Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow412Free2024-03-11macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow214Free2024-03-11TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow4310Free2024-03-11Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType
Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.
"@SerkinValery, Huntrule Team"WindowssystemLow111Free2024-03-07Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.
"@SerkinValery, Huntrule Team"WindowssystemLow374Free2024-03-07GitHub Audit: Secret Scanning Push Protection Bypass Event Detected
Triggers on GitHub audit events indicating a secret scanning push protection bypass attempt.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditLow345Free2024-03-07Windows Shell Context Menu Registry Command Tampering
Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow100Free2024-03-06Windows DNS Queries to update.onelaunch.com by OneLaunch.exe
Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.
Josh Nickels, Huntrule TeamWindowsdns_queryLow162Free2024-02-26Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository
Flags Bitbucket audit events indicating secret scanning rules were deleted at the project or repository level.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow183Free2024-02-25Bitbucket audit: Project secret scanning allowlist rule added
Alerts when Bitbucket records a project secret scanning allowlist rule being added via the audit log.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow467Free2024-02-25Windows sc.exe Service Query for termservice Enumeration
Alerts on sc.exe service querying that references termservice on Windows.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationLow371Free2024-02-12Windows: Detect MODE.COM Changing Code Page Settings
Detects MODE.COM executions that include code page selection parameters.
Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationLow120Free2024-01-19macOS SIP Status Enumeration via csrutil status
Flags execution of "csrutil status" on macOS to enumerate System Integrity Protection state.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationLow132Free2024-01-02Windows: tar.exe Archive Extraction Using -x Flag
Flags Windows process executions of tar.exe with -x to extract compressed archives.
AdmU3, Huntrule TeamWindowsprocess_creationLow379Free2023-12-19Windows tar.exe Used to Create Compressed Archives
Flags tar.exe (or bsdtar) command lines using -c/-r/-u to create or update compressed archives on Windows.
Nasreddine Bencherchali (Nextron Systems), AdmU3, Huntrule TeamWindowsprocess_creationLow153Free2023-12-19