Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode
Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.
heyyanu, Huntrule TeamWindowsapplockerLow172Free2026-03-26Linux setcap sets cap_setuid on a binary via setcap utility
Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.
Luc Génaux, Huntrule TeamLinuxprocess_creationLow142Free2026-01-24Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.
Luc Génaux, Huntrule TeamLinuxprocess_creationLow151Free2026-01-24Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Flags browser processes opening .htm files from a user’s Downloads folder on Windows, a pattern consistent with HTML attachment activity.
Joseph Kamau, Huntrule TeamWindowsprocess_creationLow140Free2025-12-05Linux File Creation with Unusually Long Filenames (100+ Characters)
Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.
"@kostastsale, Huntrule Team"Linuxfile_eventLow140Free2025-11-22Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe
Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.
Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationLow285Free2025-11-03GitHub Audit Events: Repository Archived/Unarchived Status Change
Alerts on GitHub audit events indicating a repository was archived or unarchived.
Ivan Saakov, Huntrule TeamGithubauditLow415Free2025-10-18GitHub Pages repository site changed to public (repo.pages_public audit event)
Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.
Ivan Saakov, Huntrule TeamGithubauditLow493Free2025-10-18Windows Process Creation: Executable Launches Identical Self Instance (Sacrificial Process)
Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.
frack113, Huntrule TeamWindowsprocess_creationLow130Free2025-10-17Linux sudo --chroot Command Execution
Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.
Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationLow335Free2025-10-02Windows Process Information Discovery via Registry Queries (reg.exe/powershell)
Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.
lazarg, Huntrule TeamWindowsprocess_creationLow131Free2025-06-12RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)
Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.
frack113, Huntrule TeamWindowsprocess_creationLow251Free2025-06-04Windows Process Loaded BitsProxy.dll via Uncommon Image
Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.
UnicornOfHunt, Huntrule TeamWindowsimage_loadLow170Free2025-06-04Linux mknod Syscall Used to Create Special Files
Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.
Milad Cheraghi, Huntrule TeamLinuxauditdLow241Free2025-05-31Linux sysinfo Syscall for System Information Discovery
Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.
Milad Cheraghi, Huntrule TeamLinuxauditdLow263Free2025-05-30