huntrule

Antivirus signatures matching APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

FreeReviewedSigma · Critical · v5
Category
antivirus
Author
Arnim Rupp (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-06-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags antivirus alerts where the detected file or alert signature contains APT-related naming patterns (e.g., bracketed or prefixed APT/UNC/ATK/UAC strings and known APT family-like substrings). Such naming is used to label malware or campaigns, and attackers may still succeed or reintroduce malicious components even after blocking occurs. It relies on antivirus telemetry that includes a signature field and signature text contents that match the specified regular expression and substring set.

Reporting behind it

Related detections9 linkedT1219 — drag to rearrange
Antivirus Remote Access Tool Signature Matches Known RAT Names
Antivirus signature match for exploitation framework indicators
Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document
Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage
Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell
Malicious NetSupport RAT Client32 Execution
Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)
Suspicious Outbound Connection To MoonPeak C2 High Ports
Suspicious Remote Management C2 Subdomain Resolution
Antivirus signatures matching APT malware naming patterns
Pivot detection · T1219 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.