Detectioncriticalstable
Antivirus Exploitation Framework Detection
Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems), Arnim RuppCreated Sun Sep 09Updated Sat Nov 02238527ad-3c2c-4e4f-a1f6-92fd63adb864category
Log Source
Antivirus Alert
CategoryAntivirus Alert← raw: antivirus
Detection Logic
Detection Logic1 selector
detection:
selection:
Signature|contains:
- 'Backdoor.Cobalt'
- 'Brutel'
- 'BruteR'
- 'CobaltStr'
- 'CobaltStrike'
- 'COBEACON'
- 'Cometer'
- 'Exploit.Script.CVE'
- 'IISExchgSpawnCMD'
- 'Metasploit'
- 'Meterpreter'
- 'MeteTool'
- 'Mpreter'
- 'MsfShell'
- 'PowerSploit'
- 'Razy'
- 'Rozena'
- 'Sbelt'
- 'Seatbelt'
- 'Sliver'
- 'Swrort'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
MITRE ATT&CK
Other
attack.t1219.002
Rule Metadata
Rule ID
238527ad-3c2c-4e4f-a1f6-92fd63adb864
Status
stable
Level
critical
Type
Detection
Created
Sun Sep 09
Modified
Sat Nov 02
Path
rules/category/antivirus/av_exploiting.yml
Raw Tags
attack.executionattack.t1203attack.command-and-controlattack.t1219.002