Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,331 rules
Linux Process Creation: wget Download Tar From Untrusted Direct IP with No-Check-Certificate
Flags wget commands that download .tar files from direct IP URLs while bypassing TLS certificate validation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh225Free2023-06-16Linux Process: Wget Downloads .zip/.rar from temp.sh URL
Identifies Linux wget commands that download .zip or .rar archives from temp.sh.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh162Free2023-06-16Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration
Detects openssl s_client connecting to an IP:port on 443/8080 from Linux process command lines.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh123Free2023-06-16Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
Flags Linux file creation/access events whose filenames end with known Barracuda ESG exploitation artifact indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh304Free2023-06-16Linux Email Exfiltration Staging File Pattern Matching (/mail/tmp/**.tar.gz)
Flags Linux file events creating /mail/tmp staging archives named like abc123.tar.gz.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh161Free2023-06-16Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence
Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2023-06-14Windows DLL Sideloading: waveedit.dll Loaded by Nero WaveEditor
Alerts when waveedit.dll is loaded from an unexpected path, suggesting possible DLL sideloading on Windows.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh155Free2023-06-14Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER
Alerts on GET requests to GeoServer OWS with CQL_FILTER containing SQLi-style payload markers and functions.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh103Free2023-06-14dfsvc.exe Initiated Network Connection to Uncommon Ports (Windows)
Alerts on dfsvc.exe-initiated outbound connections targeting non-standard ports on Windows, excluding typical 80/443 and IPv6 DNS(53).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh70Free2023-06-12Windows: Potential RjvPlatform.dll DLL Sideloading via SystemResetPlatform.exe from Non-Default Path
Flags SystemResetPlatform.exe loading RjvPlatform.dll from a non-default location, indicating possible DLL sideloading.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh171Free2023-06-09Windows DLL Sideloading Suspicion via edputil.dll Image Load
Alerts on edputil.dll image loads occurring outside standard Windows system directories, suggesting possible DLL side-loading.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh112Free2023-06-09Windows Registry COM InProcServer32 Hijack via PSFactory CLSID Default Value
Detects suspicious modifications to a PSFactory COM InProcServer32 (Default) registry value that may enable COM-based persistence.
BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk, Huntrule TeamWindowsregistry_setHigh452Free2023-06-07Windows Code Integrity: Kernel Module Loaded Without WHQL Requirements (Event 3082/3083)
Alerts when Code Integrity logs show loaded kernel modules failing WHQL compliance (Event 3082/3083), excluding selected VMware drivers.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh82Free2023-06-06Windows Code Integrity Operational: Unsigned Image Loaded
Alerts on Windows Code Integrity detecting that an unsigned image was loaded (Event ID 3037).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh111Free2023-06-06Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)
Alerts on Windows Code Integrity reporting an unsigned kernel module load via Event ID 3001.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh289Free2023-06-06