huntrule

Windows Application Logs: Match Antivirus/Malware Signature Keywords

Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.

FreeReviewedSigma · High · v4
Product
windows
Service
application
Author
Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
Published
2017-02-19
Updated
2026-10-13
AnalysisDetection
title: "Windows Application Logs: Match Antivirus/Malware Signature Keywords"
id: df8e5254-4190-4ed1-881f-8555f680b7ee
status: test
description: This rule flags Windows application log entries containing known antivirus signature names and malware-related keywords such as backdoors, keyloggers, credential dumping tools, webshells, and ransomware-related terms. Attackers may leave these strings in log-producing activities like scanning results, tool execution output, or other application-generated messages during malicious tradecraft. The detection relies on keyword matches across the application log text, with optional exclusions for specific anti-ransomware and cracking/keygen indicators and filtering by an information-level field.
references:
  - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
  - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
  - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2017-02-19
modified: 2026-10-12
tags:
  - attack.resource-development
  - attack.t1588
logsource:
  product: windows
  service: application
detection:
  keywords_generic:
    - Adfind
    - "ASP/BackDoor "
    - ATK/
    - Backdoor.ASP
    - Backdoor.Cobalt
    - Backdoor.JSP
    - Backdoor.PHP
    - Blackworm
    - Brutel
    - BruteR
    - Chopper
    - Cobalt
    - COBEACON
    - Cometer
    - CRYPTES
    - Cryptor
    - Destructor
    - DumpCreds
    - Exploit.Script.CVE
    - FastReverseProxy
    - Filecoder
    - "GrandCrab "
    - HackTool
    - _HKTL
    - -HKTL
    - .HKTL
    - /HKTL
    - HKTL_
    - HKTL-
    - HKTL.
    - HKTL/
    - HTool-
    - HTool.
    - HTool/
    - HTool_
    - -HTool
    - /HTool
    - .HTool
    - _HTool
    - IISExchgSpawnCMD
    - Impacket
    - "JSP/BackDoor "
    - Keylogger
    - Koadic
    - Krypt
    - Lazagne
    - Metasploit
    - Meterpreter
    - MeteTool
    - mikatz
    - Mimikatz
    - Mpreter
    - MsfShell
    - Nighthawk
    - Packed.Generic.347
    - PentestPowerShell
    - Phobos
    - "PHP/BackDoor "
    - Potato
    - PowerSploit
    - PowerSSH
    - PshlSpy
    - PSWTool
    - PWCrack
    - PWDump
    - Ransom
    - Rozena
    - Ryzerlo
    - Sbelt
    - Seatbelt
    - "SecurityTool "
    - SharpDump
    - Shellcode
    - Sliver
    - Splinter
    - Swrort
    - Tescrypt
    - TeslaCrypt
    - TurtleLoader
    - Valyria
    - Webshell
  keywords_re:
    "|re": \bHKTL\b
  filter_optional_generic:
    - anti_ransomware_service.exe
    - Anti-Ransomware
    - Crack
    - cyber-protect-service.exe
    - encryptor
    - Keygen
  filter_optional_information:
    Level: 4
  filter_optional_restartmanager:
    Provider_Name: Microsoft-Windows-RestartManager
  condition: 1 of keywords_* and not 1 of filter_optional_*
falsepositives:
  - Some software piracy tools (key generators, cracks) are classified as hack tools
level: high
license: DRL-1.1
related:
  - id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
    type: derived