Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,313 rules
Windows Named Pipe Creation: Default RemCom Pipe Name
Alerts on creation of named pipes with names containing "\RemCom" on Windows.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium161Free2023-08-07Windows Named Pipe Created for CSExec Default Pipe Name
Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium385Free2023-08-07Windows RemComSvc Service Installation and Execution
Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium4010Free2023-08-07Windows Service Control Manager Detects CSExecSvc Installation and Execution
Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium193Free2023-08-07Windows Portable Gpg.exe Execution from Uncommon Paths
Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium505Free2023-08-06Windows RemCom Service File Creation via RemComSvc.exe Filename
Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium449Free2023-08-04Windows CSExec Service File Creation (csexecsvc.exe)
Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium142Free2023-08-04Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries
Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium163Free2023-08-03Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading
Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium405Free2023-08-03Windows DLL Sideloading via mfdetours.dll using mftrace.exe
Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium100Free2023-08-03Windows ImageLoad DLL Sideloading: EACore.dll
Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh182Free2023-08-03Windows DLL sideloading via AVKkid.dll image loads
Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium171Free2023-08-03Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution
Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setHigh151Free2023-08-02Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.
Muhammad Faisal, Huntrule TeamWindowsprocess_creationMedium223Free2023-08-02Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path
Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh174Free2023-08-01