title: Antivirus - Remote Access Tools Signature
id: 97233998-3838-4581-88c6-f1d19d3993fb
status: experimental
description: |
    Detects a highly relevant Antivirus alert that reports a remote access tool.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
author: Arnim Rupp (Nextron Systems)
date: 2026-06-15
tags:
    - attack.execution
    - attack.t1203
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: antivirus
detection:
    selection:
        Signature|contains:
            - 'AgentB'
            - 'AgentTesla'
            - 'AMRat'
            - 'Ammyy'
            - 'AsyncRAT'
            - 'Bandook'
            - 'Bitrat'
            - 'Bladabindi'
            - 'Connectwise'
            - 'CyberGate'
            - 'DarkComet'
            - 'DCrat'
            - 'Delf'
            - 'DokStorm'
            - 'Egairtigado'
            - 'Gh0st'
            - 'Gorat'
            - 'GodRat'
            - 'Jalapeno'
            - 'LummaC2'
            - 'Minirat'
            - 'Netwire'
            - 'NanoCore'
            - 'NJRat'
            - 'Paralax'
            - 'PlugX'
            - 'Pulsar'
            - 'Quasar'
            - 'Remcos'
            - 'Ravartar'
            - 'RemoteAdmin'
            - 'RemoteTool'
            - 'revengeRAT'
            - 'rokRAT'
            - 'salatstealer'
            - 'Salgorea'
            - 'SmokedHam'
            - 'TigerRat'
            - 'Tzeebot'
            - 'WarZone'
            - 'VenomRAT'
            - 'Vidar'
            - 'Wirenet'
            - 'XWorm'
            - 'Zapchast'
            - 'Zegost'
    condition: selection
falsepositives:
    - Unlikely
level: critical