Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Windows adidnsdump Execution via python.exe
Detects python.exe running adidnsdump, a DNS-record enumeration tool used for internal AD recon.
frack113, Huntrule TeamWindowsprocess_creationLow299Free2022-01-01Windows: Suspicious Process Execution of hostname.exe
Flags execution of hostname.exe from process creation events on Windows for discovery activity.
frack113, Huntrule TeamWindowsprocess_creationLow111Free2022-01-01SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration
Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh112Free2022-01-01SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)
Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh1710Free2022-01-01RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)
Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh477Free2022-01-01RPC Firewall Alerts for Remote Scheduled Task Creation/Execution via SASec
Identifies remote scheduled task create/execute RPC calls via SASec using RPC Firewall EventLog RPCFW events.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh234Free2022-01-01RPC Firewall Logs: Remote Encryption Service RPC Call Detected for Lateral Movement
Alerts on RPC Firewall events indicating remote MS-EFSR encryption service RPC activity that may support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh122Free2022-01-01MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
Flags RPC firewall EventID 3 targeting the MS-SRVS interface UUID associated with remote server service abuse.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh60Free2022-01-01RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)
Alerts on RPC Firewall RRP calls for remote registry information collection on the monitored interface UUID.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh112Free2022-01-01Windows RPC Firewall Registry Modification Calls via MS-RRP OpNums
Alerts on RPC Firewall registry-interface RPC calls (EventID 3) with OpNums tied to remote registry modification.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh93Free2022-01-01RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs
Alerts on RPC Firewall RPC events indicating remote DCOM/WMI interface activity that can support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh3010Free2022-01-01RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement
Alerts on RPC Firewall EventID 3 events for MS-RPRN/MS-PAR remote printing RPC interface UUIDs.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh103Free2022-01-01RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)
Flags RPC calls to ITaskSchedulerService that query scheduled task information using RPC firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh121Free2022-01-01Remote ITaskSchedulerService RPC Create/Execute Scheduled Tasks Used for Lateral Movement
Detects RPC Firewall alerts for remote ITaskSchedulerService calls that create or execute scheduled tasks.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh111Free2022-01-01Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
Flags RPC Firewall EventID 3 remote calls querying Windows Event Log data over EVEN/EVEN6 interfaces.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh396Free2022-01-01