Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,779
Ready to search
Backends
3
Loaded from pysigma-node
pySigma Versions
2
Newest: 2.0.1
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Antivirus - Remote Access Tools Signature
Backends follow their supported pySigma version. Select 1.5.1 for Elasticsearch, Kusto, and other 1.x plugins.
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Antivirus - Remote Access Tools Signature
Using Splunk · Default · pySigma 2.0.1
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
title: Antivirus - Remote Access Tools Signature
id: 97233998-3838-4581-88c6-f1d19d3993fb
status: experimental
description: |
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
- https://www.nextron-systems.com/?s=antivirus
- https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
author: Arnim Rupp (Nextron Systems)
date: 2026-06-15
tags:
- attack.execution
- attack.t1203
- attack.command-and-control
- attack.t1219.002
logsource:
category: antivirus
detection:
selection:
Signature|contains:
- 'AgentB'
- 'AgentTesla'
- 'AMRat'
- 'Ammyy'
- 'AsyncRAT'
- 'Bandook'
- 'Bitrat'
- 'Bladabindi'
- 'Connectwise'
- 'CyberGate'
- 'DarkComet'
- 'DCrat'
- 'Delf'
- 'DokStorm'
- 'Egairtigado'
- 'Gh0st'
- 'Gorat'
- 'GodRat'
- 'Jalapeno'
- 'LummaC2'
- 'Minirat'
- 'Netwire'
- 'NanoCore'
- 'NJRat'
- 'Paralax'
- 'PlugX'
- 'Pulsar'
- 'Quasar'
- 'Remcos'
- 'Ravartar'
- 'RemoteAdmin'
- 'RemoteTool'
- 'revengeRAT'
- 'rokRAT'
- 'salatstealer'
- 'Salgorea'
- 'SmokedHam'
- 'TigerRat'
- 'Tzeebot'
- 'WarZone'
- 'VenomRAT'
- 'Vidar'
- 'Wirenet'
- 'XWorm'
- 'Zapchast'
- 'Zegost'
condition: selection
falsepositives:
- Unlikely
level: critical
CLI command
Sigma CLI 4.0.0 · Install matching versions, then run from the Phoenix project directory.
python -m pip install 'sigma-cli==4.0.0' 'pysigma==2.0.1' 'pysigma-backend-splunk==3.0.0'
sigma convert --without-pipeline -t splunk -f default 'sigma/rules/category/antivirus/av_remote_access_toolkit.yml'