Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
5,921 rules
Windows Suspicious Outbound SMTP Connections on Common Mail Ports
Alerts on outbound, initiated SMTP connections to ports 25/465/587/2525, excluding specific mail/Exchange processes.
frack113, Huntrule TeamWindowsnetwork_connectionMedium323Free2022-01-07Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass
Detects non-default Environment\windir registry changes commonly used to facilitate SilentCleanup UAC bypass.
frack113, Nextron Systems, Huntrule TeamWindowsregistry_setHigh3910Free2022-01-06Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender
Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical122Free2022-01-06Potential DLL Injection via AccCheckConsole.exe Command-Line Parameters on Windows
Alerts on AccCheckConsole.exe executions whose CLI parameters align with loading custom verification logic via a DLL.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium233Free2022-01-06Windows PowerShell Remote Session Creation via New-PSSession
Flags PowerShell usage of New-PSSession with a ComputerName in script block logging, indicating remote session creation.
frack113, Huntrule TeamWindowsps_scriptMedium282Free2022-01-06Windows Registry: Disable User Account Control by setting EnableLUA to 0
Alerts on Windows registry changes that disable UAC by writing EnableLUA as 0.
frack113, Huntrule TeamWindowsregistry_setMedium271Free2022-01-05Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)
Monitors registry value changes to the Event Viewer command handler path indicative of a UAC bypass attempt on Windows.
frack113, Huntrule TeamWindowsregistry_setHigh173Free2022-01-05Windows Registry: Detect DelegateExecute UAC bypass via TargetObject path
Alerts on registry set events targeting \open\command\DelegateExecute with empty Details, consistent with a UAC bypass attempt.
frack113, Huntrule TeamWindowsregistry_setHigh5010Free2022-01-05Windows Process Creation: Pypykatz Credential Dumping via Registry Parsing
Alerts when pypykatz is run with "live" and "registry" parameters to extract credential data from local SAM-related artifacts.
frack113, Huntrule TeamWindowsprocess_creationHigh461Free2022-01-05Windows WinRAR Compression of .dmp/.dump Files via Command Line
Flags WinRAR executions on Windows whose command lines reference .dmp/.dump/.hdmp extensions.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium407Free2022-01-04Windows: Uncommon format.com File System Load via /fs parameter
Alerts on format.com executions with atypical /fs: parameters, which may indicate defense-evasion use of Windows utilities.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh223Free2022-01-04Windows Process Creation: createdump.exe Dumping Memory with Full and Name Flags
Flags and .dmp output usage indicate createdump.exe dumping process memory on Windows.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh418Free2022-01-04Windows Process Creation: Headless Chromium Download via dump-dom
Flags headless Chromium browser executions using dump-dom and an http URL on Windows, indicative of stealthy remote content retrieval.
Sreeman, Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh142Free2022-01-04Windows Process Creation: cscript/wscript Running gatherNetworkInfo.vbs
Alerts on cscript/wscript processes running gatherNetworkInfo.vbs, indicating potential host/network reconnaissance.
blueteamer8699, Huntrule TeamWindowsprocess_creationMedium251Free2022-01-03Suspicious PowerShell Execution with Base64 Encoded Command (Windows)
Alerts on PowerShell launched with Base64-encoded command-line parameters, excluding likely Guest Configuration noise.
frack113, Huntrule TeamWindowsprocess_creationMedium213Free2022-01-02