Antivirus detections matching known exploitation framework signatures

Alerts when AV signature names contain indicators tied to exploitation frameworks and related backdoors.

FreeUnreviewedSigmacriticalv1

antivirus-detections-matching-known-exploitation-framework-signatures-238527ad

title: Antivirus detections matching known exploitation framework signatures
id: 5dfcf4d9-a67b-4864-afc0-670074a838f9
status: stable
description: This rule flags antivirus alerts whose signature name contains strings associated with exploitation frameworks, backdoors, and related tooling. Such matches are important because they indicate the presence of malware behavior even if the antivirus blocked the payload, and they warrant investigation into how the software arrived on the system. The detection relies on antivirus telemetry that includes the alerted signature name text.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797
  - https://www.virustotal.com/gui/file/8f8daabe1c8ceb5710949283818e16c4aa8059bf2ce345e2f2c90b8692978424
  - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_exploitation_framework.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-15
tags:
  - attack.execution
  - attack.t1203
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: antivirus
detection:
  selection:
    Signature|contains:
      - ATK/Cobalt
      - Backdoor.Cobalt
      - Beacon
      - Brutel
      - BruteR
      - CbltStr
      - CobaltStr
      - COBALT.SMD
      - COBEACON
      - Cometer
      - Exploit.Script.CVE
      - IISExchgSpawnCMD
      - Metasploit
      - Meterpreter
      - MeteTool
      - Mpreter
      - MsfShell
      - PowerSploit
      - Razy
      - Rozena
      - Sbelt
      - Seatbelt
      - Sliver
      - Swrort
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 238527ad-3c2c-4e4f-a1f6-92fd63adb864
    type: derived

What it detects

This rule flags antivirus alerts whose signature name contains strings associated with exploitation frameworks, backdoors, and related tooling. Such matches are important because they indicate the presence of malware behavior even if the antivirus blocked the payload, and they warrant investigation into how the software arrived on the system. The detection relies on antivirus telemetry that includes the alerted signature name text.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.