Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows WMIC System Information Discovery via WMI Command-Line Queries
Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationLow180Free2023-12-19Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)
Alerts on non-standard processes loading RstrtMgr.dll using Windows image load telemetry.
Luc Génaux, Huntrule TeamWindowsimage_loadLow181Free2023-11-28Okta: Access to /reports/password-health endpoint outside expected Admin Console use
Flags requests to Okta Password Health report endpoints (/reports/password-health/*) for threat hunting.
Muhammad Faisal (@faisalusuf), Huntrule TeamOktaoktaLow80Free2023-10-25Windows PowerShell EnableScripts Policy Enabled via Registry DWORD
Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule TeamWindowsregistry_setLow222Free2023-10-18Windows MSSQL Failed Logon (Event ID 18456) Detection
Alerts on MSSQL-related failed login attempts (Event ID 18456) captured in Windows application logs.
Nasreddine Bencherchali (Nextron Systems), j4son, Huntrule TeamWindowsapplicationLow80Free2023-10-11Windows ScreenConnect RMM System Command Execution via cmd.exe
Flags cmd.exe launched by ScreenConnect.ClientService.exe with a TEMP\ScreenConnect command-line path.
Ali Alwashali, Huntrule TeamWindowsprocess_creationLow171Free2023-10-10Windows: ScreenConnect Temporary File Creation in ConnectWiseControl Temp
Flags file writes to ScreenConnect’s ConnectWiseControl\Temp staging directory from ScreenConnect.WindowsClient.exe.
Ali Alwashali, Huntrule TeamWindowsfile_eventLow92Free2023-10-10Windows Application: ScreenConnect RMM File Transfer Activity (Event 201)
Flags ScreenConnect RMM file transfer events on Windows based on provider name, Event ID 201, and transfer action text.
Ali Alwashali, Huntrule TeamWindowsapplicationLow174Free2023-10-10Windows ScreenConnect Remote Command Execution (EventID 200)
Detects ScreenConnect command execution on Windows by matching EventID 200 with an 'Executed command of length' message.
Ali Alwashali, Huntrule TeamWindowsapplicationLow173Free2023-10-10Windows Service Registry Key ReadControl Access (Event ID 4663)
Flags READ_CONTROL access requests to service registry keys (\SYSTEM\ControlSet\Services\) via Windows Security Event 4663.
Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule TeamWindowssecurityLow163Free2023-09-28Windows Registry Scheduled Task Cache Key Creation Detection
Flags registry event activity under Scheduled TaskCache indicating scheduled task creation or updates on Windows.
Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule TeamWindowsregistry_eventLow120Free2023-09-27Windows Scheduled Task File Creation Activity (File Event)
Flags file creation under Windows scheduled task directories that may indicate new scheduled task persistence.
Center for Threat Informed Defense (CTID) Summiting the Pyramid Team, Huntrule TeamWindowsfile_eventLow90Free2023-09-27Windows File Access to .reg and .hive Backups by Uncommon Applications
Alerts on access to .hive/.reg files from less-common application paths on Windows.
frack113, Huntrule TeamWindowsfile_accessLow100Free2023-09-15Windows: Headless Chromium Browser Execution via --headless
Alerts on headless Chromium-based browser launches on Windows using the "--headless" command-line flag.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationLow130Free2023-09-12Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow160Free2023-09-07