Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
5,854 rules
Windows Process Memory Dump via comsvcs.dll using rundll32
Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.
Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh171Free2020-02-18Windows Process Creation: Sticky Keys Backdoor via sethc.exe Replacement
Flags forced replacement of C:\Windows\System32\sethc.exe with cmd.exe consistent with a Sticky Keys backdoor.
Sreeman, Huntrule TeamWindowsprocess_creationCritical146Free2020-02-18Windows: Flag SettingSyncHost.exe used to execute RoamDiag.cmd from cmd.exe
Flags non-System32/SysWOW64 processes spawned by SettingSyncHost.exe running RoamDiag.cmd via cmd.exe /c -outputpath.
Anton Kutepov, oscd.community, Huntrule TeamWindowsprocess_creationHigh396Free2020-02-05Windows HackTool: Dumpert Process Dumper Execution
Detects Dumpert execution on Windows via known hash and command line reference to Dumpert.dll for lsass memory dumping.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical275Free2020-02-04Windows File Creation of Dumpert Default Dump (dumpert.dmp)
Alerts on creation of Dumpert’s default "dumpert.dmp" dump file on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventCritical273Free2020-02-04PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)
Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh173Free2020-01-29Windows renamed dctask64.exe execution via known IMPHASH values
Flags Windows process creations where a renamed dctask64.exe execution matches known IMPHASH values.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh111Free2020-01-28Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh152Free2020-01-28Windows MSTSC Shadowing CommandLine Using shadow:
Flags Windows processes launching MSTSC with noconsentprompt and shadow: parameters consistent with RDP session shadowing.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh161Free2020-01-24Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Alerts on Windows Audit-CVE EventID 1 entries from Microsoft-Windows-Audit-CVE provider indicating CveEventWrite activity.
Florian Roth (Nextron Systems), Zach Mathis, Huntrule TeamWindowsapplicationCritical442Free2020-01-15Windows Process Command Lines Using System32/SysWow64 Tasks Folder
Alerts on process command lines referencing the writable System32/SysWow64 Tasks folders with common file staging/copy primitives.
Sreeman, Huntrule TeamWindowsprocess_creationHigh113Free2020-01-13Windows Process: curl Download with HTTP Output Redirect and Command Chaining
Flags Windows commands where curl downloads over HTTP with -o and then executes via command chaining with '&'.
Sreeman, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2020-01-13Windows: Koadic Command Prompt Invocation with /q /c chcp
Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.
wagga, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh531Free2020-01-12Windows Process Access to svchost.exe with High-Rights GrantedAccess
Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.
Tim Burrell, Huntrule TeamWindowsprocess_accessHigh277Free2020-01-02Windows Registry Access to WCESERVICE Start Key
Detects registry activity targeting the WCE service Start configuration in Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsregistry_eventCritical312Free2019-12-31