Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,358 rules
Windows Process Creation: Execution of vbc.exe Spawned from more.com
Alerts when more.com starts vbc.exe on Windows, matching a known stealer execution pattern.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationHigh141Free2024-12-19Windows File Creation to Roaming AppData DataLogs.conf and RAT-Client Names
Alerts on creation of specific RAT client config files under AppData\Roaming on Windows.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsfile_eventHigh317Free2024-12-19Windows Process Creation: Suspicious cmd.exe Launch with Encoded PowerShell from Cleo Suite
Alerts on cmd.exe launching PowerShell encoded commands from Cleo javaw.exe components with .Download.
Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson, Huntrule TeamWindowsprocess_creationHigh327Free2024-12-09AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)
Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.
Ivan Saakov, Huntrule TeamAwscloudtrailHigh212Free2024-12-06Windows Suspicious ShellExec_RunDLL via SHELL32.DLL Ordinal in Parent Command Line
Alert on Windows process starts where parent command line invokes SHELL32.DLL ShellExec_RunDLL using a matched ordinal and spawns suspicious binaries.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh349Free2024-12-01Windows File Event: Detect RTLO Filename Extension Spoofing
Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.
Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh202Free2024-11-17Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators
Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.
Ahmed Farouk, Nasreddine Bencherchali, Huntrule TeamWindowsregistry_setHigh191Free2024-11-01IIS HTTP Logging Disabled via dontLog Configuration Change (Windows)
Alerts on IIS configuration updates that disable HTTP logging by setting dontLog to true for successful requests.
frack113, Huntrule TeamWindowsiis-configurationHigh442Free2024-10-06Windows DISM Enables PowerShell Web Access Feature via Command Line
Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.
Michael Haag, Huntrule TeamWindowsprocess_creationHigh102Free2024-09-03Windows PowerShell Web Access Installation via PowerShell Script Block
Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.
Michael Haag, Huntrule TeamWindowsps_scriptHigh307Free2024-09-03Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule TeamLinuxprocess_creationHigh181Free2024-09-02Linux Inline Python (-c) Calling os.system to Spawn Shell
Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh482Free2024-09-02Linux process execution of shell via nice utility
Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh353Free2024-09-02Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection
Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh328Free2024-09-02Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh222Free2024-09-02