Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows File Writes of TeamViewer Session Logs
Flags Windows file creation events for TeamViewer session log artifacts like vprint.db and TVNetwork.log.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventMedium325Free2022-01-30Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image
Alerts when TeamViewer domains are resolved via DNS by a process whose image name does not include "TeamViewer".
Florian Roth (Nextron Systems), Huntrule TeamWindowsdns_queryMedium494Free2022-01-30Windows: Application Uninstall via WMIC.exe (WMIC call uninstall)
Flags WMIC.exe commands that include "call" and "uninstall," indicating potential application removal on Windows.
frack113, Huntrule TeamWindowsprocess_creationMedium281Free2022-01-28Windows: whoami.exe Executed by Privileged Accounts
Flags execution of whoami.exe from privileged-like accounts using Windows process creation events.
Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Huntrule TeamWindowsprocess_creationHigh234Free2022-01-28Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches
Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3610Free2022-01-28Windows File Creation of TeamViewer_Desktop.exe During Install
Alerts on Windows when TeamViewer_Desktop.exe is created, indicating potential installation or dropped remote-access binaries.
frack113, Huntrule TeamWindowsfile_eventMedium253Free2022-01-28Windows Installer Application Removed via MsiInstaller Events
Alerts on Windows Installer events indicating an application was removed via MsiInstaller.
frack113, Huntrule TeamWindowsapplicationLow191Free2022-01-28Linux auth logs: pkexec and XAUTHORITY strings indicating PwnKit (CVE-2021-4034) attempt
Alerts on Linux auth log entries with pkexec and PwnKit-related environment/session keywords consistent with CVE-2021-4034 attempts.
Sreeman, Huntrule TeamLinuxauthHigh153Free2022-01-26Windows Process Hollowing Suspected via Replaced In-Memory Image
Alerts on Windows events where a process image is replaced in memory, suggesting possible process hollowing.
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S, Huntrule TeamWindowsprocess_tamperingMedium449Free2022-01-25Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)
Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.
Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman, Huntrule TeamWindowsprocess_creationMedium172Free2022-01-25Windows: RunXCmd Command-Line Execution with System or TrustedInstaller Accounts
Flags RunXCmd usage on Windows when invoked to execute commands as System or TrustedInstaller.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh222Free2022-01-24Windows Process Execution: NSudo (NSudo.exe/NSudoLC/NSudoLG)
Alerts on NSudo execution on Windows with privilege and integrity/elevation command-line parameters.
Florian Roth (Nextron Systems), Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationHigh427Free2022-01-24Windows Process Creation: NirCmd runasSystem CommandLine Usage
Alerts on NirCmd being used to run commands as LocalSystem based on the process command line.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh352Free2022-01-24Windows Process Creation: NirCmd Command Execution
Alerts when NirCmd.exe is launched with command-execution-oriented parameters in the process command line.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium201Free2022-01-24BlackByte ransomware Registry Set Persistence and Privilege Changes (Windows)
Alerts on BlackByte-specific Windows registry value changes to DWORD 1 across three predefined keys.
frack113, Huntrule TeamWindowsregistry_setHigh211Free2022-01-24