Antivirus detections for executables and web scripts in relevant file paths

title: Antivirus detections for executables and web scripts in relevant file paths
id: 379af4ee-b3d2-44ae-8358-0948c380a96e
status: test
description: This rule flags antivirus alerts where the reported Filename contains or ends with patterns commonly associated with system, user, and web-accessible locations. Attackers often stage malicious files in these directories or disguise them as scripts and web-related assets, so even AV-blocked events can indicate failed or partial intrusion attempts. The detection relies on antivirus telemetry fields containing the Filename substring and suffix matches for specified paths and file extensions.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_relevant_files.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-29
tags:
  - attack.resource-development
  - attack.t1588
logsource:
  category: antivirus
detection:
  selection_path:
    Filename|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Users\Default\
      - :\Users\Public\
      - :\Windows\
      - /www/
      - \inetpub\
      - \tsclient\
      - apache
      - nginx
      - tomcat
      - weblogic
  selection_ext:
    Filename|endswith:
      - .asax
      - .ashx
      - .asmx
      - .asp
      - .aspx
      - .bat
      - .cfm
      - .cgi
      - .chm
      - .cmd
      - .dat
      - .ear
      - .gif
      - .hta
      - .jpeg
      - .jpg
      - .jsp
      - .jspx
      - .lnk
      - .msc
      - .php
      - .pl
      - .png
      - .ps1
      - .psm1
      - .py
      - .pyc
      - .rb
      - .scf
      - .sct
      - .sh
      - .svg
      - .txt
      - .vbe
      - .vbs
      - .war
      - .wll
      - .wsf
      - .wsh
      - .xll
      - .xml
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c9a88268-0047-4824-ba6e-4d81ce0b907c
    type: derived