Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,405 rules
Windows Registry: Internet Settings Zone and Cache-related Key Modifications
Flags registry writes to Windows Internet Settings-related keys that can be abused to alter zone trust or store persistence data.
frack113, Huntrule TeamWindowsregistry_setLow133Free2022-01-22Windows Registry Set to Hide File Extensions via Explorer Advanced Keys
Flags registry changes under Explorer Advanced that hide file extensions by setting specific DWORD values.
frack113, Huntrule TeamWindowsregistry_setMedium178Free2022-01-22Windows Registry: IE ZoneMap Domain Zone Change via ZoneMap\Domains
Flags Windows registry changes to IE ZoneMap domain entries that alter security zone assignments for targeted domains.
frack113, Huntrule TeamWindowsregistry_setMedium2910Free2022-01-22Radmin Viewer Utility Execution on Windows (Process Creation)
Alerts when Radmin Viewer (Radmin.exe) is launched, based on process metadata in Windows process creation logs.
frack113, Huntrule TeamWindowsprocess_creationMedium215Free2022-01-22Windows Network Connection Initiated by IMEWDBLD.EXE
Alerts when IMEWDBLD.EXE initiates a network connection on Windows.
frack113, Huntrule TeamWindowsnetwork_connectionHigh151Free2022-01-22Windows: Suspicious colorcpl.exe file creation/copy to System32 spool drivers color
Alerts on colorcpl.exe creating files in C:\Windows\System32\spool\drivers\color\ with suspicious target filenames.
frack113, Huntrule TeamWindowsfile_eventHigh166Free2022-01-21Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters
Collects successful Windows 4769 RC4 service-ticket requests while excluding krbtgt and computer/service account patterns for kerberoasting triage.
"@kostastsale, Huntrule Team"WindowssecurityMedium343Free2022-01-21Windows: AdvancedRun executed with RunAs IDs under high-privilege service accounts
Detects AdvancedRun execution where /RunAs is set to specific high-privilege IDs in the process command line.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh102Free2022-01-20Windows PUA AdvancedRun.exe Execution
Detects AdvancedRun.exe executions on Windows with /Run and /RunAs style command-line parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium111Free2022-01-20Windows Code Integrity: Unmet Signing Level Requirements When Loading a File (Event ID 3033/3034)
Alerts on Code Integrity file-load attempts failing signing level requirements, based on Event ID 3033/3034 in Windows Code Integrity logs.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalLow162Free2022-01-20Windows PowerShell XML Document Load Used for Execution
Flags PowerShell script blocks that use XML document loading combined with expression/command execution keywords.
frack113, Huntrule TeamWindowsps_scriptMedium3810Free2022-01-19PowerShell MsXml2.XmlHttp COM Object Instantiation
Alerts on PowerShell creating an MsXml2.XmlHttp COM object through New-Object -ComObject.
frack113, MatilJ, Huntrule TeamWindowsps_scriptMedium142Free2022-01-19Windows Registry: Disable Administrative Share Creation via LanmanServer Parameters
Flags registry writes that disable Windows administrative share auto-creation under LanmanServer parameters.
frack113, Huntrule TeamWindowsregistry_setMedium151Free2022-01-16Windows msiexec.exe Quiet MSI Installation with Installer Arguments
Flags msiexec.exe launched with -q plus MSI installer switches, indicating quiet installation behavior in Windows process creation logs.
frack113, Huntrule TeamWindowsprocess_creationMedium70Free2022-01-16Windows: Suspicious msiexec.exe Command-Line Writes Install Logs with /Y
Alerts on suspicious msiexec.exe executions using the /Y argument that are not consistent with common installer locations.
frack113, Huntrule TeamWindowsprocess_creationMedium437Free2022-01-16