Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
71 rules
Zeek: Public RDP Connections from Non-Private IPv4/IPv6 Ranges
Alert on Zeek-observed RDP connections originating from non-excluded IP ranges, suggesting external accessibility.
Josh Brower @DefensiveDepth, Huntrule TeamZeekrdpHigh305Free2020-08-22Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses
Flags Zeek HTTP PUT requests with a WebDAV User-Agent that target non-excluded network addresses.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamZeekhttpLow183Free2020-05-02WebDAV Delivery of Executable Files over HTTP (Zeek)
Flags Zeek HTTP events where WebDAV traffic serves an .exe with MIME type 'dosexec'.
SOC Prime, Adam Swan, Huntrule TeamZeekhttpMedium102Free2020-05-01Zeek SMB: Network Share File Transfers of Credential-Related Filenames
Flags Zeek-observed SMB share file transfers involving credential/dump-related filenames.
"@neu5ron, Teymur Kheirkhabarov, oscd.community, Huntrule Team"Zeeksmb_filesMedium208Free2020-04-02Zeek SMB File Access to Sensitive Email/Database/Backup Extensions
Alerts on Zeek-observed SMB file accesses to filenames ending with high-value sensitive extensions.
Samir Bousseaden, @neu5ron, Huntrule TeamZeeksmb_filesMedium426Free2020-04-02Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers
Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.
Samir Bousseaden, @neu5ron, Huntrule TeamZeeksmb_filesHigh333Free2020-03-19Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence
Alerts on specific Zeek DCE-RPC endpoint/operation combinations linked to Windows persistence techniques.
"@neu5ron, SOC Prime, Huntrule Team"Zeekdce_rpcMedium3410Free2020-03-19Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start
Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.
"@neu5ron, SOC Prime, Huntrule Team"Zeekdce_rpcMedium163Free2020-03-19Cisco AAA commands: shutdown or config-register changes to boot into alternate modes
Flags Cisco AAA events referencing shutdown or config-register 0x2100/0x2142 changes that may disrupt boot or availability.
Austin Clark, Huntrule TeamCiscoaaaMedium153Free2019-08-15Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)
Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.
Austin Clark, Huntrule TeamCiscoaaaLow495Free2019-08-12Cisco AAA Configuration Modification Command Patterns
Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.
Austin Clark, Huntrule TeamCiscoaaaMedium161Free2019-08-12Cisco AAA local account and remote authentication changes
Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.
Austin Clark, Huntrule TeamCiscoaaaHigh422Free2019-08-12Cisco AAA Commands Indicating File Deletion on Local Flash Storage
Flags Cisco AAA log entries referencing flash file erase, delete, or format operations that may indicate stealthy cleanup.
Austin Clark, Huntrule TeamCiscoaaaMedium389Free2019-08-12Cisco AAA discovery via show/dir commands
Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.
Austin Clark, Huntrule TeamCiscoaaaLow409Free2019-08-12Cisco IOS AAA Crypto PKI Export/Import Commands
Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.
Austin Clark, Huntrule TeamCiscoaaaHigh395Free2019-08-12