Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: Detect SelectMyParent PPID Spoofing Tool Execution
Flags SelectMyParent.exe process creation with PPID spoofing command-line and metadata indicators on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2022-07-23Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium201Free2022-07-22Windows Service Installation: PDQDeployRunner Remote Service Creation (Service Control Manager)
Flags new Windows services installed with PDQDeployRunner-* naming via Service Control Manager event 7045.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium193Free2022-07-22Windows: Detect New PDQDeploy Service Installation via Service Control Manager
Flags new Windows services installed via SCM Event 7045 that reference PDQDeployService.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium191Free2022-07-22Windows Registry SIP Persistence via New Cryptography Provider Registration
Detects suspicious Windows registry writes that register a new SIP/Cryptography provider DLL for persistence or defense impairment.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium203Free2022-07-21Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language
Alerts on Windows registry changes to ContentIndex Natural Language DLLPathOverride values tied to SearchIndexer.exe persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh358Free2022-07-21Windows Registry: mpnotify SIP Provider Persistence via Winlogon
Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh451Free2022-07-21Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)
Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh412Free2022-07-21Windows Registry: New IFilter Registration via PersistentHandler/CLSID Keys
Flags registry writes that register new Windows Search IFilters/persistent handlers via PersistentHandler and CLSID key patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium317Free2022-07-21Windows Registry Persistence via HtmlHelp Author Location Modification
Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh243Free2022-07-21Windows Registry AMSI Provider Persistence via Providers Key
Alerts on registry activity creating/modifying AMSI provider entries under the Microsoft AMSI Providers keys.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium328Free2022-07-21Windows Registry Persistence via hhctrl CLSID InprocServer32 Default Modification
Flags registry changes to the hhctrl COM CLSID InprocServer32 (Default) to load a custom binary instead of the system hhctrl.ocx.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh412Free2022-07-21Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key
Flags registry modifications adding a Debugger entry under Windows Error Reporting Hangs, a potential crash-triggered persistence technique.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh304Free2022-07-21Windows Registry Persistence via Disk Cleanup Handler Autorun Keys
Flags registry changes under Windows Disk Cleanup Handler VolumeCaches that set Autorun and command-like handler values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium2410Free2022-07-21Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence
Flags registry writes that set an AeDebug Debugger .dll value, enabling debugger execution on application crashes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium163Free2022-07-21