Linux ClamAV Alerts: Keyword-Matched Trojan, Webshell, Rootkit, and Htran Detections

Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.

FreeUnreviewedSigmahighv1

linux-clamav-alerts-keyword-matched-trojan-webshell-rootkit-and-htran-detections-36aa86ca

title: "Linux ClamAV Alerts: Keyword-Matched Trojan, Webshell, Rootkit, and Htran Detections"
id: c79b0e54-a140-4776-ad7c-15e54ddb5f63
status: stable
description: This rule flags ClamAV alert messages containing specific infection-name keywords such as Trojan, VirTool, Webshell, Rootkit, or Htran. Attackers commonly attempt to deploy malware and stealth components; timely detection of these alert strings helps investigators triage potential compromise. The detection relies on ClamAV service logs on Linux and matches the presence of the defined keywords in alert text.
references:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-01
tags:
  - attack.resource-development
  - attack.t1588.001
logsource:
  product: linux
  service: clamav
detection:
  keywords:
    - Trojan*FOUND
    - VirTool*FOUND
    - Webshell*FOUND
    - Rootkit*FOUND
    - Htran*FOUND
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb
    type: derived

What it detects

This rule flags ClamAV alert messages containing specific infection-name keywords such as Trojan, VirTool, Webshell, Rootkit, or Htran. Attackers commonly attempt to deploy malware and stealth components; timely detection of these alert strings helps investigators triage potential compromise. The detection relies on ClamAV service logs on Linux and matches the presence of the defined keywords in alert text.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.