Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
GitHub Pages repository site changed to public (repo.pages_public audit event)
Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.
Ivan Saakov, Huntrule TeamGithubauditLow493Free2025-10-18Windows Process Execution: Restic Backup Tool Command-Line Indicators
Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.
Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh171Free2025-10-17Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep
Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.
Milad Cheraghi, Nasreddine Bencherchali, Huntrule TeamLinuxprocess_creationHigh346Free2025-10-17Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
Flags Linux processes running Python’s built-in HTTP server modules via command line.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationMedium162Free2025-10-17Linux auditctl -D used to delete all audit rules
Flags auditctl -D executions that delete all audit rules and watchers on Linux.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationHigh486Free2025-10-17Windows Process Creation: Executable Launches Identical Self Instance (Sacrificial Process)
Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.
frack113, Huntrule TeamWindowsprocess_creationLow130Free2025-10-17AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent
Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.
Adan Alvarez @adanalvarez, Huntrule TeamAwscloudtrailMedium401Free2025-10-12Windows: WinSCP Execution from Non-Standard Directory
Flags WinSCP started from a non-default directory on Windows to surface potential portable execution.
frack113, Huntrule TeamWindowsprocess_creationMedium190Free2025-10-12Windows: Winscp CLI FTP/SFTP Open via -command
Detects WinSCP executions with -command and an open request to ftp:// on Windows.
frack113, Huntrule TeamWindowsprocess_creationMedium160Free2025-10-12WSL Process Execution of Kali Linux on Windows
Flags Kali Linux running under WSL on Windows using process creation image and command-line indicators.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh514Free2025-10-10Windows WSL Kali Linux installation via wsl.exe --install -i
Flags wsl.exe commands that install a distribution specified as Kali Linux using --install -i.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh203Free2025-10-10Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation
Flags Windows process trees where GoAnywhere Tomcat spawns suspicious cmd/PowerShell command lines consistent with exploitation activity.
MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh201Free2025-10-07Linux sudo --chroot Command Execution
Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.
Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationLow325Free2025-10-02Linux File Creation: Non-Standard nsswitch.conf Directory Write Activity
Flags creation of /etc/nsswitch.conf in non-standard locations that could support privilege escalation.
Swachchhanda Shrawn Poudel (Nextron Systems), Huntrule TeamLinuxfile_eventHigh212Free2025-10-02Windows Registry RunMRU Key Deletion
Alerts on deletion of the Windows Run dialog command history (RunMRU) registry key.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_deleteHigh528Free2025-09-25