Relevant Anti-Virus Signature Keywords In Application Log

  1title: Relevant Anti-Virus Signature Keywords In Application Log
  2id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
  3status: test
  4description: |
  5        Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
  6references:
  7    - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
  8    - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
  9    - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
 10    - https://www.nextron-systems.com/?s=antivirus
 11author: Florian Roth (Nextron Systems), Arnim Rupp
 12date: 2017-02-19
 13modified: 2026-10-12
 14tags:
 15    - attack.resource-development
 16    - attack.t1588
 17logsource:
 18    product: windows
 19    service: application
 20detection:
 21    keywords_generic:
 22        - 'Adfind'
 23        - 'ASP/BackDoor '
 24        - 'ATK/'
 25        - 'Backdoor.ASP'
 26        - 'Backdoor.Cobalt'
 27        - 'Backdoor.JSP'
 28        - 'Backdoor.PHP'
 29        - 'Blackworm'
 30        - 'Brutel'
 31        - 'BruteR'
 32        - 'Chopper'
 33        - 'Cobalt'
 34        - 'COBEACON'
 35        - 'Cometer'
 36        - 'CRYPTES'
 37        - 'Cryptor'
 38        - 'Destructor'
 39        - 'DumpCreds'
 40        - 'Exploit.Script.CVE'
 41        - 'FastReverseProxy'
 42        - 'Filecoder'
 43        - 'GrandCrab '
 44        - 'HackTool'
 45        - '_HKTL'
 46        - '-HKTL'
 47        - '.HKTL'
 48        - '/HKTL'
 49        - 'HKTL_'
 50        - 'HKTL-'
 51        - 'HKTL.'
 52        - 'HKTL/'
 53        - 'HTool-'
 54        - 'HTool.'
 55        - 'HTool/'
 56        - 'HTool_'
 57        - '-HTool'
 58        - '/HTool'
 59        - '.HTool'
 60        - '_HTool'
 61        - 'IISExchgSpawnCMD'
 62        - 'Impacket'
 63        - 'JSP/BackDoor '
 64        - 'Keylogger'
 65        - 'Koadic'
 66        - 'Krypt'
 67        - 'Lazagne'
 68        - 'Metasploit'
 69        - 'Meterpreter'
 70        - 'MeteTool'
 71        - 'mikatz'
 72        - 'Mimikatz'
 73        - 'Mpreter'
 74        - 'MsfShell'
 75        - 'Nighthawk'
 76        - 'Packed.Generic.347'
 77        - 'PentestPowerShell'
 78        - 'Phobos'
 79        - 'PHP/BackDoor '
 80        - 'Potato'
 81        - 'PowerSploit'
 82        - 'PowerSSH'
 83        - 'PshlSpy'
 84        - 'PSWTool'
 85        - 'PWCrack'
 86        - 'PWDump'
 87        - 'Ransom'
 88        - 'Rozena'
 89        - 'Ryzerlo'
 90        - 'Sbelt'
 91        - 'Seatbelt'
 92        - 'SecurityTool '
 93        - 'SharpDump'
 94        - 'Shellcode'
 95        - 'Sliver'
 96        - 'Splinter'
 97        - 'Swrort'
 98        - 'Tescrypt'
 99        - 'TeslaCrypt'
100        - 'TurtleLoader'
101        - 'Valyria'
102        - 'Webshell'
103        # - 'FRP.'
104        # - 'Locker'
105        # - 'PWS.'
106        # - 'PWSX'
107        # - 'Razy'
108        # - 'Ryuk'
109    keywords_re:
110        '|re': '\bHKTL\b'  # also matches case-sensitively
111    filter_optional_generic:
112        - 'anti_ransomware_service.exe'
113        - 'Anti-Ransomware'
114        - 'Crack'
115        - 'cyber-protect-service.exe'
116        - 'encryptor'
117        - 'Keygen'
118    filter_optional_information:
119        Level: 4  # Information level
120    filter_optional_restartmanager:
121        Provider_Name: 'Microsoft-Windows-RestartManager'
122    condition: 1 of keywords_* and not 1 of filter_optional_*
123falsepositives:
124    - Some software piracy tools (key generators, cracks) are classified as hack tools
125level: high