Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,365 rules
Linux process chain for Axios NPM compromise: curl download with nohup and python3
Flags Linux executions where curl downloads /tmp/ld.py and the payload is run via nohup python3 from an Axios-related node process.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh101Free2026-04-01DNS queries to known malicious C2 domains from axios/plain-crypto-js npm compromise indicators
Alerts on DNS queries to known malicious C2 domains tied to an Axios npm supply-chain compromise.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—dnsHigh495Free2026-04-01Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components
Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh91Free2026-04-01macOS: Axios NPM compromise file creation via curl and node indicators
Alerts on macOS file events matching curl and node staging paths linked to an Axios npm compromise pattern.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamMacosfile_eventHigh161Free2026-04-01Linux file creation via curl to /tmp/ld.py (Axios NPM compromise indicators)
Alerts on Linux file creation of /tmp/ld.py by a /curl process, consistent with automated payload staging.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxfile_eventHigh438Free2026-04-01Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)
Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh2310Free2026-03-30Linux Persistence File Creation Targeting sysmon.py and systemd user service
Alerts on creation of user persistence files under sysmon.py or systemd user service paths by a process running from /python3.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxfile_eventHigh152Free2026-03-30Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands
Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.
Chirag Damani, Huntrule TeamWindowsprocess_creationHigh185Free2026-03-29Windows Process Creation: curl Uploads to File-Sharing Domains
Detects curl commands on Windows uploading files to common file sharing/upload domains.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh151Free2026-03-29Windows System Restore Registry Modification via PowerShell or reg.exe Command Line
Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh315Free2026-03-11Windows Process Creation: Python One-Liners Decoding Base64 via Command Line
Alerts on Windows Python command-line one-liners that import base64 and call decode functions.
Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh189Free2026-03-09Linux Process Execution of Python Base64 Decode One-Liners
Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.
Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh231Free2026-03-09Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)
Alerts on WebHelpDesk (bin) spawning tool-like child processes with download/execution command patterns on Windows.
Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh172Free2026-02-11Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)
Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh477Free2026-02-03Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations
Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh399Free2026-02-03