Add and update anti virus rules#6075
Conversation
There was a problem hiding this comment.
Pull request overview
This PR extends the repository’s antivirus category coverage by adding new Sigma rules for APT malware and remote access tool detections, and by updating several existing antivirus signature-based rules with additional indicators and refreshed metadata.
Changes:
- Added new antivirus rules for APT malware and remote access tools.
- Updated multiple existing antivirus rules (ransomware, password dumper/stealer, hacktool, exploitation framework) with new signature strings and updated
modifieddates.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| rules/category/antivirus/av_remote_access_toolkit.yml | New rule for AV alerts indicating remote access tools (signature substring matching). |
| rules/category/antivirus/av_advanced_persistent_threat.yml | New rule for AV alerts indicating APT-related naming/patterns (regex + substring matching). |
| rules/category/antivirus/av_password_dumper.yml | Updated password dumper/stealer indicators and refreshed metadata. |
| rules/category/antivirus/av_hacktool.yml | Added additional hacktool-related signature indicators and refreshed metadata. |
| rules/category/antivirus/av_ransomware.yml | Added additional ransomware family signature indicators and refreshed metadata. |
| rules/category/antivirus/av_exploiting.yml | Added/adjusted exploitation framework signature indicators and refreshed metadata. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
nasbench
left a comment
nasbench
left a comment
There was a problem hiding this comment.
LGTM but the rules have old style titles. Can we update them to have a prefix like the following
Antivirus - <activity> Signature
So for example Antivirus Exploitation Framework Detection becomes Antivirus - Exploitation Framework Signature
@ruppde or @swachchhanda000 if one of you can do this. Then i can merge.
Also please rename the file to reflect the title change. av_.yml
Summary of the Pull Request
Add and update anti virus rules
Changelog
new: Antivirus APT Malware
new: Antivirus Remote Access Tools
update: Antivirus Password Dumper Detection - add multiple new strings
update: Antivirus Hacktool Detection - add multiple new strings
update: Antivirus Ransomware Detection - add multiple new strings
update: Antivirus Exploitation Framework Detection - add multiple new strings
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions