Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
450 rules
Linux Local Groups Discovery via /groups or /etc/group File Enumeration
Detects Linux commands and utilities used to enumerate local groups and read /etc/group.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationLow379Free2020-10-11Linux System Information Discovery via Common Command-Line Utilities
Flags Linux executions of uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod for system discovery behavior.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationInformational223Free2020-10-08Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u
Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.
Alejandro Ortuno, oscd.community, CheraghiMilad, Huntrule TeamLinuxprocess_creationLow495Free2020-10-08Linux System & Hardware Information Discovery via File and Version Reads
Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.
Ömer Günal, oscd.community, Huntrule TeamLinuxauditdInformational2510Free2020-10-08Linux Password Policy Discovery via chage and passwd Commands
Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.
Ömer Günal, oscd.community, Pawel Mazur, Huntrule TeamLinuxauditdLow173Free2020-10-08Linux Process Creation: File Deletion via rm, shred, or unlink
Alerts on Linux process executions of rm, shred, or unlink used to delete files.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationInformational100Free2020-10-07Linux process attempts to delete log files using rm, rmdir, shred, or unlink
Flags Linux attempts to remove or destroy log files via rm/rmdir/shred/unlink when /var/log or mail spool paths are referenced.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationMedium80Free2020-10-07Linux System Network Discovery via Firewall/Network Tools
Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.
Ömer Günal and remotephone, oscd.community, Huntrule TeamLinuxprocess_creationInformational143Free2020-10-06Linux Cron Abuse via crontab Executed with /tmp/ File Paths
Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationMedium131Free2020-10-06Linux at/atd Process Execution via /at or /atd
Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow4910Free2020-10-06Linux: Process executing update-ca-certificates or update-ca-trust
Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow182Free2020-10-05Apache Guacamole Linux: Two-User Session Presence Anomaly
Flags Guacamole sessions on Linux when telemetry indicates two users are present, suggesting anomalous or suspicious session activity.
Florian Roth (Nextron Systems), Huntrule TeamLinuxguacamoleHigh306Free2020-07-03Linux Remote File Copy via scp, rsync, or sftp
Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.
Ömer Günal, Huntrule TeamLinux—Low142Free2020-06-18Linux process commands stopping firewall and security services
Flags Linux commands that stop/disable firewall/security services or set SELinux enforcement to 0.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationMedium268Free2020-06-17Linux Process Sets HTTP/HTTPS Proxy Environment Variables
Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow156Free2020-06-17