Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,145 rules
Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs
Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium361Free2023-08-14Windows DLL sideloading via unsigned mfdetours.dll loaded by image_load
Alerts on loading unsigned \mfdetours.dll, consistent with DLL sideloading abuse via mftrace.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh200Free2023-08-11Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe
Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationHigh288Free2023-08-09Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe
Flags Gpg4win (gpg.exe/gpg2.exe) executions using passphrase-based encryption on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium160Free2023-08-09Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)
Identifies Windows Gpg4win (gpg.exe/gpg2.exe) decryption commands that include a passphrase keyword.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium170Free2023-08-09Windows Provisioning Registry Key Abuse Leading to Indirect Execution via Provlaunch.exe
Flags Windows command lines referencing the provisioning commands registry path commonly abused for Provlaunch.exe-based indirect execution.
Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh4410Free2023-08-08Windows: Alert on Suspicious Child Processes Spawned by provlaunch.exe
Detects provlaunch.exe launching suspicious child executables and processes from common temp/task paths on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh302Free2023-08-08Windows Named Pipe Creation: Default RemCom Pipe Name
Alerts on creation of named pipes with names containing "\RemCom" on Windows.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium261Free2023-08-07Windows Named Pipe Created for CSExec Default Pipe Name
Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium485Free2023-08-07Windows RemComSvc Service Installation and Execution
Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium4910Free2023-08-07Windows Service Control Manager Detects CSExecSvc Installation and Execution
Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium283Free2023-08-07Windows Portable Gpg.exe Execution from Uncommon Paths
Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium575Free2023-08-06Windows RemCom Service File Creation via RemComSvc.exe Filename
Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium549Free2023-08-04Windows CSExec Service File Creation (csexecsvc.exe)
Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium212Free2023-08-04Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries
Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium233Free2023-08-03