Add and update anti virus rules

[ruppde]

Summary of the Pull Request

Add and update anti virus rules

Changelog

new: Antivirus APT Malware
new: Antivirus Remote Access Tools
update: Antivirus Password Dumper Detection - add multiple new strings
update: Antivirus Hacktool Detection - add multiple new strings
update: Antivirus Ransomware Detection - add multiple new strings
update: Antivirus Exploitation Framework Detection - add multiple new strings

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull request overview

This PR extends the repository’s antivirus category coverage by adding new Sigma rules for APT malware and remote access tool detections, and by updating several existing antivirus signature-based rules with additional indicators and refreshed metadata.

Changes:

• Added new antivirus rules for APT malware and remote access tools.
• Updated multiple existing antivirus rules (ransomware, password dumper/stealer, hacktool, exploitation framework) with new signature strings and updated modified dates.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
rules/category/antivirus/av_remote_access_toolkit.yml	New rule for AV alerts indicating remote access tools (signature substring matching).
rules/category/antivirus/av_advanced_persistent_threat.yml	New rule for AV alerts indicating APT-related naming/patterns (regex + substring matching).
rules/category/antivirus/av_password_dumper.yml	Updated password dumper/stealer indicators and refreshed metadata.
rules/category/antivirus/av_hacktool.yml	Added additional hacktool-related signature indicators and refreshed metadata.
rules/category/antivirus/av_ransomware.yml	Added additional ransomware family signature indicators and refreshed metadata.
rules/category/antivirus/av_exploiting.yml	Added/adjusted exploitation framework signature indicators and refreshed metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.