Antivirus Event Analysis Cheat Sheet v1.8.2

by Florian RothAug 16, 2021

The analysis of Antivirus events can be a tedious task in big organizations with hundreds of events per day. Usually security teams fall back to a mode of operation in which they only analyze events in which a cleanup process has failed or something went wrong.

This is definitely the wrong approach for a security team. You should instead focus on highly relevant events.

This cheat sheet helps you select these highly relevant Antivirus alerts.

Download the Antivirus Event Analysis Cheat Sheet version 1.8.2 here.

About the author:

Florian Roth

Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.