Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Linux eBPF Rootkit Activity: File Creation of /tmp/rootlog
Detects creation of /tmp/rootlog on Linux, a marker used by the TripleCross rootkit to track backdoor state.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh81Free2022-07-05Linux sudoers persistence via /etc/sudoers or /etc/sudoers.d file changes
Alerts on file changes in /etc/sudoers.d/ that may indicate persistence via sudo privilege policy.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventMedium446Free2022-07-05Windows curl.exe Process Creation
Alerts on execution of curl.exe on Windows, which may indicate remote downloads or web requests.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationLow130Free2022-07-05Windows: File Download via curl.exe with -O/--remote-name or --output
Flags curl.exe with download-oriented options (-O, --remote-name, --output) to spot likely file retrieval on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium80Free2022-07-05Windows Registry Changes Disabling Windows Defender Event Log Channel
Detects registry changes that disable the Windows Defender Operational event log channel by setting its Enabled DWORD to 0.
Florian Roth (Nextron Systems), Huntrule TeamWindowsregistry_setHigh434Free2022-07-04Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key
Flags registry changes that set WINEVT channel Enabled to 0x00000000 to disable Windows event logging.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh233Free2022-07-04Windows UAC Bypass via IDiagnosticProfileUAC Triggered from DllHost.exe
Flags elevated process creation where DllHost.exe launches using the specific IDiagnosticProfileUAC /Processid value.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh307Free2022-07-03Windows: DllHost.exe creates a System32 DLL for UAC bypass via IDiagnosticProfileUAC
Alerts when dllhost.exe creates a System32 .dll consistent with IDiagnosticProfileUAC UAC bypass behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh383Free2022-07-03Windows: Execution of .xbap via PresentationHost.exe from Uncommon Paths
Alerts when PresentationHost.exe launches a .xbap file from a non-standard location on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium339Free2022-07-01Windows: Execution of ScriptRunner.exe with appvscript Argument
Flags ScriptRunner.exe executions that include the " -appvscript " parameter in the command line.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium202Free2022-07-01Azure Audit Logs: UserType updated from Guest to Member
Alerts when an Azure user’s UserType is updated from Guest to Member, indicating potential privilege elevation.
MikeDuddington, '@dudders1', Huntrule TeamAzureauditlogsMedium449Free2022-06-30Windows: Suspicious LSASS handle access via svchost.exe call trace to seclogon.dll
Flags svchost.exe attempting LSASS access (granted access 0x14c0) with seclogon.dll in the call trace.
Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh294Free2022-06-29Windows: assoc.exe Changes File Extension Handler to exefile
Alerts on cmd.exe running assoc to set file extension handlers to exefile, indicating possible persistence via file associations.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh100Free2022-06-28Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories
Flags bitsadmin.exe file downloads that target suspicious folders using /transfer, /create, and /addfile command-line parameters.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh143Free2022-06-28Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension
Flags bitsadmin.exe commands that transfer or add files with suspicious extensions based on process creation command-line content.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh121Free2022-06-28