huntrule

Rules that
hunt.

Expert-reviewed Sigma detections for what attackers are doing now — each one with its source, its ATT&CK mapping and the telemetry it needs.

Sigma

Encoded PowerShell in Scheduled Task

logsource:
  product: windows
  service: security
detection:
  registration:
    EventID: 4698
  payload:
    TaskContent|contains:
      - '-enc '
      - '-EncodedCommand'
  condition: registration and payload
level: high

Threat intelligence moves fast. Detection engineering rarely gets the same luxury.

Track

Current technical reporting and attacker research is followed continuously, so coverage tracks the threat rather than a release calendar.

Filed by technique, not by vendor. The reporting and the detections land in the same places.

Cloud335Container6Identity26Linux475macOS156Network60Web274Windows4414

Latest rules

All rules

Windows

Malicious UAC Bypass via Eventvwr Execution Hijack via Process Creation

Windows

Malicious UAC Bypass via Fodhelper or ComputerDefaults Execution Hijack via Process Creation

macOS

Suspicious KANDYKORN Python Loader Execution via Process Creation

Windows

Suspicious GPG Decryption of Downloaded Payload via GPG

Windows

Malicious REF5961 PsExec-Style Remote Service Execution from Windows Help Directory via Process Creation

Windows

Malicious PIPEDANCE Named Pipe Command and Control Channel via Pipe Created

Fair questions. Asked before you asked.

Public reporting — an incident write-up, a vendor advisory, a malware analysis — turned into detection logic. The report is linked on the rule's own page, so the claim the rule makes and the source it makes it from can be read side by side.

A description of the traces an attacker technique leaves behind, written so a security tool can execute it. Sigma is the vendor-neutral format for log-based detection: the logic is written once and translated to whichever SIEM you run.

A rule is published once a reviewer has checked it against the reporting it came from: that the logic matches the described behaviour, that the syntax parses, that the log source and prerequisites are stated, and that the ATT&CK mapping is defensible rather than inflated.

No, and the two are never used interchangeably. Reviewed means a person approved the logic and the metadata. Validated means the rule was additionally tested against a documented dataset or lab scenario. Every rule states which one it has earned.

They are written for it, but no rule is production-ready in an environment it has never seen. Read the linked source, tune the thresholds and exclusions against your own telemetry, and run it in audit mode before it pages anyone.

Sigma, for now. The catalog stores the format alongside every rule, so further formats and product-specific detections are an addition rather than a migration.

Yes. GET /api/rules returns the published catalog as JSON with the same filters the site uses, and /api/rules/{slug} returns a single rule. There is also an llms.txt for answer engines.

Browsing is free and stays free — every rule's context, mappings, requirements and limitations are public. Premium plans carry a monthly allowance of rule unlocks and open shortly.