Nasreddine Bencherchali
95793d73bd
chore: update workflows and add quality of life updates and automation to the repository --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
104 lines
2.7 KiB
YAML
104 lines
2.7 KiB
YAML
title: Relevant Anti-Virus Event
|
|
id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8
|
|
status: test
|
|
description: This detection method points out highly relevant Antivirus events
|
|
references:
|
|
- https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
|
|
- https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
|
|
- https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
|
|
author: Florian Roth (Nextron Systems), Arnim Rupp
|
|
date: 2017/02/19
|
|
modified: 2023/07/04
|
|
tags:
|
|
- attack.resource_development
|
|
- attack.t1588
|
|
logsource:
|
|
product: windows
|
|
service: application
|
|
detection:
|
|
keywords:
|
|
- 'Adfind'
|
|
- 'ASP/BackDoor'
|
|
- 'ATK/'
|
|
- 'Backdoor.ASP'
|
|
- 'Backdoor.Cobalt'
|
|
- 'Backdoor.JSP'
|
|
- 'Backdoor.PHP'
|
|
- 'Blackworm'
|
|
- 'Brutel'
|
|
- 'BruteR'
|
|
- 'Chopper'
|
|
- 'Cobalt'
|
|
- 'COBEACON'
|
|
- 'Cometer'
|
|
- 'CRYPTES'
|
|
- 'Cryptor'
|
|
- 'Destructor'
|
|
- 'DumpCreds'
|
|
- 'Exploit.Script.CVE'
|
|
- 'Filecoder'
|
|
# - 'FRP.'
|
|
- 'FastReverseProxy'
|
|
- 'GrandCrab'
|
|
- 'HackTool'
|
|
- 'HKTL.'
|
|
- 'HKTL/'
|
|
- 'HKTL:'
|
|
- 'HTool'
|
|
- 'Impacket'
|
|
- 'IISExchgSpawnCMD'
|
|
- 'JSP/BackDoor'
|
|
- 'Keylogger'
|
|
- 'Koadic'
|
|
- 'Krypt'
|
|
- 'Lazagne'
|
|
- 'Locker'
|
|
- 'Metasploit'
|
|
- 'Meterpreter'
|
|
- 'MeteTool'
|
|
- 'Mimikatz'
|
|
- 'Mpreter'
|
|
- 'Nighthawk'
|
|
- 'Packed.Generic.347'
|
|
- 'PentestPowerShell'
|
|
- 'Phobos'
|
|
- 'PHP/BackDoor'
|
|
- 'Potato'
|
|
- 'PowerSploit'
|
|
- 'PowerSSH'
|
|
- 'PshlSpy'
|
|
- 'PSWTool'
|
|
- 'PWCrack'
|
|
- 'PWDump'
|
|
# - 'PWS.'
|
|
# - 'PWSX'
|
|
- 'Ransom'
|
|
# - 'Razy'
|
|
- 'Rozena'
|
|
# - 'Ryuk'
|
|
- 'Ryzerlo'
|
|
- 'Sbelt'
|
|
- 'Seatbelt'
|
|
- 'SecurityTool'
|
|
- 'SharpDump'
|
|
- 'Sliver'
|
|
- 'Splinter'
|
|
- 'Swrort'
|
|
- 'Tescrypt'
|
|
- 'TeslaCrypt'
|
|
- 'Valyria'
|
|
- 'Webshell'
|
|
filter_optional_generic:
|
|
- 'Keygen'
|
|
- 'Crack'
|
|
- 'anti_ransomware_service.exe'
|
|
- 'cyber-protect-service.exe'
|
|
filter_optional_information:
|
|
Level: 4 # Information level
|
|
filter_optional_restartmanager:
|
|
Provider_Name: 'Microsoft-Windows-RestartManager'
|
|
condition: keywords and not 1 of filter_optional_*
|
|
falsepositives:
|
|
- Some software piracy tools (key generators, cracks) are classified as hack tools
|
|
level: high
|