Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
450 rules
Linux process: enabling BPF kprobes tracing via /sys/kernel/debug/tracing/events/kprobes
Flags Linux commands that enable BPF kprobes tracing through debugfs and probe enable endpoints in the command line.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium385Free2023-01-25Linux: Alert on bpf_probe_write_user BPF helper warning strings
Alerts on Linux log messages referencing the bpf_probe_write_user helper warning string, indicating potential suspicious eBPF usage.
Red Canary (idea), Nasreddine Bencherchali, Huntrule TeamLinux—High326Free2023-01-25Linux iptables/ufw Firewall Rule Flush via Process Execution
Flags Linux iptables/ufw activity that flushes firewall rules and can allow broad network traffic.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium387Free2023-01-18Linux UFW Disable Attempt via Process Execution
Flags Linux commands that stop/flush/unload or disable UFW, reducing firewall protection and exposure.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium248Free2023-01-18Linux mount executed with hidepid=2 option
Flags Linux mounts that include hidepid=2, a stealth configuration that hides processes from other users.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium153Free2023-01-12Linux Service File Touch with Timestamp Argument
Alerts when touch is executed with a timestamp flag on a .service file, indicating potential stealthy service manipulation.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium142Free2023-01-11Linux process execution matches known hacktools by image name
Alerts on Linux process executions of known hacktool, scanner, web enumeration, and exploit utility binaries by image name.
Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]), Huntrule TeamLinuxprocess_creationHigh403Free2023-01-03Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords
Alerts on Linux "git clone" commands that include exploit/vulnerability-related keywords or CVE/PoC-style terms.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium444Free2023-01-03Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords
Alerts when apt/yum/rpm/dpkg install commands include reconnaissance or proxy tool keywords.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium488Free2023-01-03Linux auditd: Access to hidden files or hidden directories (/. paths)
Alerts when Linux auditd shows PATH values referencing hidden files or hidden directories (excluding common dev/cache paths).
David Burkett, @signalblur, Huntrule TeamLinuxauditdLow178Free2022-12-30Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
Detects suspicious Vim/vi/vimdiff/rvim invocations that include Ex commands to run shell/proxy actions.
Nasreddine Bencherchali (Nextron Systems), Luc Génaux, Huntrule TeamLinuxprocess_creationHigh386Free2022-12-28Linux find Command Used to Discover SUID/SGID and World-Writable Files
Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium519Free2022-12-28Linux Privilege Capability Discovery via getcap
Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow162Free2022-12-28Linux process execution via apt/apt-get Pre-Invoke shell command
Detects apt/apt-get executions using APT::Update::Pre-Invoke to trigger shell-like command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium131Free2022-12-28Linux userdel Execution: User Account Deletion via userdel
Flags Linux process executions of userdel, indicating possible user account deletion and related cleanup.
Tuan Le (NCSGroup), Huntrule TeamLinuxprocess_creationMedium357Free2022-12-26