Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: Detect Suspicious mofcomp.exe Execution from Scripts or Temp Paths
Flags mofcomp.exe runs spawned by script interpreters or using temp/AppData paths, with exclusions for WmiPrvSE .mof-related activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh152Free2022-07-12Windows cmd.exe Output Redirection to User Writable Paths
Flags cmd.exe commands that redirect output (>) into temp/AppData and other commonly targeted directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium154Free2022-07-12Windows MSSQL xp_cmdshell Setting Change (EventID 15457)
Flags MSSQL xp_cmdshell setting changes using Windows application EventID 15457 events containing 'xp_cmdshell'.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsapplicationHigh3710Free2022-07-12Windows MSSQL xp_cmdshell Command Execution via Application Event 33205
Alerts when SQL Server xp_cmdshell is invoked to execute commands, using Windows application EventID 33205 data.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsapplicationHigh196Free2022-07-12Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns
Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh498Free2022-07-11Windows DNS Queries to Remote Support and Remote Access Domains From Non-Browser Processes
Alert on DNS lookups for remote access service domains from non-browser executables, including RustDesk subdomains.
frack113, Connor Martin, Huntrule TeamWindowsdns_queryMedium202Free2022-07-11Azure Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions
Alerts on Azure AD audit log entries where an app/service principal is granted delegated or app-role permissions to Microsoft services.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh130Free2022-07-10Azure AD End-User Consent Blocked for Risk-Based Risky App Exceptions
Alerts when Azure end-user consent is blocked due to risk-based consent for risky apps.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsMedium145Free2022-07-10PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows
Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium192Free2022-07-08Windows: Detect Named Pipe Creation with Koh Default Names
Alerts on Windows named pipe creation with Koh default identifiers in the pipe name.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdCritical531Free2022-07-08Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding
Alerts on proxy requests with User-Agent values ending in '=' that may indicate Base64-encoded content.
Florian Roth (Nextron Systems), Brian Ingram (update), Huntrule TeamWebproxyMedium132Free2022-07-08Windows PowerShell: Import-Module From Temp, AppData, or Public Directories
Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium253Free2022-07-07Linux Triple Cross eBPF rootkit install commands via sudo tc on enp0s3
Flags sudo tc commands using qdisc/filter syntax and enp0s3 consistent with eBPF rootkit installer behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh162Free2022-07-05Linux process execution of execve_hijack via sudo
Alerts when /sudo spawns a process whose command line includes execve_hijack.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh101Free2022-07-05Linux eBPF Backdoor File Persistence via cron.d and sudoers.d (ebpfbackdoor)
Detects Linux creation of "ebpfbackdoor" files in cron.d/sudoers.d, indicating likely persistence via an eBPF backdoor.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh173Free2022-07-05