Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows File Creation of .diagcab Packages
Alerts on newly created Windows .diagcab files that may indicate malicious packaging or exploitation.
frack113, Huntrule TeamWindowsfile_eventMedium246Free2022-06-08Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)
Alerts when WinRAR/7-Zip/PeaZIP spawns ISO image tools, a pattern consistent with archive-delivered ISO payloads.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2022-06-07DNS Queries to OAST and Callback Domain Services
Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.
Florian Roth (Nextron Systems), Matt Kelly (list of domains), Huntrule TeamNetworkdnsHigh221Free2022-06-07AWS ECS Task Definition Commands Query AWS Container Credentials Endpoint
Alerts on ECS Describe/Register/Run activity when task container commands reference the container credential endpoint URI.
Darin Smith, Huntrule TeamAwscloudtrailMedium192Free2022-06-07Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags
Alerts on renamed Plink executions using SSH port forwarding flags in Windows process creation logs.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh429Free2022-06-06Webserver: Suspicious Windows Path Strings in URI Query
Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWebwebserverHigh221Free2022-06-06Linux nohup Process Execution (Process Creation)
Flags Linux process launches where the image path ends with '/nohup', indicating nohup was invoked for backgrounding or persistence.
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule TeamLinuxprocess_creationMedium90Free2022-06-06Windows: ManageEngine SupportCenter Plus msiexec.exe Dropped in bin (CVE-2021-44077 POC)
Alerts on msiexec.exe being created in the SupportCenterPlus bin folder on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh347Free2022-06-06Windows Office Startup Folder File Creation with Uncommon Extension
Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh415Free2022-06-05Windows rundll32 Locks Workstation via user32.dll LockWorkStation
Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.
frack113, Huntrule TeamWindowsprocess_creationMedium463Free2022-06-04Windows PowerShell: Suspicious GPO Discovery via Get-GPO
Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.
frack113, Huntrule TeamWindowsps_scriptLow211Free2022-06-04Java Payload Indicators in Web Server Logs
Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.
frack113, Harjot Singh, "@cyb3rjy0t" (update), Huntrule TeamWebwebserverHigh202Free2022-06-04Windows Process Creation: Renamed msdt.exe Execution
Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.
pH-T (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh364Free2022-06-03Python Process Spawning a Pretty TTY via pty.spawn on Windows
Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.
Nextron Systems, Huntrule TeamWindowsprocess_creationHigh4110Free2022-06-03Linux Java Process Launching Suspicious Shell and Scripting Children
Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh140Free2022-06-03