Antivirus signature hits for APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

FreeUnreviewedSigmacriticalv1

antivirus-signature-hits-for-apt-malware-naming-patterns-101a1877

title: Antivirus signature hits for APT malware naming patterns
id: 572c6230-26e5-44d9-9b5c-257d5105bc65
status: experimental
description: This rule flags Antivirus alerts whose signature text matches specific APT-style malware naming patterns, including variants like APT/ATK/UNC/UAC prefixes and a set of known APT family name strings. Such alerts matter because they indicate the AV has identified malware content that may still require investigation, even if blocking occurred. The detection relies on Antivirus telemetry containing a signature field and matches either a regular expression prefix pattern or substring containment within that signature value.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_advanced_persistent_threat.yml
author: Arnim Rupp (Nextron Systems), Huntrule Team
date: 2026-06-15
tags:
  - attack.execution
  - attack.t1203
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: antivirus
detection:
  selection:
    - Signature|re:
        - APT\d
        - ATK\d
        - UNC\d
        - UAC\d
    - Signature|contains:
        - "[APT]"
        - APT_
        - APT-
        - BackOrder
        - BlindingCan
        - Blizzard
        - Chollima
        - Cleaver
        - Cobra
        - DarkHotel
        - Dragon
        - DTrack
        - Equation
        - GiftedCrook
        - GraphSteel
        - GreyEnergy
        - GEnergy
        - GrimPlant
        - Hydra
        - Jackal
        - Kitten
        - Kimsuky
        - Lazar
        - LightRail
        - Lotus
        - Luminous
        - LumiMoth
        - Nimbus
        - Manticore
        - MiniBike
        - MiniBrowse
        - MiniBus
        - MiniFast
        - MiniJuke
        - MiniUpdate
        - MuddyWater
        - NukeSped
        - OilRig
        - Panda
        - Sandstorm
        - SandWorm
        - Seamonkey
        - Sleet
        - SlugResin
        - SnailResin
        - Snake
        - Tempest
        - Tsunami
        - Turla
        - Typhoon
        - UAC_
        - UAC-
        - UNC_
        - UNC-
        - VinoSiren
        - Winnti
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a
    type: derived

What it detects

This rule flags Antivirus alerts whose signature text matches specific APT-style malware naming patterns, including variants like APT/ATK/UNC/UAC prefixes and a set of known APT family name strings. Such alerts matter because they indicate the AV has identified malware content that may still require investigation, even if blocking occurred. The detection relies on Antivirus telemetry containing a signature field and matches either a regular expression prefix pattern or substring containment within that signature value.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.