SigmaHQ/rules/linux/lnx_clamav.yml

title: Relevant ClamAV Message
description: Detects relevant ClamAV messages
references:
    - https://github.com/ossec/ossec-hids/blob/master/etc/rules/clam_av_rules.xml
logsource:
    product: linux
    service: clamav
detection:
    keywords:
        - 'Trojan*FOUND'
        - 'VirTool*FOUND'
        - 'Webshell*FOUND'
        - 'Rootkit*FOUND'
        - 'Htran*FOUND'
    condition: keywords
falsepositives:
    - Unknown
level: high
Rule: ClamAV 2017-03-01 09:00:03 +00:00			`title: Relevant ClamAV Message`
			`description: Detects relevant ClamAV messages`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
			`- https://github.com/ossec/ossec-hids/blob/master/etc/rules/clam_av_rules.xml`
Rule: ClamAV 2017-03-01 09:00:03 +00:00			`logsource:`
			`product: linux`
			`service: clamav`
			`detection:`
			`keywords:`
			`- 'Trojan*FOUND'`
			`- 'VirTool*FOUND'`
			`- 'Webshell*FOUND'`
			`- 'Rootkit*FOUND'`
			`- 'Htran*FOUND'`
			`condition: keywords`
			`falsepositives:`
Bug and typo fixes 2017-03-14 13:52:28 +00:00			`- Unknown`
Rule: ClamAV 2017-03-01 09:00:03 +00:00			`level: high`