Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,158 rules
Windows Process Creation: Renamed AutoHotkey Executable via PE Metadata
Detects renamed AutoHotkey executables by correlating process creation events with PE metadata indicators.
Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationMedium272Free2023-02-07Windows nltest.exe Execution for Network Information Discovery
Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.
Arun Chauhan, Huntrule TeamWindowsprocess_creationLow250Free2023-02-03Windows cmdkey.exe Adds Generic Credentials via -g Flag
Flags -g/-u/-p with cmdkey.exe indicate generic credential insertion, which can enable follow-on access.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium554Free2023-02-03Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh170Free2023-02-02Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation
Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium527Free2023-01-31Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation
Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium203Free2023-01-31Windows PowerShell Base64-Encoded WMI Class Invocation
Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.
Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh182Free2023-01-30Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images
Alerts on registry tampering of PendingFileRenameOperations by processes running from suspicious image paths.
frack113, Huntrule TeamWindowsregistry_setMedium161Free2023-01-27Windows WMIC System Information Discovery via WMIC.EXE Recon
Flags WMIC.EXE executions running system info queries for OS and disk details.
TropChaud, Huntrule TeamWindowsprocess_creationMedium422Free2023-01-26Windows: Suspicious Child Process Spawned by VsCode code.exe
Alerts when code.exe spawns suspicious binaries, script hosts, or command-line activity that matches common execution patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium281Free2023-01-26Windows WSL Process Spawning Uncommon Child Executables
Alerts when wsl.exe or wslhost.exe spawns suspicious child binaries from common temp/public/user directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium191Free2023-01-23Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names
Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_moduleHigh555Free2023-01-23PowerShell on Windows adding Windows capabilities via Add-WindowsCapability
Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium190Free2023-01-22Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)
Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.
frack113, Huntrule TeamWindowsprocess_creationMedium150Free2023-01-22Windows IIS appcmd Creating GlobalRules URL Rewrite Configuration
Flags appcmd.exe commands that modify IIS global URL rewrite globalRules and commit the configuration.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium191Free2023-01-22