SigmaHQ/rules/windows/builtin/win_av_relevant_match.yml

title: Relevant Anti-Virus Event
description: This detection method points out highly relevant Antivirus events
author: Florian Roth
logsource:
    product: windows
detection:
    selection:
        EventLog: Application
    keywords:
        - HTool
        - Hacktool
        - ASP/Backdoor
        - JSP/Backdoor
        - PHP/Backdoor
        - Backdoor.ASP
        - Backdoor.JSP
        - Backdoor.PHP
        - Webshell
        - Portscan
        - Mimikatz
        - WinCred
        - PlugX
        - Korplug
        - Pwdump
        - Chopper
        - WmiExec
        - Xscan
        - Clearlog
        - ASPXSpy
    filters:
        - Keygen
        - Crack
    condition: selection and 1 of keywords and not 1 of filters
falsepositives:
    - Some software piracy tools (key generators, cracks) are classified as hack tools
level: high
Consistency between format description and examples - description/comment -> title/description - addition of reference 2017-01-10 21:40:59 +00:00			`title: Relevant Anti-Virus Event`
			`description: This detection method points out highly relevant Antivirus events`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Florian Roth`
			`logsource:`
Removed lists from log source section 2017-02-19 10:08:23 +00:00			`product: windows`
Example Updates 2016-12-27 13:49:54 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventLog: Application`
Example Updates 2016-12-27 13:49:54 +00:00			`keywords:`
			`- HTool`
			`- Hacktool`
			`- ASP/Backdoor`
			`- JSP/Backdoor`
			`- PHP/Backdoor`
			`- Backdoor.ASP`
			`- Backdoor.JSP`
			`- Backdoor.PHP`
			`- Webshell`
			`- Portscan`
			`- Mimikatz`
			`- WinCred`
			`- PlugX`
			`- Korplug`
			`- Pwdump`
			`- Chopper`
			`- WmiExec`
			`- Xscan`
			`- Clearlog`
			`- ASPXSpy`
			`filters:`
			`- Keygen`
			`- Crack`
Fixed type of condition 2017-02-16 22:49:34 +00:00			`condition: selection and 1 of keywords and not 1 of filters`
Example Updates 2016-12-27 13:49:54 +00:00			`falsepositives:`
			`- Some software piracy tools (key generators, cracks) are classified as hack tools`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: high`