Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
645 rules
Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution
Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.
Aayush Gupta, Huntrule TeamLinuxprocess_creationHigh252Free2025-06-17Linux mknod Syscall Used to Create Special Files
Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.
Milad Cheraghi, Huntrule TeamLinuxauditdLow241Free2025-05-31Linux sysinfo Syscall for System Information Discovery
Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.
Milad Cheraghi, Huntrule TeamLinuxauditdLow263Free2025-05-30Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)
Flags auditd syslog syscall actions that clear or suppress kernel ring buffer (dmesg) logs.
Milad Cheraghi, Huntrule TeamLinuxauditdMedium163Free2025-05-27Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes
Flags Linux events where ASLR is disabled using the personality syscall or sysctl setting kernel.randomize_va_space=0.
Milad Cheraghi, Huntrule TeamLinuxauditdHigh252Free2025-05-26Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse
Alerts on auditd PATH events referencing /sysrq or /sysrq-trigger, indicating possible Linux Magic SysRq abuse.
Milad Cheraghi, Huntrule TeamLinuxauditdMedium496Free2025-05-23Linux: Shell spawned by rsync without -e flag in command line
Flags rsync/rsyncd spawning a shell when rsync lacks the expected " -e " command-line flag.
Florian Roth, Huntrule TeamLinuxprocess_creationHigh474Free2025-01-18Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule TeamLinuxprocess_creationHigh211Free2024-09-02Linux Inline Python (-c) Calling os.system to Spawn Shell
Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh492Free2024-09-02Linux process execution of shell via nice utility
Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh393Free2024-09-02Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection
Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh338Free2024-09-02Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh232Free2024-09-02Linux: Shell Command Execution Using flock -u with Common Shell Paths
Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh444Free2024-09-02Linux Find Command Used to Execute a Shell via -exec
Flags Linux /find executions that use -exec to launch a shell interpreter.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh170Free2024-09-02Linux env Execution Spawning Common Shells
Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh152Free2024-09-02