Antivirus signatures matching APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

FreeReviewedSigma · Critical · v5

Category: antivirus
Author: Arnim Rupp (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-06-15
Updated: 2026-07-31

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1219Remote Access Tools
Exfiltration
Impact

What it detects

This rule flags antivirus alerts where the detected file or alert signature contains APT-related naming patterns (e.g., bracketed or prefixed APT/UNC/ATK/UAC strings and known APT family-like substrings). Such naming is used to label malware or campaigns, and attackers may still succeed or reintroduce malicious components even after blocking occurs. It relies on antivirus telemetry that includes a signature field and signature text contents that match the specified regular expression and substring set.

Reporting behind it

Related detections9 linkedT1219 — drag to rearrange

Antivirus Remote Access Tool Signature Matches Known RAT Names

Antivirus signature match for exploitation framework indicators

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious NetSupport RAT Client32 Execution

Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)

Suspicious Outbound Connection To MoonPeak C2 High Ports

Suspicious Remote Management C2 Subdomain Resolution

Antivirus signatures matching APT malware naming patterns

Pivot detection · T1219 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

antivirus-signature-hits-for-apt-malware-naming-patterns-101a1877

title: Antivirus signatures matching APT malware naming patterns
id: 572c6230-26e5-44d9-9b5c-257d5105bc65
status: experimental
description: This rule flags antivirus alerts where the detected file or alert signature contains APT-related naming patterns (e.g., bracketed or prefixed APT/UNC/ATK/UAC strings and known APT family-like substrings). Such naming is used to label malware or campaigns, and attackers may still succeed or reintroduce malicious components even after blocking occurs. It relies on antivirus telemetry that includes a signature field and signature text contents that match the specified regular expression and substring set.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_advanced_persistent_threat.yml
author: Arnim Rupp (Nextron Systems), Huntrule Team
date: 2026-06-15
tags:
  - attack.execution
  - attack.t1203
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: antivirus
detection:
  selection:
    - Signature|re:
        - APT\d
        - ATK\d
        - UNC\d
        - UAC\d
    - Signature|contains:
        - "[APT]"
        - APT_
        - APT-
        - BackOrder
        - BlindingCan
        - Blizzard
        - Chollima
        - Cleaver
        - Cobra
        - DarkHotel
        - Dragon
        - DTrack
        - Equation
        - GiftedCrook
        - GraphSteel
        - GreyEnergy
        - GEnergy
        - GrimPlant
        - Hydra
        - Jackal
        - Kitten
        - Kimsuky
        - Lazar
        - LightRail
        - Lotus
        - Luminous
        - LumiMoth
        - Nimbus
        - Manticore
        - MiniBike
        - MiniBrowse
        - MiniBus
        - MiniFast
        - MiniJuke
        - MiniUpdate
        - MuddyWater
        - NukeSped
        - OilRig
        - Panda
        - Sandstorm
        - SandWorm
        - Seamonkey
        - Sleet
        - SlugResin
        - SnailResin
        - Snake
        - Tempest
        - Tsunami
        - Turla
        - Typhoon
        - UAC_
        - UAC-
        - UNC_
        - UNC-
        - VinoSiren
        - Winnti
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL