Detectioncriticalexperimental
Antivirus - Remote Access Tools Signature
Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Antivirus Alert
CategoryAntivirus Alert← raw: antivirus
Detection Logic
Detection Logic1 selector
detection:
selection:
Signature|contains:
- 'AgentB'
- 'AgentTesla'
- 'AMRat'
- 'Ammyy'
- 'AsyncRAT'
- 'Bandook'
- 'Bitrat'
- 'Bladabindi'
- 'Connectwise'
- 'CyberGate'
- 'DarkComet'
- 'DCrat'
- 'Delf'
- 'DokStorm'
- 'Egairtigado'
- 'Gh0st'
- 'Gorat'
- 'GodRat'
- 'Jalapeno'
- 'LummaC2'
- 'Minirat'
- 'Netwire'
- 'NanoCore'
- 'NJRat'
- 'Paralax'
- 'PlugX'
- 'Pulsar'
- 'Quasar'
- 'Remcos'
- 'Ravartar'
- 'RemoteAdmin'
- 'RemoteTool'
- 'revengeRAT'
- 'rokRAT'
- 'salatstealer'
- 'Salgorea'
- 'SmokedHam'
- 'TigerRat'
- 'Tzeebot'
- 'WarZone'
- 'VenomRAT'
- 'Vidar'
- 'Wirenet'
- 'XWorm'
- 'Zapchast'
- 'Zegost'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
97233998-3838-4581-88c6-f1d19d3993fb
Status
experimental
Level
critical
Type
Detection
Created
Mon Jun 15
Path
rules/category/antivirus/av_remote_access_toolkit.yml
Raw Tags
attack.executionattack.t1203attack.command-and-controlattack.t1219.002