Antivirus remote access tool detections by malware family signatures (AgentB, AgentTesla, Ammyy, others)

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

FreeUnreviewedSigmacriticalv1

antivirus-remote-access-tool-detections-by-malware-family-signatures-agentb-agen-97233998

title: Antivirus remote access tool detections by malware family signatures (AgentB, AgentTesla, Ammyy, others)
id: fb212791-338d-490d-adbf-5ed57922ab4f
status: experimental
description: This rule flags antivirus events whose signature text contains known remote access tool family names. Such detections matter because attackers often deliver RATs to establish remote control and command-and-control capabilities, even if the payload is later blocked. It relies on antivirus telemetry that includes a signature or classification field matching one of the listed RAT family strings.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_remote_access_toolkit.yml
author: Arnim Rupp (Nextron Systems), Huntrule Team
date: 2026-06-15
tags:
  - attack.execution
  - attack.t1203
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: antivirus
detection:
  selection:
    Signature|contains:
      - AgentB
      - AgentTesla
      - AMRat
      - Ammyy
      - AsyncRAT
      - Bandook
      - Bitrat
      - Bladabindi
      - Connectwise
      - CyberGate
      - DarkComet
      - DCrat
      - Delf
      - DokStorm
      - Egairtigado
      - Gh0st
      - Gorat
      - GodRat
      - Jalapeno
      - LummaC2
      - Minirat
      - Netwire
      - NanoCore
      - NJRat
      - Paralax
      - PlugX
      - Pulsar
      - Quasar
      - Remcos
      - Ravartar
      - RemoteAdmin
      - RemoteTool
      - revengeRAT
      - rokRAT
      - salatstealer
      - Salgorea
      - SmokedHam
      - TigerRat
      - Tzeebot
      - WarZone
      - VenomRAT
      - Vidar
      - Wirenet
      - XWorm
      - Zapchast
      - Zegost
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 97233998-3838-4581-88c6-f1d19d3993fb
    type: derived

What it detects

This rule flags antivirus events whose signature text contains known remote access tool family names. Such detections matter because attackers often deliver RATs to establish remote control and command-and-control capabilities, even if the payload is later blocked. It relies on antivirus telemetry that includes a signature or classification field matching one of the listed RAT family strings.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.