Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows PowerShell Sensitive File Discovery via Script Block Enumeration
PowerShell script blocks using recursive file enumeration that target sensitive file extensions.
frack113, Huntrule TeamWindowsps_scriptMedium2710Free2022-09-16Windows IIS WebServer Access Log Files Deleted
Alerts when IIS access log files (.log) under inetpub\logs\LogFiles\ are deleted.
Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium499Free2022-09-16Windows Security 4663: Access to Microsoft Teams token and local storage files
Identifies non-Teams.exe processes accessing Microsoft Teams cookies or local storage objects on Windows (Event 4663).
"@SerkinValery, Huntrule Team"WindowssecurityHigh161Free2022-09-16Windows: SharPersist Execution via Process Image and Scheduled Task/Startup/Registry/Service Command Lines
Detects SharPersist execution on Windows via process name and persistence-related command-line parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh196Free2022-09-15Windows: Service Created by System Using Client with PID 0 (SCM Event 7045)
Alerts on Windows service installation events (SCM EventID 7045) where the client process ID is 0.
Tim Rauch (Nextron Systems), Elastic (idea), Huntrule TeamWindowssystemHigh501Free2022-09-15Windows Service Created by Client With PID 0 or Parent PID 0
Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.
Tim Rauch (Nextron Systems), Elastic (idea), Huntrule TeamWindowssecurityHigh202Free2022-09-15Linux Suspicious curl Start with User-Agent Modification Flags
Flags Linux curl invocations that set a custom User-Agent using -A/--user-agent.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium267Free2022-09-15Linux: Suspicious curl upload via form or data flags
Alerts on Linux curl executions that include file upload or form submission flags in their command line, excluding localhost targets.
Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update), Huntrule TeamLinuxprocess_creationMedium201Free2022-09-15Linux Service Management Command Usage to Stop or Disable Services
Flags Linux service-control commands with stop/disable intent, while excluding selected benign upgrade and snap workflows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium258Free2022-09-15Process Creation: curl on Linux
Flags Linux process starts for the curl binary, indicating potential remote file download or web requests.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow140Free2022-09-15Linux crontab Removal via "crontab -r" Process Command Line
Identifies attempts to remove the current user crontab via "crontab -r" on Linux.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium144Free2022-09-15Linux: chattr Used to Remove Immutable File Attribute
Flags Linux process use of chattr with -i to remove the immutable file attribute.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium161Free2022-09-15Linux: Base64-Encoded Shebang Patterns in Command Line
Flags Linux command lines containing Base64-encoded shebang prefixes for common shells, indicating potential encoded script execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium213Free2022-09-15Windows CLI Processes Using Common Weak or Abused Passwords
Alerts when Windows command lines include common weak or reused password values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium256Free2022-09-14Windows PowerShell Disables Windows Firewall Profiles via Set-NetFirewallProfile
Flags PowerShell commands attempting to turn off Windows Firewall profiles using Set-NetFirewallProfile.
Tim Rauch, Elastic (idea), Huntrule TeamWindowsprocess_creationMedium222Free2022-09-14