Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,358 rules
Linux: Shell Command Execution Using flock -u with Common Shell Paths
Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh404Free2024-09-02Linux Find Command Used to Execute a Shell via -exec
Flags Linux /find executions that use -exec to launch a shell interpreter.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh130Free2024-09-02Linux env Execution Spawning Common Shells
Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh142Free2024-09-02Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh293Free2024-09-02Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()
Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh121Free2024-09-02Linux: SSH ProxyCommand Triggering Interactive Shell Execution
Flags Linux ssh invocations that embed shell execution and redirection via ProxyCommand/local command options.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh316Free2024-08-29Windows Registry: Disable Python function execution warnings in Excel
Alerts on registry updates that disable Excel Python function execution warnings via the PythonFunctionWarnings DWORD.
Nasreddine Bencherchali (Nextron Systems), @Kostastsale, Huntrule TeamWindowsregistry_setHigh221Free2024-08-23Azure AD Audit: Update User Risk and MFA Registration Policy
Flags Azure AD audit events showing updates to user risk and MFA registration policy.
Harjot Singh (@cyb3rjy0t), Huntrule TeamAzureauditlogsHigh162Free2024-08-13Windows Process Masquerading as svchost.exe via Binary Name and Location
Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh511Free2024-08-07Windows DLL Side-Loading: OleView loading aclui.dll
Alerts on OleView.exe loading aclui.dll on Windows, excluding common benign paths to highlight potential DLL side-loading.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadHigh292Free2024-07-31Windows Security: Changes to "ESX Admins" Domain Group Membership
Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityHigh413Free2024-07-30Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"
Alerts on net.exe or PowerShell attempts to create a domain group named "ESX Admins" via AD/command-line parameters.
frack113, Huntrule TeamWindowsprocess_creationHigh122Free2024-07-29Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification
Detects registry changes to COM CLSID Default InprocServer32/LocalServer32 values that point to suspicious locations.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh423Free2024-07-16Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)
Alerts when DsrmAdminLogonBehavior registry value is changed on Windows, except the default DWORD 0x00000000.
Nischal Khadgi, Huntrule TeamWindowsregistry_setHigh482Free2024-07-11AWS CloudTrail SSM SendCommand Successful Execution for Instance
Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh247Free2024-07-11