Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows File Deletion: Remove Zone.Identifier Alternate Data Stream
Alerts on Windows deletions of the Zone.Identifier ADS, which attackers may remove to evade zone-based security controls.
frack113, Huntrule TeamWindowsfile_deleteLow220Free2023-09-04Windows: Detect WinRAR Creating .rev Files Associated with CVE-2023-40477
Alert on .rev file creation tied to WinRAR/Explorer on Windows as an indicator of potential CVE-2023-40477 exploitation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow155Free2023-08-31Linux Process Discovery of Container Environment via ls -i on / Directory
Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow366Free2023-08-23Linux Docker Container Discovery via .dockerenv File Listing or Reads
Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow143Free2023-08-23Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools
Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow222Free2023-08-23macOS: JAMF CLI (jamf) execution for account and MDM management
Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.
Jay Pandit, Huntrule TeamMacosprocess_creationLow231Free2023-08-22Windows PowerShell Script Modifies File Permissions with Set-Acl
Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptLow170Free2023-07-18PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule TeamWindowsps_moduleLow90Free2023-07-13Linux Named Pipe Creation via mkfifo Process Execution
Flags Linux process executions of /mkfifo that create named pipes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow130Free2023-06-16Windows DLL Sideloading Indicators: 7za.dll Loaded from Non-Program Files Paths
Alerts when a process loads 7za.dll from a non-Program Files path, indicating potential DLL sideloading.
X__Junior, Huntrule TeamWindowsimage_loadLow196Free2023-06-09Linux OS Architecture Discovery Using grep
Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationLow398Free2023-06-02Linux Process Creation: crontab -l Enumeration
Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationLow291Free2023-06-02Linux Shell Script Creation in /etc/profile.d/ for Persistence
Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxfile_eventLow183Free2023-06-02Windows Registry: New ODBC Driver Registration via ODBCINST.INI
Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow183Free2023-05-23Windows Excel Loads .XLL Add-In Files
Flags excel.exe loading a .XLL add-in module, an execution indicator for potential malicious add-in activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadLow180Free2023-05-12