Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows dnscmd.exe DNS Zone and Record Enumeration Command Execution
Flags dnscmd.exe executions that enumerate DNS zones/records via process creation command-line parameters.
"@gott_cyber, Huntrule Team"Windowsprocess_creationMedium347Free2022-07-31Windows ISO File Creation in User Temp and Outlook Cache Folders
Alerts on creation of .iso files in Windows AppData temp or Outlook cache paths.
"@sam0x90, Huntrule Team"Windowsfile_eventHigh151Free2022-07-30Windows DLL Search Order Hijack via Space in System Directory Paths
Alerts on .dll events targeting Windows system paths with an extra space, indicative of DLL search order hijacking.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh356Free2022-07-30Windows Sysmon Driver Altitude Registry Changes
Identifies registry writes that change the Sysmon instance altitude value, which can disrupt Sysmon loading at boot.
B.Talebi, Huntrule TeamWindowsregistry_setHigh163Free2022-07-28Windows schtasks Scheduled Task Create/Modify Running as SYSTEM
Alerts on Windows schtasks task create/modify commands that set the run account to NT AUTHORITY\SYSTEM.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh245Free2022-07-28Windows: Suspicious Scheduled Task Modification via schtasks /Change /TN
Flags schtasks.exe executions that modify existing scheduled tasks (/Change /TN) using suspicious locations and command-line payload tooling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh478Free2022-07-28Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder
Alerts on creation of .dll, .exe, or .sys files under C:\Windows\System32\spool\drivers\color.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium121Free2022-07-28Azure Audit Logs: Admin-initiated App Role Assignments and Privileged Delegated Permissions
Alerts on Azure audit events where an admin grants app roles to a service principal, enabling privileged application access.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh110Free2022-07-28Azure Audit Logs: End User Consent for Application (Non-Admin Consent)
Identifies end-user consent grants to applications in Azure AD audit logs.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsLow175Free2022-07-28Azure audit logs: Delegated highly privileged permissions granted for all users
Alerts on Azure audit log events where delegated permissions are granted to all users.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh150Free2022-07-28Windows Registry: Appx DebugPath Key for Potential Persistence
Detects registry set activity involving AppX DebugPath entries that may indicate persistence via packaged app debug configuration.
frack113, Huntrule TeamWindowsregistry_setMedium438Free2022-07-27Windows Browser Launched with Remote Debugging Flags
Alerts on Windows launches of Chromium-based browsers or Firefox with remote debugging command-line flags.
pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium184Free2022-07-27Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.
MikeDuddington, '@dudders1', Huntrule TeamAzuresigninlogsLow130Free2022-07-27Windows: WinRing0 Driver Load via Image Hash and File Name Match
Alerts on Windows driver loads matching WinRing0 modules by IMPhash or expected WinRing0 filenames.
Florian Roth (Nextron Systems), Huntrule TeamWindowsdriver_loadHigh172Free2022-07-26Linux Process Creation: Base64-Encoded Pipe to Bash/Sh Execution
Flags Linux command lines that use base64-encoded data piped into bash or sh for execution.
pH-T (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium90Free2022-07-26