huntrule

Antivirus alerts on known hacktool and attack tool signatures

Alerts on Antivirus detections matching hacktool signature prefixes or offensive tool names for investigation.

FreeReviewedSigma · High · v5
Category
antivirus
Author
Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
Published
2021-08-16
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags antivirus detections whose signature matches common hacktool and attack tool names, including prefixes and specific indicator strings. Such matches are important because attackers may deploy offensive tooling that can lead to credential theft, persistence, and post-exploitation activity even if blocking occurs. It relies on antivirus alert telemetry that provides the detection signature value to evaluate prefix and substring conditions.

Reporting behind it

Related detections9 linkedT1204 — drag to rearrange
Malicious Edge Abuse for Payload Download via Console (via process_creation)
Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)
Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution
Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'
Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter
Windows Registry: Suspicious Space-Padded TypedPaths Details String
Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1
Windows: Deno writes files from remote HTTPS content into AppData
Antivirus alerts on known hacktool and attack tool signatures
Pivot detection · T1204 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.