Query: Sigma YAML for antivirus
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV h. Logsource: antivirus. Rule: title: Antivirus - APT Malware Signature id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a status: experimental description: 'Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus author: Arnim Rupp (Nextron Systems) date: 2026-06-15 tags: - attack.execution - attack.t1203 - attack.command-and-control - attack.t1219.002 logsource: category: antivirus detection: selection: - Signature|re: - APT\d - ATK\d - UNC\d - UAC\d - Signature|contains: - '[APT]' - APT_ - APT- - BackOrder - BlindingCan - Blizzard - Chollima - Cleaver - Cobra - DarkHotel - Dragon - DTrack - Equation - GiftedCrook - GraphSteel - GreyEnergy - GEnergy - GrimPlant - Hydra - Jackal - Kitten - Kimsuky - Lazar - LightRail - Lotus - Luminous - LumiMoth - Nimbus - Manticore - MiniBike - MiniBrowse - MiniBus - MiniFast - MiniJuke - MiniUpdate - MuddyWater - NukeSped - OilRig - Panda - Sandstorm - SandWorm - Seamonkey - Sleet - SlugResin - SnailResin - Snake - Tempest - Tsunami - Turla - Typhoon - UAC_ - UAC- - UNC_ - UNC- - VinoSiren - Winnti condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects suspicious process patterns used in NTDS.DIT exfiltration. Logsource: windows / process_creation. Rule: title: Suspicious Process Patterns NTDS.DIT Exfil id: 8bc64091-6875-4881-aaf9-7bd25b5dda08 status: test description: Detects suspicious process patterns used in NTDS.DIT exfiltration references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 - https://github.com/zcgonvh/NTDSDumpEx - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1 - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: process_creation detection: selection_tool: - Image|endswith: - \NTDSDump.exe - \NTDSDumpEx.exe - CommandLine|contains|all: - ntds.dit - system.hiv - CommandLine|contains: NTDSgrab.ps1 selection_oneliner_1: CommandLine|contains|all: - ac i ntds - create full selection_onliner_2: CommandLine|contains|all: - '/c copy ' - \windows\ntds\ntds.dit selection_onliner_3: CommandLine|contains|all: - activate instance ntds - create full selection_powershell: CommandLine|contains|all: - powershell - ntds.dit set1_selection_ntds_dit: CommandLine|contains: ntds.dit set1_selection_image_folder: - ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ - Image|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: 1 of selection* or all of set1* falsepositives: - Unknown level: high