Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,313 rules
Windows devcon.exe Command Line Disabling VMware VMCI Device
Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.
Matt Anderson, Dray Agha, Anna Pham (Huntress), Huntrule TeamWindowsprocess_creationHigh224Free2026-01-02Windows Registry Set: Disable Windows Credential Guard by Zeroing EnableVirtualizationBasedSecurity
Alerts on registry value changes that zero Credential Guard/LSA configuration flags to disable virtualization-based secret protection.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_setHigh3610Free2025-12-26Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags
Flags deletion of Credential Guard/LSA-related registry values that may weaken virtualization-based secret protection.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_deleteHigh281Free2025-12-26Windows Credential Guard Registry Key Tampering via reg.exe or PowerShell Command Line
Alerts on PowerShell/Reg.exe commands that add/modify/delete DeviceGuard/LSA registry values tied to Credential Guard.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh515Free2025-12-26Windows AMSI Disabled by Registry Value Modification (AmsiEnable)
Alerts when Windows Script Settings AmsiEnable is set to 0x00000000 to disable AMSI.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_setHigh433Free2025-12-25Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell
Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh267Free2025-12-25Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell
Alerts on reg.exe or PowerShell command lines attempting to add/set AMSI enable registry settings.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh160Free2025-12-25Windows File Write by Common Executables to Uncommon Locations
Alerts when selected Windows binaries write files to typically uncommon directories such as Temp, ProgramData, AppData, or system areas.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh283Free2025-12-10Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
Alerts on Windows process activity from GitHub self-hosted runner Worker/Listener indicating spawnclient or run/configure operations.
Daniel Koifman (KoifSec), Huntrule TeamWindowsprocess_creationMedium302Free2025-11-29Windows Schtasks.exe renamed execution used to create, modify, run, or delete scheduled tasks
Alerts on scheduled task management commands that use a renamed schtasks.exe binary on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh529Free2025-11-27Windows Process Access: WerFaultSecure accessing MsMpEng with dbgcore.dll/dbghelp.dll call traces
Alerts on WerFaultSecure.exe accessing MsMpEng.exe with dbgcore/dbghelp DLLs in the call trace.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh571Free2025-11-27Windows suspicious access to LSASS.exe with dbgcore.dll/dbghelp.dll call trace from uncommon paths
Alerts on suspicious LSASS access from unusual locations when dbgcore.dll or dbghelp.dll appears in the call trace.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh213Free2025-11-27Windows Image Load: dbgcore.dll/dbghelp.dll Loaded from Uncommon User and System Paths
Alerts when dbgcore.dll or dbghelp.dll is loaded from user or other uncommon directories on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh162Free2025-11-27Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
Flags node.exe or bun.exe spawning trufflehog/gitleaks to perform secret or credential scanning.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh602Free2025-11-25Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe
Alerts when ArcSOC.exe launches cmd/cscript/mshta/powershell/wscript and similar interpreters, indicating potential remote code execution.
Micah Babinski, Huntrule TeamWindowsprocess_creationHigh140Free2025-11-25