Sigma to Elastic ES|QL

Sigma

title: Base64 Encoding Via Built-In Windows Utility
id: 7c1e0a34-2b5f-4d18-9a63-0c8b1f4e5a71
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a built-in utility being asked to
    base64-encode a file, which is a common way to stage data before moving it off a host.
    The flag is written out in both its dash and slash spellings, because the utility
    accepts either and a rule that names only one misses half the invocations.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains:
            - '-encode'
            - '/encode'
    condition: all of selection_*
falsepositives:
    - Administrative scripts that legitimately encode files
level: medium

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND ((TO_LOWER(process.executable) LIKE """*\\certutil.exe""" OR TO_LOWER(process.pe.original_file_name) LIKE """certutil.exe""") AND (TO_LOWER(process.command_line) LIKE """*-encode*""" OR TO_LOWER(process.command_line) LIKE """*/encode*"""))

Sigma

title: PowerShell Download Cradle On The Command Line
id: 1f9d4c02-6a77-4e5b-8c31-2d0af7b96e48
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the download-and-run pattern where a
    remote payload is fetched and executed in one command. It exercises a value list under a
    single field, which every backend has to expand into its own OR form.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_fetch:
        CommandLine|contains:
            - '.DownloadString('
            - '.DownloadFile('
            - 'Invoke-WebRequest '
            - 'Invoke-RestMethod '
    selection_run:
        CommandLine|contains:
            - '| IEX'
            - 'IEX ('
            - 'Invoke-Expression'
    condition: all of selection_*
falsepositives:
    - Installers and package managers that fetch and run their own payloads
level: high

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND ((TO_LOWER(process.command_line) LIKE """*.downloadstring(*""" OR TO_LOWER(process.command_line) LIKE """*.downloadfile(*""" OR TO_LOWER(process.command_line) LIKE """*invoke-webrequest *""" OR TO_LOWER(process.command_line) LIKE """*invoke-restmethod *""") AND (TO_LOWER(process.command_line) LIKE """*| iex*""" OR TO_LOWER(process.command_line) LIKE """*iex (*""" OR TO_LOWER(process.command_line) LIKE """*invoke-expression*"""))

Sigma

title: Registry Import With A Suspicious Path
id: 5b3a8e91-4c26-4f70-b1d8-6e97c30a2f5d
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects a registry import whose argument does
    not look like an ordinary file path. It exercises a regular expression alongside a `not`
    filter, so the report has both a regex to check against the target's engine and a negated
    branch to place.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains: '.reg'
        CommandLine|re: ':[^ \\]'
    filter_flags:
        CommandLine|contains|windash:
            - ' -e '
            - ' -a '
    condition: all of selection_* and not filter_flags
falsepositives:
    - Scripted registry maintenance
level: high

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND ((TO_LOWER(process.executable) LIKE """*\\regedit.exe""" OR TO_LOWER(process.pe.original_file_name) LIKE """regedit.exe""") AND TO_LOWER(process.command_line) LIKE """*.reg*""" AND process.command_line RLIKE """.*:[^ \\].*""" AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* -e *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* /e *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* –e *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* —e *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* ―e *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* -a *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* /a *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* –a *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* —a *"""))) AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """* ―a *"""))))

Sigma

title: File Copy Through The Print Utility
id: 3e6c17b8-9f40-4a2d-85e1-7b4d0c9a6f23
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the print utility being used to copy an
    executable rather than to print. It exercises `startswith` together with `contains|all`, where
    several substrings must all appear in one field.
author: HuntRule Team
date: 2026-08-01
tags:
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\print.exe'
        CommandLine|startswith: 'print'
        CommandLine|contains|all:
            - '/D'
            - '.exe'
    filter_self:
        CommandLine|contains: 'print.exe'
    condition: selection and not filter_self
falsepositives:
    - Printing a file whose name ends in .exe
level: medium

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND (TO_LOWER(process.executable) LIKE """*\\print.exe""" AND TO_LOWER(process.command_line) LIKE """print*""" AND TO_LOWER(process.command_line) LIKE """*/d*""" AND TO_LOWER(process.command_line) LIKE """*.exe*""" AND ((process.command_line IS NULL OR NOT (TO_LOWER(process.command_line) LIKE """*print.exe*"""))))

Sigma

title: Scheduled Task Created From A Temp Path
id: 9d24a3ee-8a1b-4f26-b90f-4a71e2c85d17
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects schtasks.exe registering a task whose
    command line points into a temp directory, a common persistence shape. It exercises the
    bread-and-butter Sigma form — several selections ANDed by the condition — with no exotic
    modifiers, so it converts on every shipped target.
author: HuntRule Team
date: 2026-08-11
tags:
    - attack.persistence
    - attack.t1053.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\schtasks.exe'
    selection_create:
        CommandLine|contains: '/create'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\Windows\Temp\'
    condition: all of selection_*
falsepositives:
    - Installers registering update tasks from their extraction directory
level: medium

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND (TO_LOWER(process.executable) LIKE """*\\schtasks.exe""" AND TO_LOWER(process.command_line) LIKE """*/create*""" AND (TO_LOWER(process.command_line) LIKE """*\\appdata\\local\\temp\\*""" OR TO_LOWER(process.command_line) LIKE """*\\windows\\temp\\*"""))

Sigma

title: LSASS Memory Dump Via Comsvcs
id: 6a95c2d4-1e08-4f7b-9d52-8c41e7b30a96
status: experimental
description: |
    A sample rule for the huntrule.com converter. Detects the comsvcs.dll MiniDump export being
    invoked through rundll32 to dump process memory, a common LSASS credential-theft technique.
    It exercises `endswith` against the image path together with `contains|all` on one field.
author: HuntRule Team
date: 2026-08-10
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'comsvcs'
            - 'MiniDump'
    condition: all of selection_*
falsepositives:
    - Administrators legitimately capturing a process dump with comsvcs
level: high

Elastic Security · ES|QL

FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security*, winlogbeat-*
| WHERE event.category == "process" AND event.type == "start" AND (TO_LOWER(process.executable) LIKE """*\\rundll32.exe""" AND TO_LOWER(process.command_line) LIKE """*comsvcs*""" AND TO_LOWER(process.command_line) LIKE """*minidump*""")