Query: alert when Detects potentially highly relevant antivirus events in the application log based on known virus signature names and mal
Matching passage: Sigma rule: Detects potentially highly relevant antivirus events in the application log based on known virus signature names and mal. Logsource: windows / application. Rule: title: Relevant Anti-Virus Signature Keywords In Application Log id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8 status: test description: 'Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords. ' references: - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31 - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01 - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2017-02-19 modified: 2024-12-25 tags: - attack.resource-development - attack.t1588 logsource: product: windows service: application detection: keywords: - Adfind - 'ASP/BackDoor ' - ATK/ - Backdoor.ASP - Backdoor.Cobalt - Backdoor.JSP - Backdoor.PHP - Blackworm - Brutel - BruteR - Chopper - Cobalt - COBEACON - Cometer - CRYPTES - Cryptor - Destructor - DumpCreds - Exploit.Script.CVE - FastReverseProxy - Filecoder - 'GrandCrab ' - HackTool - HKTL - HTool- - /HTool - .HTool - IISExchgSpawnCMD - Impacket - 'JSP/BackDoor ' - Keylogger - Koadic - Krypt - Lazagne - Metasploit - Meterpreter - MeteTool - mikatz - Mimikatz - Mpreter - MsfShell - Nighthawk - Packed.Generic.347 - PentestPowerShell - Phobos - 'PHP/BackDoor ' - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Ransom - Rozena - Ryzerlo - Sbelt - Seatbelt - 'SecurityTool ' - SharpDump - Shellcode - Sliver - Splinter - Swrort - Tescrypt - TeslaCrypt - TurtleLoader - Valyria - Webshell filter_optional_generic: - anti_ransomware_service.exe - Anti-Ransomware - Crack - cyber-protect-service.exe - encryptor - Keygen filter_optional_information: Level: 4 filter_optional_restartmanager: Provider_Name: Microsoft-Windows-RestartManager condition: keywords and not 1 of filter_optional_* falsepositives: - Some software piracy tools (key generators, cracks) are classified as hack tools level: high
Near-miss passage: Sigma rule: Detects PowerShell execution to set the ACL of a file or a folder. Logsource: windows / process_creation. Rule: title: PowerShell Script Change Permission Via Set-Acl id: bdeb2cff-af74-4094-8426-724dc937f20a related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell execution to set the ACL of a file or a folder references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cmdlet: CommandLine|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: all of selection_* falsepositives: - Unknown level: high