Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Defender Exploit Guard Tamper via Controlled Folder Access AllowedApplications or ProtectedFolders Changes
Alerts on Windefend EventID 5007 when Exploit Guard ProtectedFolders or AllowedApplications lists are modified.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowswindefendHigh163Free2022-08-05Azure Audit Logs: Removal of Privileged Role Eligible Members
Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh215Free2022-08-05Windows RDP Tunneling Using plink.exe on Local Port 3389
Alert on plink.exe command lines referencing 127.0.0.1:3389 or port 3389, suggesting potential RDP tunneling on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh110Free2022-08-04Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil
Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.
Florian Roth (Nextron Systems), Microsoft (idea), Huntrule TeamWindowsprocess_creationHigh140Free2022-08-04Windows PsExec Named Pipe Creation from Suspicious Paths (PSEXESVC)
Alerts on PsExec pipe \PSEXESVC creation when the executing image path is in public/temp/desktop/downloads locations.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium362Free2022-08-04Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights
Alerts when a user is removed from a group that can modify Conditional Access policies in Azure Entra.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium101Free2022-08-04Azure Entra: Added member to group granting Conditional Access policy modification
Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium102Free2022-08-04Windows: Detect wusa.exe Cab Extraction Using /extract
Flags wusa.exe running with /extract:, a behavior consistent with CAB extraction and potential payload staging.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium80Free2022-08-04Windows CLI usage of obfuscated IP address patterns in ping/arp commands
Alerts when ping or arp command lines include obfuscated/encoded IP address indicators on Windows.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium183Free2022-08-03Windows Process Creation: Obfuscated IP Address in Download Command URLs
Alerts on Windows download commands that include obfuscated/encoded IP addresses in the URL.
Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium100Free2022-08-03Windows named pipe creation matching DiagTrackEoP POC pipe name fragment
Flags Windows creation of a named pipe matching the DiagTrackEoP POC’s default pipe name.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdCritical507Free2022-08-03Windows Security Mitigations: Unsigned DLL Blocked from User-Writable Paths
Alerts on blocked unsigned DLL loads targeting public, downloads, desktop, or temp directories in Windows Security Mitigations logs.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurity-mitigationsHigh142Free2022-08-03Windows Security: DiagTrackEoP POC Default UserName Login Attempt (LogonType 9)
Alerts on Windows 4624 LogonType 9 events targeting a known DiagTrackEoP default username.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityCritical260Free2022-08-03Azure AD audit logs: Successful user-initiated password reset
Alerts on successful Azure AD password reset events initiated by a user account.
YochanaHenderson, '@Yochana-H', Huntrule TeamAzureauditlogsMedium131Free2022-08-03Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget
Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3610Free2022-08-02