Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,357 rules
Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh181Free2024-03-20Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2024-03-11Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files
Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh465Free2024-03-11OpenCanary VNC Connection Attempt Observed
Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh359Free2024-03-08OpenCanary TFTP Service Receives a Request
Alerts on OpenCanary logs showing a recorded request to the TFTP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh467Free2024-03-08OpenCanary Telnet Login Attempt Recorded in Application Logs
Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh262Free2024-03-08OpenCanary application logs: SSH new connection attempt on monitored node
Alerts when OpenCanary records a new SSH connection attempt to a monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh161Free2024-03-08OpenCanary Application Logs: SSH Login Attempt on Monitoring Node
Alerts on recorded SSH login attempts from OpenCanary application logs (logtype 4002).
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh233Free2024-03-08OpenCanary SNMP OID Requests Observed on Node
Alerts when OpenCanary records an SNMP OID request to its SNMP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh162Free2024-03-08OpenCanary SMB service records file open requests
Triggers when OpenCanary logs an SMB file open request to its monitored host.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh289Free2024-03-08OpenCanary SIP Request on Honeypot Node
Alerts on OpenCanary logs showing SIP request activity on a configured SIP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh191Free2024-03-08OpenCanary Redis Action Command Attempt
Alerts when OpenCanary reports an attempted action command against its Redis service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh458Free2024-03-08OpenCanary NTP Monlist Request Observed
Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh183Free2024-03-08OpenCanary MySQL Service: Login Attempt Recorded
Flags OpenCanary events indicating a MySQL service login attempt on the monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh191Free2024-03-08OpenCanary: MSSQL Windows Authentication Login Attempt (Logtype 9002)
Alerts on OpenCanary MSSQL events where Windows Authentication login attempts are observed.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh251Free2024-03-08