Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

185 rules

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation
Flags Word (WINWORD.EXE) spawning csc.exe, a suspicious execution pattern observed in some exploit chains.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical41
Free2017-09-15
Windows rundll32 execution matching ZxShell function and remote disk strings
Alerts on rundll32.exe command lines containing zxFunction and RemoteDiskXXXXX indicative of ZxShell execution.
Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule TeamWindowsprocess_creationCritical52
Free2017-07-20
Windows WCE wceaux.dll File Access via Security Event 4656/4663
Identifies Windows Security event activity involving access to the wceaux.dll library file.
Thomas Patzke, Huntrule TeamWindowssecurityCritical92
Free2017-06-14
Windows Registry Event: Pandemic implant key path contains null Instance
Detects registry activity targeting CurrentControlSet\services\null\Instance, associated with Windows implant persistence staging.
Florian Roth (Nextron Systems), Huntrule TeamWindowsregistry_eventCritical81
Free2017-06-01
Windows Service Creation: ServiceName javamtsup (Event ID 4697)
Flags Windows Security Event 4697 when a service named "javamtsup" is installed, indicating potential persistence.
Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update), Huntrule TeamWindowssecurityCritical112
Free2017-03-27