Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,298 rules
Windows: WinZip executed with password flag and archive parameters indicative of data staging
Flags Windows executions of WinZip/WinZip64 using a password flag and archive parameters that can support data staging.
frack113, Huntrule TeamWindowsprocess_creationMedium218Free2021-07-27Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
frack113, Huntrule TeamWindowsprocess_creationLow171Free2021-07-27Windows: 7-Zip password-protected archive creation for potential data exfiltration
Flags 7-Zip archive creation on Windows with a password flag and archive-action parameters.
frack113, Huntrule TeamWindowsprocess_creationMedium256Free2021-07-27Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.
Craig Young, oscd.community, Georg Lauenstein, Huntrule TeamWindowsprocess_creationMedium163Free2021-07-24Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
Alerts on Windows execution of common SMB/NTLM relay and “Potato” privilege escalation hacktool indicators via process creation fields.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical161Free2021-07-24Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches
Flags execution of Windows impacket compiled binaries based on distinctive tool names in the process Image.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh469Free2021-07-24Windows File Writes of HiveNightmare-Style SAM Export Artifacts
Identifies Windows SAM export files written with HiveNightmare-style filename patterns in file events.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh428Free2021-07-23Windows Registry Changes Enabling DNS-over-HTTPS via Edge, Chrome, or Firefox Policies
Alerts on registry policy updates that enable DNS-over-HTTPS for Edge, Chrome, or Firefox on Windows.
Austin Songer, Huntrule TeamWindowsregistry_setMedium162Free2021-07-22Windows Process Creation: Netcat (ncat/cat) Suspicious Execution
Alerts on Windows process launches of Netcat-like binaries with typical listener/proxy or remote execution command-line flags.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh436Free2021-07-21Windows PowerShell Script Block Local Email Collection via Outlook COM Automation
Flags PowerShell script block text referencing Outlook COM automation used to collect locally stored email.
frack113, Huntrule TeamWindowsps_scriptMedium439Free2021-07-21PowerShell command line containing powercat invocation on Windows
Alerts when classic PowerShell starts with Powercat-related command-line strings ('powercat ' or 'powercat.ps1').
frack113, Huntrule TeamWindowsps_classic_startMedium3310Free2021-07-21Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe
Flags Windows command-line searches for key/certificate file extensions using cmd.exe, PowerShell, or findstr.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium233Free2021-07-20PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths
Flags PowerShell Compress-Archive usage writing archives to %TEMP%, AppData Local Temp, or Windows Temp.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationMedium211Free2021-07-20PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging
Flags PowerShell scripts compressing data with Compress-Archive into $env:TEMP or Temp folders.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsps_scriptMedium213Free2021-07-20Windows PowerShell module usage: Compress-Archive to store archives in Temp locations
Alerts on PowerShell Compress-Archive output written to common temp staging directories.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsps_moduleMedium121Free2021-07-20