Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,143 rules
Windows Process Creation: Microsoft QuickAssist.exe Execution
Alerts on execution of QuickAssist.exe by matching the process image ending with \QuickAssist.exe.
Muhammad Faisal (@faisalusuf), Huntrule TeamWindowsprocess_creationLow261Free2024-12-19Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Alerts when QuickAssist.exe performs DNS lookups for the Microsoft Quick Assist remote session endpoint.
Muhammad Faisal (@faisalusuf), Huntrule TeamWindowsdns_queryLow569Free2024-12-19Windows Setup16.EXE Execution Triggered by Custom .LST File
Flags Windows Setup16.EXE being invoked with ' -m ' from its system parent process, potentially tied to custom .lst-driven execution.
frack113, Huntrule TeamWindowsprocess_creationMedium323Free2024-12-01Windows Suspicious ShellExec_RunDLL via SHELL32.DLL Ordinal in Parent Command Line
Alert on Windows process starts where parent command line invokes SHELL32.DLL ShellExec_RunDLL using a matched ordinal and spawns suspicious binaries.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh429Free2024-12-01Windows File Event: Detect RTLO Filename Extension Spoofing
Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.
Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh292Free2024-11-17Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators
Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.
Ahmed Farouk, Nasreddine Bencherchali, Huntrule TeamWindowsregistry_setHigh311Free2024-11-01Windows IIS module removal event (IIS-configuration EventID 29)
Detects removal of an IIS module from Windows IIS configuration events (Event ID 29).
Nasreddine Bencherchali, Huntrule TeamWindowsiis-configurationLow233Free2024-10-06Windows IIS Configuration: New Module Added to /system.webServer/modules
Flags IIS configuration events where a new module is added under /system.webServer/modules.
frack113, Huntrule TeamWindowsiis-configurationMedium518Free2024-10-06IIS HTTP Logging Disabled via dontLog Configuration Change (Windows)
Alerts on IIS configuration updates that disable HTTP logging by setting dontLog to true for successful requests.
frack113, Huntrule TeamWindowsiis-configurationHigh522Free2024-10-06Windows IIS Configuration: Disable ETW Logging/Processing via logTargetW3C Change
Identifies IIS configuration edits that remove/disable ETW logging or processing for W3C log targeting.
frack113, Nasreddine Bencherchali, Huntrule TeamWindowsiis-configurationMedium421Free2024-10-06Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes
Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.
"@Kostastsale, Huntrule Team"Windowsprocess_creationMedium595Free2024-09-22Windows Process Initiated Connections to .btunnel.co.in Domains
Flags initiated outbound connections to .btunnel.co.in domains from a Windows host.
Kamran Saifullah, Huntrule TeamWindowsnetwork_connectionMedium292Free2024-09-13Windows: GPO Modification Adds Startup/Logon Script References
Flags GPO changes that add startup/logon scripts (SYSVOL scripts.ini) for user or computer targets using Windows directory/audit events.
Elastic, Josh Nickels, Marius Rothenbücher, Huntrule TeamWindowssecurityMedium263Free2024-09-06Windows Security: Group Policy Object modification adds privileges to user accounts
Alerts on Windows GPO attribute changes that correspond to adding privileges or making users local admins.
Elastic, Josh Nickels, Marius Rothenbücher, Huntrule TeamWindowssecurityMedium231Free2024-09-04Windows DISM Enables PowerShell Web Access Feature via Command Line
Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.
Michael Haag, Huntrule TeamWindowsprocess_creationHigh222Free2024-09-03