SigmaHQ/rules/windows/malware/av_relevant_files.yml

title: Antivirus Relevant File Paths Alerts
id: c9a88268-0047-4824-ba6e-4d81ce0b907c
description: Detects an Antivirus alert in a highly relevant file path or with a relevant file name
date: 2018/09/09
modified: 2021/05/09
author: Florian Roth, Arnim Rupp
references:
    - https://www.nextron-systems.com/2021/03/25/antivirus-event-analysis-cheat-sheet-v1-8/
logsource:
    product: antivirus
detection:
    selection:
        - FileName|startswith:
            - 'C:\Windows\'
            - 'C:\Temp\'
            - 'C:\PerfLogs\'
            - 'C:\Users\Public\'
            - 'C:\Users\Default\'
        - FileName|contains:
            - '\Client\'
            - '\tsclient\'
            - '\inetpub\'
            - '/www/'
            - 'apache'
            - 'tomcat'
            - 'nginx'
            - 'weblogic'
    selection2:
        Filename|endswith:
            - '.ps1'
            - '.psm1'
            - '.vbs'
            - '.bat'
            - '.cmd'
            - '.sh'
            - '.chm'
            - '.xml'
            - '.txt'
            - '.jsp'
            - '.jspx'
            - '.asp'
            - '.aspx'
            - '.ashx'
            - '.asax'
            - '.asmx'
            - '.php'
            - '.cfm'
            - '.py'
            - '.pyc'
            - '.pl'
            - '.rb'
            - '.cgi'
            - '.war'
            - '.ear'
            - '.hta'
            - '.lnk'
            - '.scf'
            - '.sct'
            - '.vbe'
            - '.wsf'
            - '.wsh'
            - '.gif'
            - '.png'
            - '.jpg'
            - '.jpeg'
            - '.svg'
            - '.dat'
    condition: selection or selection2
fields:
    - Signature
    - User
falsepositives:
    - Unlikely
level: high