Relevant ClamAV Message

 1title: Relevant ClamAV Message
 2id: 36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb
 3status: stable
 4description: Detects relevant ClamAV messages
 5references:
 6    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/clam_av_rules.xml
 7author: Florian Roth (Nextron Systems)
 8date: 2017-03-01
 9tags:
10    - attack.resource-development
11    - attack.t1588.001
12logsource:
13    product: linux
14    service: clamav
15detection:
16    keywords:
17        - 'Trojan*FOUND'
18        - 'VirTool*FOUND'
19        - 'Webshell*FOUND'
20        - 'Rootkit*FOUND'
21        - 'Htran*FOUND'
22    condition: keywords
23falsepositives:
24    - Unknown
25level: high

References

• ossec-hids/etc/rules/clam_av_rules.xml at 1ecffb1b884607cb12e619f9ab3c04f530801083 · ossec/ossec-hids

  

  OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. - os...

  
  Read More

Related rules

• Bitbucket Unauthorized Access To A Resource
• Bitbucket Unauthorized Full Data Export Triggered
• Conti Volume Shadow Listing
• Creation of a Diagcab
• FoggyWeb Backdoor DLL Loading