
    - 'Rozena'
    - 'Ryzerlo'
    - 'Sbelt'
    - 'Seatbelt'
    - 'SecurityTool '
    - 'SharpDump'
    - 'Shellcode'
    - 'Sliver'
    - 'Splinter'
    - 'Swrort'
    - 'Tescrypt'
    - 'TeslaCrypt'
    - 'TurtleLoader'
    - 'Valyria'
    - 'Webshell'
    # - 'FRP.'
    # - 'Locker'
    # - 'PWS.'
    # - 'PWSX'
    # - 'Razy'
    # - 'Ryuk'
keywords_re:
    '|re': '\bHKTL\b'  # also matches case-sensitively
filter_optional_generic:
    - 'anti_ransomware_service.exe'
    - 'Anti-Ransomware'
    - 'Crack'
    - 'cyber-protect-service.exe'
    - 'encryptor'
    - 'Keygen'
filter_optional_information:
    Level: 4  # Information level
filter_optional_restartmanager:
    Provider_Name: 'Microsoft-Windows-RestartManager'
condition: 1 of keywords_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Some software piracy tools (key generators, cracks) are classified as hack tools

Tags

• attack.resource-development
• attack.t1588

MITRE ATT&CK ids this rule names

• T1588

References

• https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
• https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
• https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
• https://www.nextron-systems.com/?s=antivirus

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/Other/win_av_relevant_match.yml