Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,326 rules
Windows wscript.exe DNS Queries to Potentially Malicious Hex-Label Domains
Alerts when wscript.exe triggers DNS lookups for domains matching a C2-like regex pattern.
Dusty Miller, Huntrule TeamWindowsdns_queryHigh162Free2023-02-23Joomla Webserver: Potential CVE-2023-23752 Exploitation via GET public=true on /api/index.php/v1/
Alerts on GET requests to Joomla API paths with 'public=true' query parameters commonly associated with CVE-2023-23752 probing.
Bhabesh Raj, Huntrule Team—webserverHigh111Free2023-02-23Windows: Mounting Internet Hosted WebDAV Shares via net.exe
Alerts on net.exe (net1.exe) commands that mount an HTTP/WebDAV network share.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh70Free2023-02-21macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
Identifies PlistBuddy commands that enable RunAtLoad for LaunchAgents or LaunchDaemons persistence on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh161Free2023-02-18Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)
Alerts on Windows process launches with command lines containing Unicode U+202E to support right-to-left text obfuscation.
Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux, Huntrule TeamWindowsprocess_creationHigh82Free2023-02-15Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags
Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh140Free2023-02-15Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags
Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2023-02-15Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags
Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh132Free2023-02-15Windows: CertOC.exe Loading a DLL from User-Writable Paths via -LoadDLL
Alerts on CertOC.exe using -LoadDLL with DLLs from temp/user-writable directories on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2023-02-15Windows execution of LocalPotato POC (LocalPotato.exe with specific PE/CLI traits)
Detects LocalPotato.exe process execution on Windows using image path, typical CLI parameters, and known imphash values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh91Free2023-02-14Potential CVE-2022-21587 Arbitrary File Upload Attempts via Oracle EBS Web Services
Alerts on POST requests with uueupload=TRUE targeting specific Oracle EBS OA_HTML services associated with CVE-2022-21587.
Isa Almannaei, Huntrule Team—webserverHigh133Free2023-02-13Velocity Application Errors Indicating Potential Server-Side Template Injection
Detects Velocity template rendering exceptions in application error logs that may indicate user-influenced SSTI attempts.
Moti Harmats, Huntrule TeamVelocityapplicationHigh102Free2023-02-11Potential SpEL Injection Attempts Triggering Spring ExpressionException (Application Logs)
Alerts on Spring ExpressionException errors that may indicate potential SpEL injection attempts.
Moti Harmats, Huntrule TeamSpringapplicationHigh453Free2023-02-11Node.js Application Errors Involving child_process Indicative of RCE Attempts
Flags Node.js ERROR logs mentioning node:child_process, which may signal command execution and possible RCE risk.
Moti Harmats, Huntrule TeamNodejsapplicationHigh91Free2023-02-11JVM Application Logs Indicating Potential XXE via XML Parser Exceptions
Alerts on JVM XML parsing exception messages in application error logs that may indicate attempted XXE exploitation.
Moti Harmats, Huntrule TeamJvmapplicationHigh114Free2023-02-11