Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
AWS CloudTrail Account EnableRegion Command Usage
Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.
Ivan Saakov, Sergey Zelenskiy, Huntrule TeamAwscloudtrailMedium93Free2025-10-19AWS CloudTrail ConsoleLogin Failed authentication
Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium141Free2025-10-19AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium154Free2025-10-19Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes
Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.
andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh90Free2025-10-18Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths
Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh121Free2025-10-18Kaspersky Endpoint Security Service Stopped via Command Line on Linux
Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.
Milad Cheraghi, Huntrule TeamLinuxprocess_creationHigh189Free2025-10-18AWS KMS Imported Key Material Import or Deletion via CloudTrail
Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.
toopricey, Huntrule TeamAwscloudtrailHigh123Free2025-10-18AWS CloudTrail Successful ConsoleLogin Events Without MFA
Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.
Thuya@Hacktilizer, Ivan Saakov, Huntrule TeamAwscloudtrailMedium112Free2025-10-18GitHub Audit Events: Repository Archived/Unarchived Status Change
Alerts on GitHub audit events indicating a repository was archived or unarchived.
Ivan Saakov, Huntrule TeamGithubauditLow345Free2025-10-18GitHub Pages repository site changed to public (repo.pages_public audit event)
Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.
Ivan Saakov, Huntrule TeamGithubauditLow443Free2025-10-18Windows Process Execution: Restic Backup Tool Command-Line Indicators
Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.
Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh131Free2025-10-17Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep
Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.
Milad Cheraghi, Nasreddine Bencherchali, Huntrule TeamLinuxprocess_creationHigh276Free2025-10-17Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
Flags Linux processes running Python’s built-in HTTP server modules via command line.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationMedium132Free2025-10-17Linux auditctl -D used to delete all audit rules
Flags auditctl -D executions that delete all audit rules and watchers on Linux.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationHigh446Free2025-10-17Windows Process Creation: Executable Launches Identical Self Instance (Sacrificial Process)
Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.
frack113, Huntrule TeamWindowsprocess_creationLow60Free2025-10-17