Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,298 rules
Windows Named Pipe Created for CSExec Default Pipe Name
Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium345Free2023-08-07Windows RemComSvc Service Installation and Execution
Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium3610Free2023-08-07Windows Service Control Manager Detects CSExecSvc Installation and Execution
Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium163Free2023-08-07Windows Portable Gpg.exe Execution from Uncommon Paths
Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium455Free2023-08-06Windows RemCom Service File Creation via RemComSvc.exe Filename
Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium409Free2023-08-04Windows CSExec Service File Creation (csexecsvc.exe)
Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium92Free2023-08-04Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries
Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium103Free2023-08-03Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading
Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium365Free2023-08-03Windows DLL Sideloading via mfdetours.dll using mftrace.exe
Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium60Free2023-08-03Windows ImageLoad DLL Sideloading: EACore.dll
Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh102Free2023-08-03Windows DLL sideloading via AVKkid.dll image loads
Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium121Free2023-08-03Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution
Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setHigh81Free2023-08-02Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.
Muhammad Faisal, Huntrule TeamWindowsprocess_creationMedium143Free2023-08-02Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path
Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh124Free2023-08-01Windows Registry: New AppCompatFlags custom shim databases targeting system processes
Alerts on Windows registry writes to AppCompatFlags Custom shim paths targeting common system processes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh303Free2023-08-01