Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
5,955 rules
Windows ISO File Creation in User Temp and Outlook Cache Folders
Alerts on creation of .iso files in Windows AppData temp or Outlook cache paths.
"@sam0x90, Huntrule Team"Windowsfile_eventHigh151Free2022-07-30Windows DLL Search Order Hijack via Space in System Directory Paths
Alerts on .dll events targeting Windows system paths with an extra space, indicative of DLL search order hijacking.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh356Free2022-07-30Windows Sysmon Driver Altitude Registry Changes
Identifies registry writes that change the Sysmon instance altitude value, which can disrupt Sysmon loading at boot.
B.Talebi, Huntrule TeamWindowsregistry_setHigh163Free2022-07-28Windows schtasks Scheduled Task Create/Modify Running as SYSTEM
Alerts on Windows schtasks task create/modify commands that set the run account to NT AUTHORITY\SYSTEM.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh245Free2022-07-28Windows: Suspicious Scheduled Task Modification via schtasks /Change /TN
Flags schtasks.exe executions that modify existing scheduled tasks (/Change /TN) using suspicious locations and command-line payload tooling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh478Free2022-07-28Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder
Alerts on creation of .dll, .exe, or .sys files under C:\Windows\System32\spool\drivers\color.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium131Free2022-07-28Windows Registry: Appx DebugPath Key for Potential Persistence
Detects registry set activity involving AppX DebugPath entries that may indicate persistence via packaged app debug configuration.
frack113, Huntrule TeamWindowsregistry_setMedium438Free2022-07-27Windows Browser Launched with Remote Debugging Flags
Alerts on Windows launches of Chromium-based browsers or Firefox with remote debugging command-line flags.
pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium184Free2022-07-27Windows: WinRing0 Driver Load via Image Hash and File Name Match
Alerts on Windows driver loads matching WinRing0 modules by IMPhash or expected WinRing0 filenames.
Florian Roth (Nextron Systems), Huntrule TeamWindowsdriver_loadHigh182Free2022-07-26Windows: Detect SelectMyParent PPID Spoofing Tool Execution
Flags SelectMyParent.exe process creation with PPID spoofing command-line and metadata indicators on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2022-07-23Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium201Free2022-07-22Windows Service Installation: PDQDeployRunner Remote Service Creation (Service Control Manager)
Flags new Windows services installed with PDQDeployRunner-* naming via Service Control Manager event 7045.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium193Free2022-07-22Windows: Detect New PDQDeploy Service Installation via Service Control Manager
Flags new Windows services installed via SCM Event 7045 that reference PDQDeployService.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium191Free2022-07-22Windows Registry SIP Persistence via New Cryptography Provider Registration
Detects suspicious Windows registry writes that register a new SIP/Cryptography provider DLL for persistence or defense impairment.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium203Free2022-07-21Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language
Alerts on Windows registry changes to ContentIndex Natural Language DLLPathOverride values tied to SearchIndexer.exe persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh358Free2022-07-21