Antivirus alerts for suspicious file paths and web/script file extensions
Alerts on AV hits involving suspicious file locations and web/script-related extensions.
- Category
- antivirus
- Author
- Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
- Published
- 2018-09-09
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Antivirus detections where the alerted Filename matches a set of highly relevant path patterns (e.g., Windows, Temp/PerfLogs, default/public user directories, inetpub, tsclient, and common web server directories) and/or ends with specific executable or web/script-related file extensions. Attackers often stage or execute payloads from these locations and use common script/web file types to gain execution or persistence. Telemetry relies on Antivirus events that include a Filename field containing the matched path fragments and/or extension suffixes.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Antivirus alerts for suspicious file paths and web/script file extensions
id: 379af4ee-b3d2-44ae-8358-0948c380a96e
status: test
description: This rule flags Antivirus detections where the alerted Filename matches a set of highly relevant path patterns (e.g., Windows, Temp/PerfLogs, default/public user directories, inetpub, tsclient, and common web server directories) and/or ends with specific executable or web/script-related file extensions. Attackers often stage or execute payloads from these locations and use common script/web file types to gain execution or persistence. Telemetry relies on Antivirus events that include a Filename field containing the matched path fragments and/or extension suffixes.
references:
- https://www.nextron-systems.com/?s=antivirus
- https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_relevant_files.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-29
tags:
- attack.resource-development
- attack.t1588
logsource:
category: antivirus
detection:
selection_path:
Filename|contains:
- :\PerfLogs\
- :\Temp\
- :\Users\Default\
- :\Users\Public\
- :\Windows\
- /www/
- \inetpub\
- \tsclient\
- apache
- nginx
- tomcat
- weblogic
selection_ext:
Filename|endswith:
- .asax
- .ashx
- .asmx
- .asp
- .aspx
- .bat
- .cfm
- .cgi
- .chm
- .cmd
- .dat
- .ear
- .gif
- .hta
- .jpeg
- .jpg
- .jsp
- .jspx
- .lnk
- .msc
- .php
- .pl
- .png
- .ps1
- .psm1
- .py
- .pyc
- .rb
- .scf
- .sct
- .sh
- .svg
- .txt
- .vbe
- .vbs
- .war
- .wll
- .wsf
- .wsh
- .xll
- .xml
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c9a88268-0047-4824-ba6e-4d81ce0b907c
type: derived