Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,313 rules
WSL InstallLocation Registry Key Modification on Windows
Alerts on suspicious registry modifications to the WSL InstallLocation key while excluding known legitimate MSI/WSL locations.
Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_setMedium100Free2026-05-05Windows Process Creation: Masqueraded wsl.exe Execution
Flags process launches masquerading as wsl.exe by matching Image path suffix while excluding legitimate OriginalFileName values.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2026-05-05Windows Process Creation: Suspicious reg.exe or PowerShell Editing of WSL InstallLocation Registry
Flags reg.exe or PowerShell command lines editing the WSL InstallLocation registry value under Lxss MSI.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh130Free2026-05-05Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths
Alert on System32 wsl.exe spawning a wsl.exe child process when the child path isn’t in known legitimate WSL locations.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh120Free2026-05-05Windows File Event: Possible Modification of wsl.exe from Installed Location
Alerts on attempts to modify wsl.exe in installed WSL/WindowsApps locations, indicating potential binary replacement for proxy execution.
Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventMedium140Free2026-05-05Windows Print.EXE Sensitive File Dump for Credential Access
Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.
Ayush Anand (Securityinbits), Huntrule TeamWindowsprocess_creationHigh201Free2026-04-28Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type
Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium548Free2026-04-27Windows SFTP.exe Indirect Command Execution via ProxyCommand
Flags SFTP.exe executions that include ProxyCommand=, indicating potential indirect command execution.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium301Free2026-04-27Windows PUA: MemProcFS memory dump mounting via -device
Detects MemProcFS.exe execution with -device on Windows, consistent with mounting memory dumps for potential credential access.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh474Free2026-04-27Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts
Flags Windows file creation under Temp\_MEI* where NetExec nxc data files are dropped, indicating likely NetExec execution.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh201Free2026-04-08Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands
Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.
Chirag Damani, Huntrule TeamWindowsprocess_creationHigh205Free2026-03-29Windows Process Creation: curl Uploads to File-Sharing Domains
Detects curl commands on Windows uploading files to common file sharing/upload domains.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh181Free2026-03-29Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode
Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.
heyyanu, Huntrule TeamWindowsapplockerLow172Free2026-03-26Windows System Restore Registry Modification via PowerShell or reg.exe Command Line
Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh355Free2026-03-11Windows Process Creation: Python One-Liners Decoding Base64 via Command Line
Alerts on Windows Python command-line one-liners that import base64 and call decode functions.
Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh209Free2026-03-09