McAfee Windows AV - Virus detected and not removed.

Description

McAfee Windows AV - Virus detected and not removed.

Query · wazuh

regex="$MCAFEE_VIRUS"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 18100 Group of windows rules. anchor level 0
    Matches no fields of its own.
  2. 18101 Windows informational event. anchor level 0
    Matches no fields of its own.
  3. 7500 Grouping of McAfee Windows AV rules. anchor level 0
    Matches no fields of its own.
  4. 7504 McAfee Windows AV - Virus detected and not removed. anchor level 12 this rule
    regex="$MCAFEE_VIRUS"

Refined by

2 rules chain off this one, narrowing it further.

Rule dependencies

Depends on

Raw source McAfee Windows AV - Virus detected and not removed. · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="7504" level="12">
    <if_sid>7500</if_sid>
    <regex>$MCAFEE_VIRUS</regex>
    <group>virus,pci_dss_5.1,pci_dss_5.2,pci_dss_10.6.1,pci_dss_11.4,gpg13_4.2,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_SI.3,nist_800_53_AU.6,nist_800_53_SI.4,tsc_A1.2,tsc_CC7.2,tsc_CC7.3,tsc_CC6.1,tsc_CC6.8,</group>
    <description>McAfee Windows AV - Virus detected and not removed.</description>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.