Relevant Anti-Virus Signature Keywords In Application Log

{
  "keywords": [
    "Adfind",
    "ASP/BackDoor ",
    "ATK/",
    "Backdoor.ASP",
    "Backdoor.Cobalt",
    "Backdoor.JSP",
    "Backdoor.PHP",
    "Blackworm",
    "Brutel",
    "BruteR",
    "Chopper",
    "Cobalt",
    "COBEACON",
    "Cometer",
    "CRYPTES",
    "Cryptor",
    "Destructor",
    "DumpCreds",
    "Exploit.Script.CVE",
    "FastReverseProxy",
    "Filecoder",
    "GrandCrab ",
    "HackTool",
    "HKTL",
    "HTool-",
    "/HTool",
    ".HTool",
    "IISExchgSpawnCMD",
    "Impacket",
    "JSP/BackDoor ",
    "Keylogger",
    "Koadic",
    "Krypt",
    "Lazagne",
    "Metasploit",
    "Meterpreter",
    "MeteTool",
    "mikatz",
    "Mimikatz",
    "Mpreter",
    "MsfShell",
    "Nighthawk",
    "Packed.Generic.347",
    "PentestPowerShell",
    "Phobos",
    "PHP/BackDoor ",
    "Potato",
    "PowerSploit",
    "PowerSSH",
    "PshlSpy",
    "PSWTool",
    "PWCrack",
    "PWDump",
    "Ransom",
    "Rozena",
    "Ryzerlo",
    "Sbelt",
    "Seatbelt",
    "SecurityTool ",
    "SharpDump",
    "Shellcode",
    "Sliver",
    "Splinter",
    "Swrort",
    "Tescrypt",
    "TeslaCrypt",
    "TurtleLoader",
    "Valyria",
    "Webshell"
  ],
  "filter_optional_generic": [
    "anti_ransomware_service.exe",
    "Anti-Ransomware",
    "Crack",
    "cyber-protect-service.exe",
    "encryptor",
    "Keygen"
  ],
  "filter_optional_information": {
    "Level": 4
  },
  "filter_optional_restartmanager": {
    "Provider_Name": "Microsoft-Windows-RestartManager"
  },
  "condition": "keywords and not 1 of filter_optional_*"
}

False Positives

• ⚠ Some software piracy tools (key generators, cracks) are classified as hack tools