Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs
Alerts on RPC Firewall RPC events indicating remote DCOM/WMI interface activity that can support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh3110Free2022-01-01RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement
Alerts on RPC Firewall EventID 3 events for MS-RPRN/MS-PAR remote printing RPC interface UUIDs.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh173Free2022-01-01RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)
Flags RPC calls to ITaskSchedulerService that query scheduled task information using RPC firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh271Free2022-01-01Remote ITaskSchedulerService RPC Create/Execute Scheduled Tasks Used for Lateral Movement
Detects RPC Firewall alerts for remote ITaskSchedulerService calls that create or execute scheduled tasks.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh181Free2022-01-01Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
Flags RPC Firewall EventID 3 remote calls querying Windows Event Log data over EVEN/EVEN6 interfaces.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh486Free2022-01-01RPC Firewall: Remote MS-EFSR encryption interface calls (EventID 3)
Alerts on RPC Firewall events targeting MS-EFSR interface UUIDs associated with remote encrypting file system abuse.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh251Free2022-01-01RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts
Alerts on MS-DRSR RPC Firewall events where non-standard opcodes target the DRSR interface from non-DC hosts.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh388Free2022-01-01RPC Firewall AtScv Remote Schedule Task Information Recon
Identifies remote AtScv RPC calls that access scheduled task information via RPC Firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh387Free2022-01-01Windows ATSvc Remote RPC Scheduled Task Creation or Execution (RPC Firewall)
Identifies remote ATSvc RPC calls for scheduled task creation/execution using RPC Firewall EventID 3 and OpNum 0/1.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh524Free2022-01-01Windows Winlogon Notify Registry Key DLL Persistence (logon)
Alerts on DLL-specified Winlogon Notify logon entries created via registry set events.
frack113, Huntrule TeamWindowsregistry_setHigh322Free2021-12-30Windows Registry Modification of Application Shim Database (InstalledSDB/Custom) for Persistence
Alerts on registry changes to Windows AppCompatFlags InstalledSDB/Custom that may enable shim-based persistence.
frack113, Huntrule TeamWindowsregistry_setMedium221Free2021-12-30Windows Registry: Add Print Port Monitor DLL Persistence
Flags registry updates to Print Port Monitors that reference .dll components for potential startup persistence on Windows.
frack113, Huntrule TeamWindowsregistry_setMedium482Free2021-12-30Windows Reg.exe Modifies Service ImagePath in HKLM\SYSTEM\CurrentControlSet\Services
Alerts on reg.exe commands that target HKLM\SYSTEM\CurrentControlSet\Services\ImagePath modifications.
frack113, Huntrule TeamWindowsprocess_creationMedium455Free2021-12-30Windows PowerShell ScriptBlock checks for service registry ACL inspection
Flags PowerShell scripts that use Get-ACL to inspect service Registry keys under HKLM\SYSTEM\CurrentControlSet\Services.
frack113, Huntrule TeamWindowsps_scriptMedium201Free2021-12-30Windows PowerShell script sets COR_PROFILER environment variables for .NET CLR profiling
Alerts on PowerShell script blocks that set CLR profiler environment variables (COR_ENABLE_PROFILING/COR_PROFILER/COR_PROFILER_PATH).
frack113, Huntrule TeamWindowsps_scriptMedium292Free2021-12-30