Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
165 rules
PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)
Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.
frack113, Duc.Le-GTSC, Huntrule TeamWindowsps_scriptMedium394Free2021-08-03Windows Process Creation: Automated Document and Directory Discovery via dir and findstr
Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.
frack113, Huntrule TeamWindowsprocess_creationMedium304Free2021-07-28Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.
Craig Young, oscd.community, Georg Lauenstein, Huntrule TeamWindowsprocess_creationMedium213Free2021-07-24PowerShell executes ADRecon.ps1 AD reconnaissance functions and writes ADRecon-Report.xlsx
Detects PowerShell ADRecon reconnaissance script content by matching AD discovery functions and the default ADRecon report output name.
Bhabesh Raj, Huntrule TeamWindowsps_scriptHigh355Free2021-07-16PowerShell Script Block Logging: PowerView cmdlet names match
Alerts when PowerShell ScriptBlockText includes PowerView/PowerSploit reconnaissance cmdlet names tied to domain and access discovery.
Bhabesh Raj, Huntrule TeamWindowsps_scriptHigh3910Free2021-05-18Windows Process Creation: Exchange Server Artifact Discovery and File Staging Patterns
Alerts on Exchange-focused suspicious Windows command-line activity involving dumping, temp file creation, and compression utilities.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical192Free2021-03-09macOS Remote System Discovery via arp or ping enumeration
Identifies macOS arp -a or ping to private/local IP ranges used for remote system enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational202Free2020-10-22Linux Remote System Discovery via arp and ping Process Execution
Flags Linux arp or ping commands with LAN/loopback/link-local IP range arguments consistent with remote host discovery.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationLow253Free2020-10-22Linux auditd: Network service enumeration via telnet, nmap, or netcat
Alerts when telnet/nmap/netcat-style binaries are executed on Linux via auditd, consistent with service discovery scanning.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxauditdLow519Free2020-10-21macOS System Network Connection Discovery via who, w, last, lsof, or netstat
Flags macOS process executions of who/w/last/lsof/netstat used to discover network or session information.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational241Free2020-10-19macOS Security Software Discovery via grep of Known Security Software Names
Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium386Free2020-10-19macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational253Free2020-10-19Linux System Network Connections Discovery via who, w, last, lsof, or netstat
Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow161Free2020-10-19Linux process discovery via grep/egrep searching for security software strings
Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow192Free2020-10-19Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed
Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.
Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule TeamLinuxprocess_creationInformational200Free2020-10-19