Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
2,298 rules
Windows Process Creation: WebBrowserPassView.exe Execution
Flags Windows execution of WebBrowserPassView.exe, a browser password recovery tool often used for credential access.
frack113, Huntrule TeamWindowsprocess_creationMedium261Free2022-08-20Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)
Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.
frack113, Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationMedium113Free2022-08-20Windows Process Creation: TruffleSnout.exe Execution
Detects execution of TruffleSnout.exe on Windows using process creation metadata.
frack113, Huntrule TeamWindowsprocess_creationHigh141Free2022-08-20Windows: SharpUp (SharpUp.exe) Local Privilege Escalation Tool Execution
Flags SharpUp.exe execution on Windows when command line indicators reference common privilege-escalation targets.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical203Free2022-08-20Windows: DirLister.exe Execution for Directory Listing Discovery
Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.
frack113, Huntrule TeamWindowsprocess_creationLow155Free2022-08-20Windows DNS Query for _ldap.* Using LDAP-Related Discovery
Alerts on _ldap.* DNS queries from uncommon Windows processes, indicating potential LDAP/DNS service discovery.
frack113, Huntrule TeamWindowsdns_queryLow161Free2022-08-20Windows Registry Modification: Suppress Windows Security Center Notifications
Flags setting Notification_Suppress DWORD to 1 in Windows Defender UX policy to disable security center notifications.
frack113, Huntrule TeamWindowsregistry_setMedium347Free2022-08-19Windows Registry: Set DisallowRun DWORD to 0x1 to Block User Program Execution
Detects Windows registry writes setting Explorer\DisallowRun to DWORD 0x1, a defense-impairment behavior.
frack113, Huntrule TeamWindowsregistry_setMedium126Free2022-08-19Windows Registry: Disable Firewall via EnableFirewall DWORD Policies
Flags registry policy changes that set Windows Firewall EnableFirewall to 0 for Domain or Standard profiles.
frack113, Huntrule TeamWindowsregistry_setMedium235Free2022-08-19Windows Registry: Disable Windows Security Center notifications via UseActionCenterExperience
Alerts on registry updates that set UseActionCenterExperience=0 to disable Windows Security Center notifications.
frack113, Huntrule TeamWindowsregistry_setMedium197Free2022-08-19Windows Registry: Enable RDP Remote Assistance via fAllowToGetHelp
Alerts when Windows enables remote assistance via Terminal Server fAllowToGetHelp (0x1) registry change.
frack113, Huntrule TeamWindowsregistry_setMedium251Free2022-08-19Windows: Uncommon Child Processes Spawned by sigverif.exe
Alerts when sigverif.exe spawns unusual child processes on Windows, excluding common WerFault.exe cases.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium452Free2022-08-19Windows reg.exe Adds or Modifies Suspicious Registry Locations via Command Line
Alerts on reg.exe registry modifications targeting specific Windows policy, security, Defender, and credential-related paths.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh123Free2022-08-19Windows Process Creation: reg.exe Modifying Group Policy Registry Settings
Flags reg.exe commands targeting Group Policy System registry settings related to security and policy refresh.
frack113, Huntrule TeamWindowsprocess_creationMedium91Free2022-08-19Windows PresentationHost.EXE downloading files via URL in command line
Flags PresentationHost.EXE executions whose command line includes http/https/ftp URLs, indicating potential arbitrary file downloads.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium142Free2022-08-19