Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows rmdir Directory Removal via cmd.exe Execution
Monitors cmd.exe process creation where rmdir is used with /s and/or /q to delete directories and reduce forensic artifacts.
frack113, Huntrule TeamWindowsprocess_creationLow170Free2022-01-15Windows del/erase Command-Line File Deletion via cmd.exe
Flags cmd.exe executions running del/erase for file removal, including common flags like /f, /s, and /q.
frack113, Huntrule TeamWindowsprocess_creationLow309Free2022-01-15Windows PowerShell: Start-Process with -PassThru and -FilePath
Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.
frack113, Huntrule TeamWindowsps_scriptMedium271Free2022-01-15Windows PowerShell ScriptBlock Use of Remove-Item to Delete Files or Folders
Alerts on PowerShell ScriptBlockText containing Remove-Item/del/rm/rd-style -Path deletion commands.
frack113, Huntrule TeamWindowsps_scriptLow100Free2022-01-15Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell
Alert on ws_TomcatService.exe spawning cmd.exe or PowerShell on Windows as suspicious exploitation activity.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh182Free2022-01-14Windows rundll32 Process Creation With Uncommon DLL Extension in Command Line
Alerts on Windows rundll32 executions whose command lines lack common .cpl/.dll/.inf endings, indicating potential unusual invocation.
Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou, Huntrule TeamWindowsprocess_creationMedium4410Free2022-01-13Windows Sysmon Configuration Change (Event ID 16)
Alerts on Sysmon configuration changes via Sysmon Event ID 16 on Windows.
frack113, Huntrule TeamWindowssysmonMedium203Free2022-01-12Windows: Process creation event for Sysmon uninstall using Sysmon -u
Flags attempts to uninstall Sysmon on Windows by running Sysmon with the -u flag.
frack113, Huntrule TeamWindowsprocess_creationHigh579Free2022-01-12PowerShell Script Creates Volume Shadow Copy via Win32_ShadowCopy
Alerts when PowerShell script blocks invoke Win32_ShadowCopy.Create to create a ClientAccessible shadow copy.
frack113, Huntrule TeamWindowsps_scriptHigh261Free2022-01-12Windows ProcDump renamed, copied or moved for stealth evasion
Alerts on ProcDump commands that copy/move or rename dump outputs, including LSASS dump filename patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh293Free2022-01-11Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter
Alerts when regsvr32 is invoked with an /i: HTTP/HTTPS IP pattern to fetch remote DLLs.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh212Free2022-01-11Windows Process Execution: Microsoft.NodejsTools.PressAnyKey.exe Child Spawns
Flags child processes started by Microsoft.NodejsTools.PressAnyKey.exe, which may be abused to run arbitrary binaries.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium223Free2022-01-11Windows mpiexec.exe LOLBin: Flag combination with -n/n 1 for potential arbitrary execution
Alerts on Windows executions of mpiexec.exe with /n 1 or -n 1, correlated to a specific imphash, indicating LOLBin-style behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2022-01-11Windows: Detect devinit.exe MSI download flag combo (-t msi-install, -i http)
Alerts on devinit.exe command lines that combine MSI install with an HTTP download source.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium183Free2022-01-11Windows Browser Process Spawned with Inline URL Pointing to Suspicious File Extension
Flags Windows browser processes launched with an inline HTTP URL pointing to files with suspicious extensions.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium404Free2022-01-11