Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
5,957 rules
Windows Registry: New NetworkProvider service keys indicative of credential dumping
Alerts on registry additions/changes to NetworkProvider service entries that may be used to dump clear-text credentials.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium317Free2022-08-23Windows Process Creation Using the Sysnative Directory Path
Alerts on process executions referencing \Windows\Sysnative, excluding common ngen.exe and a known XAMPP bat launcher.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium182Free2022-08-23Windows Process Creation: Suspicious CLI NetworkProvider Addition for Credential Dumping
Alerts on Windows CLI executions that reference services\... and NetworkProvider, a pattern consistent with credential dumping via provider changes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh223Free2022-08-23Windows cmd.exe Command-Line Anomaly: Missing Spaces Around /c /k /r
Flags cmd.exe invocations with suspicious missing spaces around /c, /k, or /r based on process creation CommandLine patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh181Free2022-08-23Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes
Alerts on changes to Explorer TypedPaths registry entries from processes other than explorer.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh232Free2022-08-22Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe
Alerts when 'DllRegisterServer' appears in the command line while the executing image is not rundll32.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh511Free2022-08-22Windows Command-Line Persistence via TypedPaths Registry Modification
Flags command-line activity referencing the Explorer TypedPaths registry path, which may indicate persistence via registry modification.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium498Free2022-08-22Windows PUA CsExec Execution via Process Creation
Flags Windows process creation of csexec.exe (CsExec) consistent with remote execution tooling usage.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh161Free2022-08-22Windows Process Creation: Uncommon Parent Process Launching link.exe
Alerts when link.exe is spawned with a parent process outside typical Visual Studio paths.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium437Free2022-08-22Windows Process Creation: Renamed AdFind.exe Executions
Detects renamed AdFind.exe executions using AdFind-style domain discovery command-line indicators, OriginalFileName, and known binary hashes.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3310Free2022-08-21Windows PowerShell Command History Disable via Remove-Module psreadline
Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.
Ali Alwashali, Huntrule TeamWindowsps_scriptHigh337Free2022-08-21Windows Script Dropped by Signed Applications and LOLBINs
Detects Windows legitimate/signed executables dropping script files (.ps1, .vbs, .js, etc.) to disk, indicating potential script-based abuse.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh153Free2022-08-21Windows Suspicious App and LOLBIN Dropping Executable Files to Disk
Alerts on Windows processes like Office/LOLBINs writing .exe/.dll and other executable-equivalent files to disk.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh241Free2022-08-21Windows Executable Dropping Archive Files via Common LOLBINs and Office Apps
Alerts when Office or other specified Windows binaries create archive files like .zip/.rar/.7z/.diagcab/.appx on disk.
frack113, Florian Roth, Huntrule TeamWindowsfile_eventHigh247Free2022-08-21Windows Registry COM Hijacking via scrobj.dll InprocServer32(Default) Persistence
Alerts on registry modifications setting InprocServer32(Default) to scrobj.dll, indicating possible COM hijacking persistence.
frack113, Huntrule TeamWindowsregistry_setMedium203Free2022-08-20