Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes
Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsps_scriptLow453Free2025-05-24Windows: Deno writes files from remote HTTPS content into AppData
Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.
Josh Nickels, Michael Taggart, Huntrule TeamWindowsfile_eventLow559Free2025-05-22Windows File Access to Browser Credential Storage by Non-Browser Processes
Flags non-browser processes reading common browser credential storage files on Windows, indicating potential credential theft.
frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore, Huntrule TeamWindowsfile_accessLow344Free2025-05-22Windows Process Execution of JavaScript via Node.exe
Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationLow295Free2025-04-21Windows: Notepad Password File Discovery via Process Creation
Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.
The DFIR Report, Huntrule TeamWindowsprocess_creationLow272Free2025-02-21Windows Process Creation: Microsoft QuickAssist.exe Execution
Alerts on execution of QuickAssist.exe by matching the process image ending with \QuickAssist.exe.
Muhammad Faisal (@faisalusuf), Huntrule TeamWindowsprocess_creationLow191Free2024-12-19Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Alerts when QuickAssist.exe performs DNS lookups for the Microsoft Quick Assist remote session endpoint.
Muhammad Faisal (@faisalusuf), Huntrule TeamWindowsdns_queryLow499Free2024-12-19Windows Command Execution via Run Dialog (RunMRU) Registry Entries
Flags suspicious Run dialog command entries by matching RunMRU registry key updates on Windows.
Ahmed Farouk, Nasreddine Bencherchali, Huntrule TeamWindowsregistry_setLow160Free2024-11-01Windows Security 4663: Uncommon Processes Access Browser Credential Store Files
Flags 4663 file access to browser credential stores (Chromium/Firefox) by processes outside common system/benign paths.
Daniel Koifman (@Koifsec), Nasreddine Bencherchali, Huntrule TeamWindowssecurityLow160Free2024-10-21Windows IIS module removal event (IIS-configuration EventID 29)
Detects removal of an IIS module from Windows IIS configuration events (Event ID 29).
Nasreddine Bencherchali, Huntrule TeamWindowsiis-configurationLow173Free2024-10-06Windows Task Scheduler DLL Loaded From Uncommon Directory
Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadLow140Free2024-09-02Windows Cmd.exe: SET /p file append/override pattern via set /p=
Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.
Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan), Huntrule TeamWindowsprocess_creationLow150Free2024-08-22Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values
Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setLow438Free2024-07-31Windows: Uncommon Process Access to Chromium User Data Cookies and History
Alerts on uncommon executables reading Chromium cookies/history/web data on Windows, excluding common system and installer paths.
X__Junior (Nextron Systems), Huntrule TeamWindowsfile_accessLow160Free2024-07-29Windows File Access Attempt to Panther\unattend.xml During Unattended Install
Alerts on attempts to access Panther\unattend.xml on Windows, a potential source of embedded credentials.
frack113, Huntrule TeamWindowsfile_accessLow160Free2024-07-22