Sigma high test sigma

Antivirus - Relevant File Paths Alerts Signature

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

View Source

Detection Logic

{
  "selection_path": {
    "Filename
| contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\",
      "/www/",
      "\\inetpub\\",
      "\\tsclient\\",
      "apache",
      "nginx",
      "tomcat",
      "weblogic"
    ]
  },
  "selection_ext": {
    "Filename
| endswith": [
      ".asax",
      ".ashx",
      ".asmx",
      ".asp",
      ".aspx",
      ".bat",
      ".cfm",
      ".cgi",
      ".chm",
      ".cmd",
      ".dat",
      ".ear",
      ".gif",
      ".hta",
      ".jpeg",
      ".jpg",
      ".jsp",
      ".jspx",
      ".lnk",
      ".msc",
      ".php",
      ".pl",
      ".png",
      ".ps1",
      ".psm1",
      ".py",
      ".pyc",
      ".rb",
      ".scf",
      ".sct",
      ".sh",
      ".svg",
      ".txt",
      ".vbe",
      ".vbs",
      ".war",
      ".wll",
      ".wsf",
      ".wsh",
      ".xll",
      ".xml"
    ]
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...