Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,295 rules
Windows Sysprep Execution Targeting AppData Directory
Alerts when sysprep.exe runs with an AppData directory present in the command line on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium73Free2018-06-22Windows NTLM authentication events (Event ID 8002)
Alerts on Windows NTLM authentication occurrences based on Event ID 8002 from Microsoft-Windows-NTLM/Operational.
Florian Roth (Nextron Systems), Huntrule TeamWindowsntlmLow2010Free2018-06-08Windows Process Creation: svchost.exe Spawns mshta.exe (LethalHTA)
Alerts on Windows instances where svchost.exe spawns mshta.exe, indicating potential LethalHTA execution.
Markus Neis, Huntrule TeamWindowsprocess_creationHigh83Free2018-06-07Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
Alerts on NTFS ADS creation where the stream hash includes a non-null IMPHASH marker, consistent with hidden executables.
Florian Roth (Nextron Systems), @0xrawsec, Huntrule TeamWindowscreate_stream_hashMedium101Free2018-06-03Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit
Flags registry changes to IFEO GlobalFlag and SilentProcessExit keys that can enable stealthy persistence or process redirection.
Karneades, Jonhnathan Ribeiro, Florian Roth, Huntrule TeamWindowsregistry_setHigh74Free2018-04-11Windows Process Creation: Access to Domain Group Policy in SYSVOL
Flags Windows processes that reference SYSVOL \policies paths in their command line.
Markus Neis, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationMedium113Free2018-04-09Windows File Events: Known Offensive PowerShell Script File Creation
Alerts on creation of known offensive PowerShell/PowerShell module filenames on Windows.
Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein, Huntrule TeamWindowsfile_eventHigh242Free2018-04-07Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32
Alerts when mshta/PowerShell and similar script hosts spawn tasks, download/transfer, or utility tools on Windows.
Florian Roth (Nextron Systems), Tim Shelton, Huntrule TeamWindowsprocess_creationHigh218Free2018-04-06Windows: Suspicious Process Spawning from Microsoft Office Applications
Alerts when Office apps spawn common execution tools or scripts from typical attacker staging paths on Windows.
Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io, Huntrule TeamWindowsprocess_creationHigh122Free2018-04-06Windows Ping Hex IP Usage via Command Line
Flags ping.exe executions that pass a hex-encoded IPv4 address (0x????????) in the command line on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh121Free2018-03-23Windows Service Control Manager flags smbexec.py-style service installation via suspicious ImagePath
Flags suspicious Windows service installations matching a specific service name and BAT/delete command patterns in Event 7045.
Omer Faruk Celik, Huntrule TeamWindowssystemHigh103Free2018-03-20Windows Security: Registry NetNTLM Downgrade Configuration Changes
Alerts on Windows registry changes that weaken NetNTLM/NTLM security settings via LSA compatibility and restriction values.
Florian Roth (Nextron Systems), wagga, Huntrule TeamWindowssecurityHigh158Free2018-03-20Windows Process Creation: taskmgr.exe launched in LOCAL_SYSTEM context
Flags taskmgr.exe process creation when initiated under a LOCAL_SYSTEM-equivalent user context string.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh31Free2018-03-18Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#
Alerts on Windows process executions using tscon.exe-style RDP redirection to an "rdp-tcp#" destination.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh133Free2018-03-17Windows: Detect tscon.exe launched under SYSTEM context
Alerts on tscon.exe starting under a SYSTEM-associated user context based on Windows process creation logs.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh249Free2018-03-17