Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Linux Process Command-Line Printing of Shell History Files
Alerts when Linux commands print or page shell history files via the command line for recon.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium203Free2022-06-20Linux Shell History File Deletion via rm/unlink/shred
Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh251Free2022-06-20Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider
Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.
frack113, Huntrule TeamWindowsregistry_setHigh202Free2022-06-19Windows: Chromium-Based Browser Launched via Script Host with --load-extension
Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.
Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh140Free2022-06-19Windows Chromium-Based Browser Launched With --load-extension Flag
Alerts when a Chromium-based browser starts with --load-extension= to load a custom extension.
Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium140Free2022-06-19Windows File Creation: Suspicious Double-Extension Filenames Ending in Script/Archive/Executable Types
Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsfile_eventHigh263Free2022-06-19Windows: msdt.exe Loads sdiageng.dll via Image Load Events
Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.
Greg (rule), Huntrule TeamWindowsimage_loadHigh259Free2022-06-17Azure AD Sign-ins Using Legacy Authentication Client Applications
Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsHigh162Free2022-06-17Azure AD Account Disabled or Blocked Login Attempt Failures (Sign-in Logs)
Alerts when Azure sign-in attempts fail because the target account is disabled or blocked.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsMedium435Free2022-06-17Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution
Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium6110Free2022-06-16Windows OpenConsole LOLBIN Execution via Process Creation
Alerts when OpenConsole.exe runs (outside a specific Windows Terminal path), potentially used to bypass application whitelisting.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium339Free2022-06-16Windows: FakeUpdates/SocGholish execution via wscript loading a zip-based update script
Flags wscript launched from Temp update .js within a .zip to spawn cmd.exe or PowerShell on Windows.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh231Free2022-06-16Windows Registry: Enable ScriptedDiagnostics TurnOffCheck DWORD via Policies
Flags registry policy enabling ScriptedDiagnostics TurnOffCheck (DWORD 0x00000001) on Windows.
Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule TeamWindowsregistry_setMedium163Free2022-06-15Windows: Execution of Pcalua.exe with -a Argument
Flags Pcalua.exe executions containing " -a" that may indicate indirect command execution on Windows.
Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule TeamWindowsprocess_creationMedium432Free2022-06-14Windows forfiles.exe Execution with /c Flag Command Proxying
Flags forfiles.exe executions that include the /c flag, indicating potential indirect command execution.
Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule TeamWindowsprocess_creationMedium191Free2022-06-14