Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
59 rules
Zeek DNS queries matching Tor proxy and hidden service domains
Alerts on Zeek DNS queries for Tor proxy and onion domain indicators tied to possible anonymized activity.
Saw Winn Naung , Azure-Sentinel, Huntrule TeamZeekdnsMedium142Free2021-08-15Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic
Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.
Bhabesh Raj, Huntrule TeamZeekx509High192Free2021-06-23Detect Wannacry killswitch DNS queries to hardcoded domains
Flags DNS lookups for known WannaCry killswitch domain strings and variants.
Mike Wade, Huntrule TeamNetworkdnsHigh131Free2020-09-16Zeek: Public RDP Connections from Non-Private IPv4/IPv6 Ranges
Alert on Zeek-observed RDP connections originating from non-excluded IP ranges, suggesting external accessibility.
Josh Brower @DefensiveDepth, Huntrule TeamZeekrdpHigh235Free2020-08-22Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses
Flags Zeek HTTP PUT requests with a WebDAV User-Agent that target non-excluded network addresses.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamZeekhttpLow153Free2020-05-02WebDAV Delivery of Executable Files over HTTP (Zeek)
Flags Zeek HTTP events where WebDAV traffic serves an .exe with MIME type 'dosexec'.
SOC Prime, Adam Swan, Huntrule TeamZeekhttpMedium72Free2020-05-01Zeek SMB: Network Share File Transfers of Credential-Related Filenames
Flags Zeek-observed SMB share file transfers involving credential/dump-related filenames.
"@neu5ron, Teymur Kheirkhabarov, oscd.community, Huntrule Team"Zeeksmb_filesMedium178Free2020-04-02Zeek SMB File Access to Sensitive Email/Database/Backup Extensions
Alerts on Zeek-observed SMB file accesses to filenames ending with high-value sensitive extensions.
Samir Bousseaden, @neu5ron, Huntrule TeamZeeksmb_filesMedium396Free2020-04-02Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers
Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.
Samir Bousseaden, @neu5ron, Huntrule TeamZeeksmb_filesHigh293Free2020-03-19Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence
Alerts on specific Zeek DCE-RPC endpoint/operation combinations linked to Windows persistence techniques.
"@neu5ron, SOC Prime, Huntrule Team"Zeekdce_rpcMedium3110Free2020-03-19Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start
Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.
"@neu5ron, SOC Prime, Huntrule Team"Zeekdce_rpcMedium123Free2020-03-19Cisco AAA commands: shutdown or config-register changes to boot into alternate modes
Flags Cisco AAA events referencing shutdown or config-register 0x2100/0x2142 changes that may disrupt boot or availability.
Austin Clark, Huntrule TeamCiscoaaaMedium113Free2019-08-15Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)
Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.
Austin Clark, Huntrule TeamCiscoaaaLow445Free2019-08-12Cisco AAA Configuration Modification Command Patterns
Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.
Austin Clark, Huntrule TeamCiscoaaaMedium131Free2019-08-12Cisco AAA local account and remote authentication changes
Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.
Austin Clark, Huntrule TeamCiscoaaaHigh382Free2019-08-12