Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
71 rules
FortiGate: Administrator Account Added via system.admin Events
Alerts on FortiGate events that add a new administrator account in system.admin.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamFortigateeventMedium553Free2025-11-01Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamZeekdnsHigh322Free2025-06-20Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions
Alerts on Zeek HTTP requests to low-reputation TLDs or URIs/MIME types consistent with executable payload delivery.
"@signalblur, Corelight, Huntrule Team"ZeekhttpMedium311Free2025-02-26Juniper BGP Logs: Missing MD5 Digest in Route Authentication
Flags Juniper BGP log messages indicating a missing MD5 digest, highlighting potential exposure from unauthenticated routing sessions.
Tim Brown, Huntrule TeamJuniperbgpLow241Free2023-01-09Huawei BGP Authentication Failures Indicating Failed Session Attempts
Flags Huawei BGP authentication failure log events that may indicate credential attempts or routing manipulation.
Tim Brown, Huntrule TeamHuaweibgpLow296Free2023-01-09Cisco LDP MD5 Authentication Failure Events
Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.
Tim Brown, Huntrule TeamCiscoldpLow142Free2023-01-09Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks
Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.
Tim Brown, Huntrule TeamCiscobgpLow318Free2023-01-09DNS Queries to OAST and Callback Domain Services
Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.
Florian Roth (Nextron Systems), Matt Kelly (list of domains), Huntrule TeamNetworkdnsHigh211Free2022-06-07Zeek DNS: Detect NKN Seed Domain Queries
Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.
Michael Portera (@mportatoes), Huntrule TeamZeekdnsLow162Free2022-04-21DNS Queries for Monero Mining Pool Domains
Alerts on DNS queries to known Monero mining pool domains that may indicate cryptomining activity.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsHigh465Free2021-10-24Zeek DNS Queries Ending in Known Crypto Mining Pool Domains
Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.
Saw Winn Naung, Azure-Sentinel, @neu5ron, Huntrule TeamZeekdnsLow161Free2021-08-19Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Flags Zeek DCE/RPC calls with operation names starting "efs" that may indicate suspicious EFS RPC usage.
"@neu5ron, @Antonlovesdnb, Mike Remen, Huntrule Team"Zeekdce_rpcMedium161Free2021-08-17Zeek DNS queries matching Tor proxy and hidden service domains
Alerts on Zeek DNS queries for Tor proxy and onion domain indicators tied to possible anonymized activity.
Saw Winn Naung , Azure-Sentinel, Huntrule TeamZeekdnsMedium192Free2021-08-15Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic
Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.
Bhabesh Raj, Huntrule TeamZeekx509High252Free2021-06-23Detect Wannacry killswitch DNS queries to hardcoded domains
Flags DNS lookups for known WannaCry killswitch domain strings and variants.
Mike Wade, Huntrule TeamNetworkdnsHigh191Free2020-09-16