Windows Application Logs: Match Antivirus Signature and Malware Keyword Hits
Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.
- Product
- windows
- Service
- application
- Author
- Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
- Published
- 2017-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application log entries that contain antivirus signature names or well-known malware tool keywords, including common backdoors, ransom terms, exploit frameworks, and credential dumping strings. Such matches can indicate an attacker’s tooling or staging activity, even when the exact malicious payload is not executed. It relies on Windows application log text containing any of the listed keyword indicators, while excluding entries that match specific optional generic filter terms and low-value information events.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
- virustotal.comhttps://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
- virustotal.comhttps://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
- nextron-systems.comhttps://www.nextron-systems.com/?s=antivirus
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Application Logs: Match Antivirus Signature and Malware Keyword Hits"
id: df8e5254-4190-4ed1-881f-8555f680b7ee
status: test
description: This rule flags application log entries that contain antivirus signature names or well-known malware tool keywords, including common backdoors, ransom terms, exploit frameworks, and credential dumping strings. Such matches can indicate an attacker’s tooling or staging activity, even when the exact malicious payload is not executed. It relies on Windows application log text containing any of the listed keyword indicators, while excluding entries that match specific optional generic filter terms and low-value information events.
references:
- https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
- https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
- https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
- https://www.nextron-systems.com/?s=antivirus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2017-02-19
modified: 2024-12-25
tags:
- attack.resource-development
- attack.t1588
logsource:
product: windows
service: application
detection:
keywords:
- Adfind
- "ASP/BackDoor "
- ATK/
- Backdoor.ASP
- Backdoor.Cobalt
- Backdoor.JSP
- Backdoor.PHP
- Blackworm
- Brutel
- BruteR
- Chopper
- Cobalt
- COBEACON
- Cometer
- CRYPTES
- Cryptor
- Destructor
- DumpCreds
- Exploit.Script.CVE
- FastReverseProxy
- Filecoder
- "GrandCrab "
- HackTool
- HKTL
- HTool-
- /HTool
- .HTool
- IISExchgSpawnCMD
- Impacket
- "JSP/BackDoor "
- Keylogger
- Koadic
- Krypt
- Lazagne
- Metasploit
- Meterpreter
- MeteTool
- mikatz
- Mimikatz
- Mpreter
- MsfShell
- Nighthawk
- Packed.Generic.347
- PentestPowerShell
- Phobos
- "PHP/BackDoor "
- Potato
- PowerSploit
- PowerSSH
- PshlSpy
- PSWTool
- PWCrack
- PWDump
- Ransom
- Rozena
- Ryzerlo
- Sbelt
- Seatbelt
- "SecurityTool "
- SharpDump
- Shellcode
- Sliver
- Splinter
- Swrort
- Tescrypt
- TeslaCrypt
- TurtleLoader
- Valyria
- Webshell
filter_optional_generic:
- anti_ransomware_service.exe
- Anti-Ransomware
- Crack
- cyber-protect-service.exe
- encryptor
- Keygen
filter_optional_information:
Level: 4
filter_optional_restartmanager:
Provider_Name: Microsoft-Windows-RestartManager
condition: keywords and not 1 of filter_optional_*
falsepositives:
- Some software piracy tools (key generators, cracks) are classified as hack tools
level: high
license: DRL-1.1
related:
- id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
type: derived