Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop
Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh133Free2025-10-20Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password
Alert on qlogin.exe commands that authenticate as _+_PublicSharingUser_ using a GUID-formatted password.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium241Free2025-10-20Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100
Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.
hamid, Huntrule TeamWindowssystemMedium131Free2025-10-19Windows SMB Server Share Connection Without Signing or Encryption
Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.
Mohamed Abdelghani, Huntrule TeamWindowssmbserver-connectivityMedium536Free2025-10-19Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming
Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowssecurityMedium181Free2025-10-19AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls
Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.
Ivan Saakov, Huntrule TeamAwscloudtrailHigh212Free2025-10-19AWS CloudTrail Account EnableRegion Command Usage
Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.
Ivan Saakov, Sergey Zelenskiy, Huntrule TeamAwscloudtrailMedium103Free2025-10-19AWS CloudTrail ConsoleLogin Failed authentication
Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium261Free2025-10-19AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium314Free2025-10-19Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes
Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.
andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh170Free2025-10-18Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths
Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh141Free2025-10-18Kaspersky Endpoint Security Service Stopped via Command Line on Linux
Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.
Milad Cheraghi, Huntrule TeamLinuxprocess_creationHigh229Free2025-10-18AWS KMS Imported Key Material Import or Deletion via CloudTrail
Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.
toopricey, Huntrule TeamAwscloudtrailHigh183Free2025-10-18AWS CloudTrail Successful ConsoleLogin Events Without MFA
Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.
Thuya@Hacktilizer, Ivan Saakov, Huntrule TeamAwscloudtrailMedium142Free2025-10-18GitHub Audit Events: Repository Archived/Unarchived Status Change
Alerts on GitHub audit events indicating a repository was archived or unarchived.
Ivan Saakov, Huntrule TeamGithubauditLow405Free2025-10-18