antivirus

Antivirus - APT Malware Signature

Jul 1, 2026 · attack.execution attack.t1203 attack.command-and-control attack.t1219.002 ·

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Exploitation Framework Signature

Jul 1, 2026 · attack.execution attack.t1203 attack.command-and-control attack.t1219.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Hacktool Signature

Jul 1, 2026 · attack.execution attack.t1204 ·

Share on:

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Password Dumper Signature

Jul 1, 2026 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.

Antivirus - Ransomware Signature

Jul 1, 2026 · attack.t1486 attack.impact ·

Share on:

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Relevant File Paths Alerts Signature

Jul 1, 2026 · attack.resource-development attack.t1588 ·

Share on:

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Remote Access Tools Signature

Jul 1, 2026 · attack.execution attack.t1203 attack.command-and-control attack.t1219.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Antivirus - Web Shell Detection Signature

Jul 1, 2026 · attack.persistence attack.t1505.003 ·

Share on:

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.