Antivirus alerts for suspicious file paths and web/script file extensions

title: Antivirus alerts for suspicious file paths and web/script file extensions
id: 379af4ee-b3d2-44ae-8358-0948c380a96e
status: test
description: This rule flags Antivirus detections where the alerted Filename matches a set of highly relevant path patterns (e.g., Windows, Temp/PerfLogs, default/public user directories, inetpub, tsclient, and common web server directories) and/or ends with specific executable or web/script-related file extensions. Attackers often stage or execute payloads from these locations and use common script/web file types to gain execution or persistence. Telemetry relies on Antivirus events that include a Filename field containing the matched path fragments and/or extension suffixes.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_relevant_files.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-29
tags:
  - attack.resource-development
  - attack.t1588
logsource:
  category: antivirus
detection:
  selection_path:
    Filename|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Users\Default\
      - :\Users\Public\
      - :\Windows\
      - /www/
      - \inetpub\
      - \tsclient\
      - apache
      - nginx
      - tomcat
      - weblogic
  selection_ext:
    Filename|endswith:
      - .asax
      - .ashx
      - .asmx
      - .asp
      - .aspx
      - .bat
      - .cfm
      - .cgi
      - .chm
      - .cmd
      - .dat
      - .ear
      - .gif
      - .hta
      - .jpeg
      - .jpg
      - .jsp
      - .jspx
      - .lnk
      - .msc
      - .php
      - .pl
      - .png
      - .ps1
      - .psm1
      - .py
      - .pyc
      - .rb
      - .scf
      - .sct
      - .sh
      - .svg
      - .txt
      - .vbe
      - .vbs
      - .war
      - .wll
      - .wsf
      - .wsh
      - .xll
      - .xml
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c9a88268-0047-4824-ba6e-4d81ce0b907c
    type: derived