Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,143 rules
Windows PowerShell Web Access Installation via PowerShell Script Block
Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.
Michael Haag, Huntrule TeamWindowsps_scriptHigh387Free2024-09-03Windows Process Deletes Its Own Executable File
Flags Windows file deletion events where a process removes its own executable image.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium293Free2024-09-03Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe
Alerts on non-initiated (incoming) network connections tied to AnyDesk.exe or AnyDeskMSI.exe on Windows.
"@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"Windowsnetwork_connectionMedium242Free2024-09-02Windows Registry: Disable Python function execution warnings in Excel
Alerts on registry updates that disable Excel Python function execution warnings via the PythonFunctionWarnings DWORD.
Nasreddine Bencherchali (Nextron Systems), @Kostastsale, Huntrule TeamWindowsregistry_setHigh341Free2024-08-23Windows DNS Client detects queries to Put.io subdomains (api.put.io, upload.put.io)
Alert on Windows DNS Client queries containing api.put.io or upload.put.io.
Omar Khaled (@beacon_exe), Huntrule TeamWindowsdns-clientMedium555Free2024-08-23Windows Process Creation: BCP.EXE Used to Export SQL Data
Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.
Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium373Free2024-08-20Windows Process Masquerading as svchost.exe via Binary Name and Location
Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh591Free2024-08-07Windows File Access to Cryptocurrency Wallet Keystores by Uncommon Processes
Alerts on access to Ethereum/Bitcoin-style wallet files from non-standard processes on Windows.
X__Junior (Nextron Systems), Huntrule TeamWindowsfile_accessMedium499Free2024-07-29Windows Process Creation Ending in .exe With No Image Name
Flags Windows process creation events where the .exe path exists but the image name is missing, indicating possible stealth or evasion.
Matt Anderson (Huntress), Huntrule TeamWindowsprocess_creationMedium363Free2024-07-23Windows: Detect execution of renamed BOINC.exe binary
Flags renamed BOINC executables on Windows by matching OriginalFileName=BOINC.exe when the executed image name differs.
Matt Anderson (Huntress), Huntrule TeamWindowsprocess_creationMedium638Free2024-07-23PowerShell Launch With --headless From Conhost.exe on Windows
Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.
Matt Anderson (Huntress), Huntrule TeamWindowsprocess_creationMedium332Free2024-07-23Windows: Uncommon Process Access to Microsoft Teams Cookies or Local Storage leveldb
Alerts on access to Teams Cookies or leveldb files by processes other than Teams.exe on Windows.
"@SerkinValery, Huntrule Team"Windowsfile_accessMedium201Free2024-07-22Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification
Detects registry changes to COM CLSID Default InprocServer32/LocalServer32 values that point to suspicious locations.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh503Free2024-07-16Windows Process Creation: Renamed Microsoft Teams Executable Launch
Alerts when Microsoft Teams binaries are launched under renamed executable names on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium371Free2024-07-12Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)
Alerts when DsrmAdminLogonBehavior registry value is changed on Windows, except the default DWORD 0x00000000.
Nischal Khadgi, Huntrule TeamWindowsregistry_setHigh652Free2024-07-11