Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

3,626 rules

Windows process creation: CrackMapExec execution via characteristic command-line flags
Alerts on Windows process creation showing CrackMapExec-style command-line flags for local auth and module execution.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh356
Free2022-02-25
Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload
Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh4110
Free2022-02-25
Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns
Flags Windows process creation with wiper-like PowerShell comsvcs MiniDump and related command-line/paths.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163
Free2022-02-25
Windows Process Command-Line Indicators of BlackByte Ransomware Activity
Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh4010
Free2022-02-25
Windows Registry: Disable CrashDump via CrashControl DWORD value
Alerts on registry changes that disable Windows crash dumps by writing 0x00000000 to CrashControl.
Tobias Michalski (Nextron Systems), Huntrule TeamWindowsregistry_setMedium441
Free2022-02-24
Windows Scheduled Task Creation via schtasks with Suspicious Command-Line Patterns
Flags schtasks.exe /Create commands containing suspicious interpreter, encoding, hidden execution, or unusual path/script components.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh472
Free2022-02-23
Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior
Alerts on explorer.exe executions that include /NOUACCHECK, indicating potential bypass of UAC checks for child processes.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh293
Free2022-02-23
Windows scheduled task creation via schtasks.exe from suspicious parent path
Flags schtasks.exe /Create when spawned from temp or user-writable parent directories on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium80
Free2022-02-23
Windows Schtasks.exe Task Creation Targeting Suspicious Paths or Env Variables
Alerts when schtasks.exe creates tasks whose target path/arguments reference suspicious folders or common environment variables.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium191
Free2022-02-21
Windows CHCP Console Code Page Lookup Triggered From cmd.exe
Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.
_pete_0, TheDFIRReport, Huntrule TeamWindowsprocess_creationMedium262
Free2022-02-21
Suspicious Reset-ComputerMachinePassword Usage via PowerShell on Windows
Detects PowerShell executions of Reset-ComputerMachinePassword that may indicate attempts to alter domain computer account authentication.
frack113, Huntrule TeamWindowsps_moduleMedium204
Free2022-02-21
Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)
Flags Windows execution of tor.exe or Tor Browser’s bundled Firefox from the expected installation path.
frack113, Huntrule TeamWindowsprocess_creationHigh152
Free2022-02-20
Windows Sysmon DNS Query to .onion or Tor Gateway Domains
Alerts when Windows Sysmon DNS queries target .onion or Tor gateway/proxy-related domain suffixes.
frack113, Huntrule TeamWindowsdns_queryHigh447
Free2022-02-20
Windows DNS Client Query for .onion and Tor-related Domains
Alerts on Windows DNS queries resolving .onion and related Tor/hidden-service domains.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientHigh143
Free2022-02-20
Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)
Alert on Windows Firewall/Defender firewall setting changes using Events 2002, 2003, 2008, 2082, and 2083.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfirewall-asLow192
Free2022-02-19