Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Registry: RDP PortNumber changed from default 3389
Alerts on Windows registry updates to the RDP-Tcp PortNumber when it changes away from default 3389.
frack113, Huntrule TeamWindowsregistry_setHigh222Free2022-01-01Windows WMIC Process Flag Execution Indicating Process Reconnaissance
Alerts on wm ic.exe executions using the 'process' flag, consistent with attempting to enumerate running processes.
frack113, Huntrule TeamWindowsprocess_creationMedium121Free2022-01-01Windows Process Creation: Suspicious systeminfo.exe Execution
Alerts on execution of systeminfo.exe (or sysinfo.exe) via Windows process creation logs for system discovery.
frack113, Huntrule TeamWindowsprocess_creationLow253Free2022-01-01Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line
Flags shutdown.exe executions that include reboot (/r) or shutdown (/s) switches in the command line.
frack113, Huntrule TeamWindowsprocess_creationMedium161Free2022-01-01Windows Process Creation: Suspicious reg.exe Query for MachineGuid
Detects reg.exe queries for MachineGuid under SOFTWARE\Microsoft\Cryptography via process creation logs.
frack113, Huntrule TeamWindowsprocess_creationLow465Free2022-01-01Windows adidnsdump Execution via python.exe
Detects python.exe running adidnsdump, a DNS-record enumeration tool used for internal AD recon.
frack113, Huntrule TeamWindowsprocess_creationLow369Free2022-01-01Windows: Suspicious Process Execution of hostname.exe
Flags execution of hostname.exe from process creation events on Windows for discovery activity.
frack113, Huntrule TeamWindowsprocess_creationLow171Free2022-01-01SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration
Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh172Free2022-01-01SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)
Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh3010Free2022-01-01RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)
Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh577Free2022-01-01RPC Firewall Alerts for Remote Scheduled Task Creation/Execution via SASec
Identifies remote scheduled task create/execute RPC calls via SASec using RPC Firewall EventLog RPCFW events.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh274Free2022-01-01RPC Firewall Logs: Remote Encryption Service RPC Call Detected for Lateral Movement
Alerts on RPC Firewall events indicating remote MS-EFSR encryption service RPC activity that may support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh252Free2022-01-01MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
Flags RPC firewall EventID 3 targeting the MS-SRVS interface UUID associated with remote server service abuse.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh90Free2022-01-01RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)
Alerts on RPC Firewall RRP calls for remote registry information collection on the monitored interface UUID.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh152Free2022-01-01Windows RPC Firewall Registry Modification Calls via MS-RRP OpNums
Alerts on RPC Firewall registry-interface RPC calls (EventID 3) with OpNums tied to remote registry modification.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh113Free2022-01-01