huntrule

Rules that
hunt.

Expert-reviewed Sigma detections for what attackers are doing now — each one with its source, its ATT&CK mapping and the telemetry it needs.

Sigma

Encoded PowerShell in Scheduled Task

logsource:
  product: windows
  service: security
detection:
  registration:
    EventID: 4698
  payload:
    TaskContent|contains:
      - '-enc '
      - '-EncodedCommand'
  condition: registration and payload
level: high

Threat intelligence moves fast. Detection engineering rarely gets the same luxury.

Track

Current technical reporting and attacker research is followed continuously, so coverage tracks the threat rather than a release calendar.

Fair questions. Asked before you asked.

A description of the traces an attacker technique leaves behind, written so a security tool can execute it. Sigma is the vendor-neutral format for log-based detection: the logic is written once and translated to whichever SIEM you run.

A rule is published once a reviewer has checked it against the reporting it came from: that the logic matches the described behaviour, that the syntax parses, that the log source and prerequisites are stated, and that the ATT&CK mapping is defensible rather than inflated.

No, and the two are never used interchangeably. Reviewed means a person approved the logic and the metadata. Validated means the rule was additionally tested against a documented dataset or lab scenario. Every rule states which one it has earned.

They are written for it, but no rule is production-ready in an environment it has never seen. Read the linked source, tune the thresholds and exclusions against your own telemetry, and run it in audit mode before it pages anyone.

Sigma, for now. The catalog stores the format alongside every rule, so further formats and product-specific detections are an addition rather than a migration.

Yes. GET /api/rules returns the published catalog as JSON with the same filters the site uses, and /api/rules/{slug} returns a single rule. There is also an llms.txt for answer engines.

Browsing is free and stays free — every rule's context, mappings, requirements and limitations are public. Paid plans carry a monthly allowance of rule unlocks and open shortly.