Detectioncriticalexperimental
Antivirus - APT Malware Signature
Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Antivirus Alert
CategoryAntivirus Alert← raw: antivirus
Detection Logic
Detection Logic1 selector
detection:
selection:
- Signature|re:
- 'APT\d'
- 'ATK\d'
- 'UNC\d'
- 'UAC\d'
- Signature|contains:
- "[APT]"
- 'APT_'
- 'APT-'
- 'BackOrder'
- 'BlindingCan'
- 'Blizzard'
- 'Chollima'
- 'Cleaver'
- 'Cobra'
- 'DarkHotel'
- 'Dragon'
- 'DTrack'
- 'Equation'
- 'GiftedCrook'
- 'GraphSteel'
- 'GreyEnergy'
- 'GEnergy'
- 'GrimPlant'
- 'Hydra'
- 'Jackal'
- 'Kitten'
- 'Kimsuky'
- 'Lazar' # Lazarus
- 'LightRail'
- 'Lotus'
- 'Luminous'
- 'LumiMoth'
- 'Nimbus'
- 'Manticore'
- 'MiniBike'
- 'MiniBrowse'
- 'MiniBus'
- 'MiniFast'
- 'MiniJuke'
- 'MiniUpdate'
- 'MuddyWater'
- 'NukeSped'
- 'OilRig'
- 'Panda'
- 'Sandstorm'
- 'SandWorm'
- 'Seamonkey'
- 'Sleet'
- 'SlugResin'
- 'SnailResin'
- 'Snake'
- 'Tempest'
- 'Tsunami'
- 'Turla'
- 'Typhoon'
- 'UAC_'
- 'UAC-'
- 'UNC_'
- 'UNC-'
- 'VinoSiren'
- 'Winnti'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
References
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
101a1877-2cf4-474d-abfd-7f6ac4788d1a
Status
experimental
Level
critical
Type
Detection
Created
Mon Jun 15
Path
rules/category/antivirus/av_advanced_persistent_threat.yml
Raw Tags
attack.executionattack.t1203attack.command-and-controlattack.t1219.002