Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,325 rules
Potential OGNL Expression Injection Exploitation in JVM Application Logs
Detects ERROR-level JVM application log entries containing OGNL parsing/syntax exception indicators that may suggest OGNL injection attempts.
Moti Harmats, Huntrule TeamJvmapplicationHigh92Free2023-02-11JVM Application Errors Indicating Local File Read Path Traversal Attempts
JVM app error logs with FileNotFoundException plus /../../.. patterns can indicate attempted local file path traversal.
Moti Harmats, Huntrule TeamJvmapplicationHigh381Free2023-02-11JVM Application Error Logs Indicating Potential JNDI Injection Exploitation
Alerts when JVM application error logs include JNDI/LDAP and Log4j JndiManager keyword indicators.
Moti Harmats, Huntrule TeamJvmapplicationHigh123Free2023-02-11Windows: Suspicious Executable Created in Temp by OneNote (onenote.exe/onenotem.exe/onenoteim.exe)
Alerts when OneNote creates files in Temp\OneNote with script/executable extensions on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh141Free2023-02-09Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1
Alerts when Outlook’s EnableUnsafeClientMailRules registry value is enabled (DWORD 0x1), reducing mailbox macro/script protections.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh112Free2023-02-08Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript
Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh295Free2023-02-08Windows: Suspicious Outlook VbaProject.OTM Macro File Created
High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh206Free2023-02-08Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh90Free2023-02-02macOS OSACompile Run-Only Script Execution
Flags osacompile commands on macOS using run-only (-x) with inline script (-e) execution.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh511Free2023-01-31macOS Office Apps Spawning Shell or Scripting Processes
Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh289Free2023-01-31macOS JXA In-Memory Execution via osascript JavaScript eval and NSData URL loading
Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh153Free2023-01-31Linux process copying passwd or shadow from /tmp
Alerts on Linux cp commands that copy /tmp-based passwd or shadow files.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationHigh351Free2023-01-31Windows PowerShell Base64-Encoded WMI Class Invocation
Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.
Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh92Free2023-01-30GitHub Audit: High-Risk Security Controls Disabled
Alerts when GitHub audit logs show advanced security, OAuth restrictions, or 2FA requirements disabled for orgs or repos.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditHigh133Free2023-01-29GitHub Audit: Dependabot Alerts and Security Updates Disabled
Flags GitHub audit events where Dependabot alerts or security updates are disabled for an organization or repositories.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditHigh102Free2023-01-27