Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
165 rules
Windows Process: reg.exe Software Version Discovery via svcVersion Query
Alerts when reg.exe is used to query \Software\ for svcVersion, indicating Windows software version discovery.
Nikita Nazarov, oscd.community, Huntrule TeamWindowsprocess_creationMedium222Free2020-10-16Linux Local Groups Discovery via /groups or /etc/group File Enumeration
Detects Linux commands and utilities used to enumerate local groups and read /etc/group.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationLow419Free2020-10-11Linux System Information Discovery via Common Command-Line Utilities
Flags Linux executions of uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod for system discovery behavior.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationInformational283Free2020-10-08Linux System & Hardware Information Discovery via File and Version Reads
Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.
Ömer Günal, oscd.community, Huntrule TeamLinuxauditdInformational3110Free2020-10-08Linux Password Policy Discovery via chage and passwd Commands
Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.
Ömer Günal, oscd.community, Pawel Mazur, Huntrule TeamLinuxauditdLow233Free2020-10-08Windows Registry Key Export via regedit.exe (-E) to File
Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.
Oddvar Moe, Sander Wiebing, oscd.community, Huntrule TeamWindowsprocess_creationLow193Free2020-10-07macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults
Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationInformational341Free2020-10-06Linux System Network Discovery via Firewall/Network Tools
Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.
Ömer Günal and remotephone, oscd.community, Huntrule TeamLinuxprocess_creationInformational193Free2020-10-06Linux process discovery via common process listing and monitoring tools
Flags Linux execution of common tools used to enumerate running processes.
Ömer Günal, oscd.community, CheraaghiMilad, Huntrule TeamLinuxprocess_creationLow150Free2020-10-06Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options
Alerts on SharpHound/Bloodhound-like processes launching with discovery-focused command-line parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh244Free2019-12-20Windows System Time Discovery via net.exe or w32tm.exe
Flags Windows net.exe/net1.exe or w32tm.exe command lines used to query system time/time zone.
E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule TeamWindowsprocess_creationLow91Free2019-10-24Windows Domain Trust Discovery Using dsquery.exe TrustedDomain Queries
Flags Windows executions of dsquery.exe with trustedDomain to discover Active Directory domain trusts.
E.M. Anhaus, Tony Lambert, oscd.community, omkar72, Huntrule TeamWindowsprocess_creationMedium321Free2019-10-24Windows Local Account Discovery via System Utilities Process Execution
Flags Windows processes that match utilities used to enumerate local user and account information.
Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowsprocess_creationLow445Free2019-10-21Linux System Owner or User Discovery via Common Utility Execution
Flags execution of Linux user/system identification utilities such as whoami and id.
Timur Zinniatullin, oscd.community, Huntrule TeamLinuxauditdLow436Free2019-10-21Cisco AAA discovery via show/dir commands
Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.
Austin Clark, Huntrule TeamCiscoaaaLow409Free2019-08-12