Antivirus - APT Malware Signature

SIGMA detection rule by Arnim Rupp (Nextron Systems) · NOASSERTION

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

title: Antivirus - APT Malware Signature
id: 101a1877-2cf4-474d-abfd-7f6ac4788d1a
status: experimental
description: |
    Detects a highly relevant Antivirus alert that reports APT malware.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
author: Arnim Rupp (Nextron Systems)
date: 2026-06-15
tags:
    - attack.execution
    - attack.t1203
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: antivirus
detection:
    selection:
        - Signature|re:
              - 'APT\d'
              - 'ATK\d'
              - 'UNC\d'
              - 'UAC\d'
        - Signature|contains:
              - "[APT]"
              - 'APT_'
              - 'APT-'
              - 'BackOrder'
              - 'BlindingCan'
              - 'Blizzard'
              - 'Chollima'
              - 'Cleaver'
              - 'Cobra'
              - 'DarkHotel'
              - 'Dragon'
              - 'DTrack'
              - 'Equation'
              - 'GiftedCrook'
              - 'GraphSteel'
              - 'GreyEnergy'
              - 'GEnergy'
              - 'GrimPlant'
              - 'Hydra'
              - 'Jackal'
              - 'Kitten'
              - 'Kimsuky'
              - 'Lazar'  # Lazarus
              - 'LightRail'
              - 'Lotus'
              - 'Luminous'
              - 'LumiMoth'
              - 'Nimbus'
              - 'Manticore'
              - 'MiniBike'
              - 'MiniBrowse'
              - 'MiniBus'
              - 'MiniFast'
              - 'MiniJuke'
              - 'MiniUpdate'
              - 'MuddyWater'
              - 'NukeSped'
              - 'OilRig'
              - 'Panda'
              - 'Sandstorm'
              - 'SandWorm'
              - 'Seamonkey'
              - 'Sleet'
              - 'SlugResin'
              - 'SnailResin'
              - 'Snake'
              - 'Tempest'
              - 'Tsunami'
              - 'Turla'
              - 'Typhoon'
              - 'UAC_'
              - 'UAC-'
              - 'UNC_'
              - 'UNC-'
              - 'VinoSiren'
              - 'Winnti'
    condition: selection
falsepositives:
    - Unlikely
level: critical

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

00ce02eb-eb8c-42d2-9af9-33294e499ddf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion