Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,455 rules
Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share
Flags cmd.exe command lines that mount an Internet WebDAV share with net use and immediately execute content from DavWWWRoot.
pH-T (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2022-09-01Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types
Flags schtasks.exe commands that create/modify tasks to run on ONLOGON/ONSTART/ONCE/ONIDLE with SYSTEM or HIGHEST privileges.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium3610Free2022-08-31Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine
Alerts on Windows command lines containing Wscript.Shell.Run keyword sequence, suggesting script-driven shell execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium123Free2022-08-31Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)
Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh451Free2022-08-30Windows Network Connection from Cmstp.EXE (Outbound)
Alerts on outbound network connections initiated by cmstp.exe, which is uncommon and may indicate process misuse.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh60Free2022-08-30Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths
Alerts when cmstp.exe loads DLL/OCX from suspicious directories on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh82Free2022-08-30Windows RTCore64 Service Installation via Service Control Manager (Event ID 7045)
Alerts on creation of the RTCore64 Windows service via Service Control Manager Event ID 7045.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemHigh101Free2022-08-30Windows SharpLdapWhoami Execution via LDAP Whoami Methods
Flags execution of SharpLdapWhoami on Windows using LDAP-related whoami alternative method parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh178Free2022-08-29Potential DLL Sideloading via DeviceEnroller.exe Using /PhoneDeepLink
Alerts on deviceenroller.exe runs with /PhoneDeepLink, a potential DLL sideloading trigger referencing ShellChromeAPI.dll.
"@gott_cyber, Huntrule Team"Windowsprocess_creationMedium449Free2022-08-29Windows Registry Detection: COM TreatAs(Default) Hijacking
Flags registry changes to COM TreatAs(Default) keys, excluding common Office/ClickToRun and installer processes.
frack113, Huntrule TeamWindowsregistry_setMedium92Free2022-08-28Windows Process Creation: nimgrab.exe Execution (Nim Tool Download Behavior)
Alerts on execution of nimgrab.exe on Windows when hashes match known indicators.
frack113, Huntrule TeamWindowsprocess_creationHigh163Free2022-08-28Windows Network Connections by wscript/cscript Script Interpreters to Non-Local IPs
Flags wscript.exe/cscript.exe making outbound connections to non-local destination IPs.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh141Free2022-08-28Windows Wscript/Cscript Initiating Local Network Connection for Script Retrieval
Flags wscript.exe or cscript.exe making connections to local/private destination IP ranges on Windows.
frack113, Huntrule TeamWindowsnetwork_connectionMedium123Free2022-08-28Windows Scheduled Task Index Registry Tampering Hiding Tasks from Query Tools
Alerts on registry set events that tamper scheduled task TaskCache Tree "Index" DWORD to 0.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh123Free2022-08-26Windows Registry: Scheduled Task Index Value Removal to Hide Task (TaskCache)
Alerts on deletion of the Scheduled Tasks TaskCache Tree 'Index' value used by tools to enumerate tasks.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_deleteMedium151Free2022-08-26