Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
626 rules
Linux Password Policy Discovery via chage and passwd Commands
Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.
Ömer Günal, oscd.community, Pawel Mazur, Huntrule TeamLinuxauditdLow233Free2020-10-08Linux Process Creation: File Deletion via rm, shred, or unlink
Alerts on Linux process executions of rm, shred, or unlink used to delete files.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationInformational110Free2020-10-07Linux process attempts to delete log files using rm, rmdir, shred, or unlink
Flags Linux attempts to remove or destroy log files via rm/rmdir/shred/unlink when /var/log or mail spool paths are referenced.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationMedium200Free2020-10-07Linux System Network Discovery via Firewall/Network Tools
Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.
Ömer Günal and remotephone, oscd.community, Huntrule TeamLinuxprocess_creationInformational193Free2020-10-06Linux Cron Abuse via crontab Executed with /tmp/ File Paths
Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationMedium141Free2020-10-06Linux at/atd Process Execution via /at or /atd
Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow5310Free2020-10-06Linux Certificate Store Update: Installing Root Certificates via ca-certificates Commands
Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow252Free2020-10-05Apache Guacamole Linux: Two-User Session Presence Anomaly
Flags Guacamole sessions on Linux when telemetry indicates two users are present, suggesting anomalous or suspicious session activity.
Florian Roth (Nextron Systems), Huntrule TeamLinuxguacamoleHigh316Free2020-07-03Linux Remote File Copy via scp, rsync, or sftp
Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.
Ömer Günal, Huntrule TeamLinux—Low282Free2020-06-18Linux process commands stopping firewall and security services
Flags Linux commands that stop/disable firewall/security services or set SELinux enforcement to 0.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationMedium278Free2020-06-17Linux Process Sets HTTP/HTTPS Proxy Environment Variables
Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow196Free2020-06-17Linux Syslog Alerts for Stopping Built-in Security Tools
Alerts on syslog text indicating security tools are being stopped: iptables, firewalld, cbdaemon, or falcon-sensor.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxsyslogMedium132Free2020-06-17Linux process activity: chown root and setuid/setgid chmod flags
Alerts on Linux command lines that set root ownership and enable setuid/setgid via chmod u+s or g+s.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow121Free2020-06-16Linux auditd: New user account creation via useradd (ADD_USER/SYSCALL)
Flags Linux auditd evidence of new local user accounts created using useradd.
Marie Euler, Pawel Mazur, Huntrule TeamLinuxauditdMedium545Free2020-05-18Linux auditd: Alert on suspicious C2-related command executions
Alerts on auditd executions of common C2-adjacent tools when labeled with the "susp_activity" key.
Marie Euler, Huntrule TeamLinuxauditdMedium263Free2020-05-18