Detectionhighstable

Relevant ClamAV Message

Detects relevant ClamAV messages

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Wed Mar 0136aa86ca-fd9d-4456-814e-d3b1b8e1e0bblinux

Log Source

Linuxclamav

ProductLinux← raw: linux

Serviceclamav← raw: clamav

Detection Logic

detection:
    keywords:
        - 'Trojan*FOUND'
        - 'VirTool*FOUND'
        - 'Webshell*FOUND'
        - 'Rootkit*FOUND'
        - 'Htran*FOUND'
    condition: keywords

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

github.com

MITRE ATT&CK

Tactics

TA0042 · Resource Development

Sub-techniques

T1588.001 · Malware

Rule Metadata

Rule ID

36aa86ca-fd9d-4456-814e-d3b1b8e1e0bb

Status

stable

Level

high

Type

Detection

Created

Wed Mar 01

Author

Florian Roth (Nextron Systems)

Path

rules/linux/builtin/clamav/lnx_clamav_relevant_message.yml

Raw Tags

attack.resource-developmentattack.t1588.001

View on GitHub