Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
407 rules
Webserver URL Enumeration for Exposed .git Paths via GET Keyword
Alerts when web requests include .git/ in the URL, suggesting source code enumeration against version control paths.
James Ahearn, Huntrule TeamWebwebserverMedium142Free2019-06-08Microsoft BITS Proxy Requests to Uncommon Top-Level Domains
Flags Microsoft BITS-initiated proxy requests to domains using uncommon TLDs.
Florian Roth (Nextron Systems), Tim Shelton, Huntrule TeamWebproxyHigh249Free2019-03-07Apache thread assertion error in error.log
Flags Apache error log entries that include a pthread thread-priority assertion failure message.
Florian Roth (Nextron Systems), Huntrule TeamWebapacheMedium445Free2019-01-22Suspicious Telegram API proxy access without Telegram User-Agent
Alerts on api.telegram.org requests where the User-Agent lacks common Telegram bot identifiers.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium152Free2018-06-05Windows Proxy Activity Using Microsoft-WebDAV-MiniRedir GET User-Agent
Alerts on proxy HTTP GET requests using the Microsoft-WebDAV-MiniRedir/ User-Agent prefix associated with file download behavior.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh90Free2018-04-06Proxy Downloads of Executables and Documents from Suspicious Dynamic DNS Domains
Alerts when proxy traffic downloads common executable or document payload types from a curated list of dynamic DNS hostnames.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium433Free2017-11-08Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)
Alerts when proxy users download common malware and lure file types from hosts using suspicious TLDs.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyLow485Free2017-11-07Proxy Web Requests for Flash Player Installer from Unofficial Locations
Flags proxy downloads for Flash Player installer paths when the request host is not ending in .adobe.com.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh133Free2017-10-25Suspicious Malformed User-Agent Strings in Proxy Logs
Flags proxy requests whose User-Agent headers are malformed or match suspicious automation/tooling patterns, excluding known Adobe/Acrobat traffic.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh225Free2017-07-08Suspicious Malware User-Agent Strings in Proxy Logs
Alerts on proxy traffic with user-agent values and substrings commonly seen in malware communications.
Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWebproxyHigh161Free2017-07-08Proxy logs: Detect suspicious hack tool user agents from known scanning and SQLi tools
Alerts on proxy requests with User-Agent values commonly used by scanners and hack tools, indicating automated probing or exploitation attempts.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh143Free2017-07-08Proxy logs: suspicious exploit framework User-Agent strings
High-severity match on proxy User-Agent strings commonly seen in exploit/pentest frameworks.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh192Free2017-07-08Proxy HTTP Requests with Empty User-Agent Header
Flags proxy HTTP traffic with an empty User-Agent header, which may indicate automation or unusual client behavior.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium111Free2017-07-08Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)
Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium211Free2017-03-13Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains
Finds proxy traffic requesting executable or script/doc payloads from hosts with suspicious TLDs not in the whitelist.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyLow102Free2017-03-13