Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows Process Execution of BitLockerToGo.EXE
Alerts on Windows execution of BitLockerToGo.exe, a rarely used BitLocker To Go component for portable drive encryption.
Josh Nickels, mttaggart, Huntrule TeamWindowsprocess_creationLow4510Free2024-07-11AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules
Identifies when EC2 network ACL entries are created in AWS via CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailLow292Free2024-07-11Windows: Microsoft Word Loads WLL Add-In Files
Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.
Steffen Rogge (dr0pd34d), Huntrule TeamWindowsimage_loadLow160Free2024-07-10Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS
Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_accessLow534Free2024-05-27Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule
Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.
frack113, Huntrule TeamWindowsps_scriptLow130Free2024-05-10Unusual Access to Windows Outlook Unistore Mail Data by Non-Standard Processes
Alerts when unusual processes access Outlook Unistore (data and UnistoreDB store.vol) file locations on Windows.
frack113, Huntrule TeamWindowsfile_accessLow120Free2024-05-10PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule
Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.
frack113, Huntrule TeamWindowsprocess_creationLow130Free2024-05-03Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts
Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.
kelnage, Huntrule TeamKubernetesauditLow582Free2024-04-12Kubernetes Service Account Created via Audit Log
Alerts on Kubernetes audit events showing new ServiceAccounts created.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow511Free2024-03-26Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)
Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow173Free2024-03-26Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt
Alerts on Kubernetes selfsubjectrulesreviews API calls that enumerate the caller’s RBAC permissions.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow162Free2024-03-26Kubernetes Privileged Pod Created via Pod Creation Requests
Flags Kubernetes pod creates where container capabilities are set to all, indicating possible privileged access setup.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow474Free2024-03-26Kubernetes Pod Created With hostPath Volume Mount
Alerts on Kubernetes pod creation requests that include a hostPath volume mount.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow266Free2024-03-26Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow153Free2024-03-26Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow182Free2024-03-19