Antivirus: Detect hacktool and attack-tool signatures by name and prefix

Alerts on Antivirus detections matching hacktool signature prefixes or offensive tool names for investigation.

FreeUnreviewedSigmahighv1

antivirus-detect-hacktool-and-attack-tool-signatures-by-name-and-prefix-fa0c05b6

title: "Antivirus: Detect hacktool and attack-tool signatures by name and prefix"
id: dc204cb4-92d7-4ef1-8262-091d334e466b
status: stable
description: This rule flags Antivirus detections whose signature starts with known hacktool/attack-tool prefixes (e.g., ATK/, HTOOLS, PWS., PWSX, SecurityTool) or contains common offensive tooling names (e.g., Mimikatz, Impacket, PowerSploit, Cobalt, BloodH, Adfind). Such detections matter because attackers may introduce tools for credential access, discovery, exploitation, persistence, or post-exploitation, and the presence of a matching signature should be investigated even if the AV blocked the content. It relies on Antivirus telemetry that includes the matched signature string.
references:
  - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_hacktool.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2021-08-16
modified: 2026-06-15
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: antivirus
detection:
  selection:
    - Signature|startswith:
        - ATK/
        - Exploit.Script.CVE
        - HKTL
        - HTOOL
        - PWS.
        - PWSX
        - SecurityTool
    - Signature|contains:
        - Adfind
        - BloodH
        - BloodyAD
        - Brutel
        - BruteR
        - Cobalt
        - COBEACON
        - Cometer
        - DumpCreds
        - EDRfreeze
        - FastReverseProxy
        - Hacktool
        - Havoc
        - Impacket
        - Keylogger
        - Koadic
        - Mimikatz
        - Nighthawk
        - PentestPowerShell
        - Potato
        - PowerSploit
        - PowerSSH
        - PshlSpy
        - PSWTool
        - PWCrack
        - PWDump
        - Responder
        - Rozena
        - Rusthound
        - Sbelt
        - Seatbelt
        - SecurityTool
        - SharpDump
        - SharpHound
        - Shellcode
        - Sliver
        - Snaffler
        - SOAPHound
        - Splinter
        - Stowaway
        - Swrort
        - Trojan.Hound
        - TurtleLoader
        - Undefend
        - Undfnd
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba
    type: derived

What it detects

This rule flags Antivirus detections whose signature starts with known hacktool/attack-tool prefixes (e.g., ATK/, HTOOLS, PWS., PWSX, SecurityTool) or contains common offensive tooling names (e.g., Mimikatz, Impacket, PowerSploit, Cobalt, BloodH, Adfind). Such detections matter because attackers may introduce tools for credential access, discovery, exploitation, persistence, or post-exploitation, and the presence of a matching signature should be investigated even if the AV blocked the content. It relies on Antivirus telemetry that includes the matched signature string.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.