Windows Application Logs: Match Antivirus/Malware Signature Keywords
Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.
- Product
- windows
- Service
- application
- Author
- Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
- Published
- 2017-02-19
- Updated
- 2026-10-13
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows application log entries containing known antivirus signature names and malware-related keywords such as backdoors, keyloggers, credential dumping tools, webshells, and ransomware-related terms. Attackers may leave these strings in log-producing activities like scanning results, tool execution output, or other application-generated messages during malicious tradecraft. The detection relies on keyword matches across the application log text, with optional exclusions for specific anti-ransomware and cracking/keygen indicators and filtering by an information-level field.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
- virustotal.comhttps://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
- virustotal.comhttps://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
- nextron-systems.comhttps://www.nextron-systems.com/?s=antivirus
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-10-13
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Application Logs: Match Antivirus/Malware Signature Keywords"
id: df8e5254-4190-4ed1-881f-8555f680b7ee
status: test
description: This rule flags Windows application log entries containing known antivirus signature names and malware-related keywords such as backdoors, keyloggers, credential dumping tools, webshells, and ransomware-related terms. Attackers may leave these strings in log-producing activities like scanning results, tool execution output, or other application-generated messages during malicious tradecraft. The detection relies on keyword matches across the application log text, with optional exclusions for specific anti-ransomware and cracking/keygen indicators and filtering by an information-level field.
references:
- https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
- https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
- https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
- https://www.nextron-systems.com/?s=antivirus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2017-02-19
modified: 2026-10-12
tags:
- attack.resource-development
- attack.t1588
logsource:
product: windows
service: application
detection:
keywords_generic:
- Adfind
- "ASP/BackDoor "
- ATK/
- Backdoor.ASP
- Backdoor.Cobalt
- Backdoor.JSP
- Backdoor.PHP
- Blackworm
- Brutel
- BruteR
- Chopper
- Cobalt
- COBEACON
- Cometer
- CRYPTES
- Cryptor
- Destructor
- DumpCreds
- Exploit.Script.CVE
- FastReverseProxy
- Filecoder
- "GrandCrab "
- HackTool
- _HKTL
- -HKTL
- .HKTL
- /HKTL
- HKTL_
- HKTL-
- HKTL.
- HKTL/
- HTool-
- HTool.
- HTool/
- HTool_
- -HTool
- /HTool
- .HTool
- _HTool
- IISExchgSpawnCMD
- Impacket
- "JSP/BackDoor "
- Keylogger
- Koadic
- Krypt
- Lazagne
- Metasploit
- Meterpreter
- MeteTool
- mikatz
- Mimikatz
- Mpreter
- MsfShell
- Nighthawk
- Packed.Generic.347
- PentestPowerShell
- Phobos
- "PHP/BackDoor "
- Potato
- PowerSploit
- PowerSSH
- PshlSpy
- PSWTool
- PWCrack
- PWDump
- Ransom
- Rozena
- Ryzerlo
- Sbelt
- Seatbelt
- "SecurityTool "
- SharpDump
- Shellcode
- Sliver
- Splinter
- Swrort
- Tescrypt
- TeslaCrypt
- TurtleLoader
- Valyria
- Webshell
keywords_re:
"|re": \bHKTL\b
filter_optional_generic:
- anti_ransomware_service.exe
- Anti-Ransomware
- Crack
- cyber-protect-service.exe
- encryptor
- Keygen
filter_optional_information:
Level: 4
filter_optional_restartmanager:
Provider_Name: Microsoft-Windows-RestartManager
condition: 1 of keywords_* and not 1 of filter_optional_*
falsepositives:
- Some software piracy tools (key generators, cracks) are classified as hack tools
level: high
license: DRL-1.1
related:
- id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
type: derived