Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
5,921 rules
Windows mpiexec.exe LOLBin: Flag combination with -n/n 1 for potential arbitrary execution
Alerts on Windows executions of mpiexec.exe with /n 1 or -n 1, correlated to a specific imphash, indicating LOLBin-style behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2022-01-11Windows: Detect devinit.exe MSI download flag combo (-t msi-install, -i http)
Alerts on devinit.exe command lines that combine MSI install with an HTTP download source.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium193Free2022-01-11Windows Browser Process Spawned with Inline URL Pointing to Suspicious File Extension
Flags Windows browser processes launched with an inline HTTP URL pointing to files with suspicious extensions.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium404Free2022-01-11Windows File Events: NTDS.DIT Created by Suspicious or Rare Process
Alerts on creation of ntds.dit on Windows when the creator process image/path is uncommon or located in suspicious directories.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh171Free2022-01-11Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths
Alerts when WScript/CScript writes script files (.js/.vbs/.wsf/.wsh, etc.) into common temp or Startup directories.
Tim Shelton, Huntrule TeamWindowsfile_eventHigh499Free2022-01-10Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0
Flags Windows Registry changes that disable Defender firewall by setting EnableFirewall DWORD to 0.
frack113, Huntrule TeamWindowsregistry_setMedium243Free2022-01-09Windows netsh Enables Defender Firewall Group Rules via advfirewall set rule group new enable=Yes
Flags netsh.exe command lines that create and enable Microsoft Defender Firewall group rules (enable=Yes).
frack113, Huntrule TeamWindowsprocess_creationMedium319Free2022-01-09Windows: AppCmd disables IIS HTTP logging via dontLog=true
Flags appcmd.exe commands that disable IIS HTTP logging by setting httplogging to dontLog:true.
frack113, Huntrule TeamWindowsprocess_creationHigh503Free2022-01-09Windows Dynamic C# Compilation Generates .cmdline Artifact
Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.
frack113, Huntrule TeamWindowsfile_eventLow547Free2022-01-09Windows: Detect mstsc.exe Remote Desktop connection via /v flag
Flags Windows RDP connection attempts started by mstsc.exe using the /v: target argument, excluding WSL helper scenarios.
frack113, Huntrule TeamWindowsprocess_creationMedium241Free2022-01-07Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments
Flags Ruby processes launched with Evil-WinRM parameters (-i, -u, -p), indicative of WinRM remote access attempts.
frack113, Huntrule TeamWindowsprocess_creationMedium3410Free2022-01-07PowerShell script exfiltration using Invoke-WebRequest with POST or PUT
PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.
frack113, Huntrule TeamWindowsps_scriptLow255Free2022-01-07PowerShell DNSExfiltrator command usage (DNSExfiltration)
Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.
frack113, Huntrule TeamWindowsps_scriptHigh191Free2022-01-07Windows PowerShell: Invoke-Command targeting -ComputerName via script block
Detects PowerShell Invoke-Command targeting remote hosts by matching script block text with -ComputerName.
frack113, Huntrule TeamWindowsps_scriptMedium192Free2022-01-07Windows PowerShell script enabling WinRM via Enable-PSRemoting
Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.
frack113, Huntrule TeamWindowsps_scriptMedium291Free2022-01-07