Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,463 rules
Windows PowerShell Execution of AADInternals Cmdlets (process creation)
Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.
Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2022-12-23Windows Chromium-Based Browsers Launched with Headless Debugging and User Profile Directory
Alerts on Windows launches of Chromium-based browsers in headless + remote debugging mode targeting a user data directory.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh111Free2022-12-23Suspicious X509Enrollment usage in Windows PowerShell scripts
Alerts on PowerShell script blocks containing X509Enrollment.CBinaryConverter and a specific enrollment GUID.
frack113, Huntrule TeamWindowsps_scriptMedium123Free2022-12-23PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream
Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.
frack113, Huntrule TeamWindowsps_scriptMedium161Free2022-12-23Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution
Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.
Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsps_scriptHigh103Free2022-12-23Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)
Flags Windows service installation or updates for remote access tool services using Service Control Manager events.
Connor Martin, Nasreddine Bencherchali, Huntrule TeamWindowssystemMedium458Free2022-12-23Windows Security Event 4697 Service Install of Remote Access Tools
Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.
Connor Martin, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityMedium133Free2022-12-23Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut
Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.
"@Kostastsale, Huntrule Team"Windowsprocess_creationHigh233Free2022-12-22Windows Process Creation: Impersonate.exe HackTool Execution
Flags execution of impersonate.exe (Impersonate tool) on Windows using command-line subcommands or known hashes.
Sai Prashanth Pulisetti @pulisettis, Huntrule TeamWindowsprocess_creationMedium81Free2022-12-21Windows Registry Set Detection of Suspicious Environment Variable Commands
Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh297Free2022-12-20Windows Office Binary Execution with Renamed Image Path
Alerts when Office apps are executed under renamed or unexpected image paths, helping catch stealthy masquerading on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh113Free2022-12-20Windows SQLite CLI Querying Chromium Browser Profile Databases
Alerts when SQLite CLI is used to query Chromium-based browser profile databases containing logins, cookies, or history.
TropChaud, Huntrule TeamWindowsprocess_creationHigh228Free2022-12-19Windows DLL Sideloading via comctl32.dll in .local directories
Alerts on comctl32.dll loaded from System32 .local folders, consistent with Windows DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash), Huntrule TeamWindowsimage_loadHigh4310Free2022-12-16Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32
Detects System32 *.exe.local entries that reference comctl32.dll, consistent with DLL sideloading behavior.
Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash), Huntrule TeamWindowsfile_eventHigh161Free2022-12-16Windows DLL Sideloading Indicator: JsSchHlp Loads JSESPR.dll from Untrusted Path
Alerts on unexpected loads of \JSESPR.dll, indicating possible DLL sideloading outside the Justsystem JsSchHlp directory.
frack113, Huntrule TeamWindowsimage_loadMedium153Free2022-12-14