Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution
Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.
frack113, Huntrule TeamWindowsprocess_creationMedium201Free2021-12-10Windows Net.exe Network Connections Discovery via Use Sessions Query
Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.
frack113, Huntrule TeamWindowsprocess_creationLow180Free2021-12-10Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets
Alerts when SharpView.exe runs with command-line indicators of AD and network discovery/enumeration activity.
frack113, Huntrule TeamWindowsprocess_creationHigh192Free2021-12-10PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)
Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.
frack113, Huntrule TeamWindowsps_moduleLow211Free2021-12-10Windows PowerShell: Query TCP connections with Get-NetTCPConnection
Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.
frack113, Huntrule TeamWindowsps_classic_startLow522Free2021-12-10Suspicious /dev/tcp Usage in Linux Shell Commands
Flags Linux shell commands containing suspicious /dev/tcp redirection and file descriptor constructs.
frack113, Huntrule TeamLinux—Medium415Free2021-12-10Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer
Flags webserver requests with ${jndi:...} payloads in User-Agent, URI query, or Referer indicative of Log4Shell attempts.
Florian Roth (Nextron Systems), Huntrule Team—webserverHigh355Free2021-12-10Webserver detection of Log4j RCE (CVE-2021-44228) JNDI injection patterns
Detects webserver traffic containing Log4Shell-style JNDI injection payload strings, excluding Nessus scan artifacts.
Florian Roth (Nextron Systems), Huntrule Team—webserverHigh181Free2021-12-10Windows Process Creation: Suspicious Executable Image Extension
Flags Windows process creations where the executable image path ends with an unexpected extension, after filtering known benign cases.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium478Free2021-12-09Windows Process Creation: Executable Image Missing Absolute Path (Possible Process Ghosting)
Flags Windows process creation where the executable Image lacks an absolute path, potentially indicating process ghosting.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh431Free2021-12-09Grafana Web Path Traversal Exploitation (CVE-2021-43798) With 200 Responses
Alerts on Grafana web requests with traversal patterns in the URI query that return HTTP 200.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical4710Free2021-12-08Windows Process Creation: Suspicious Network Configuration and Discovery Commands
Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule TeamWindowsprocess_creationLow313Free2021-12-07Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)
Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule TeamWindowsprocess_creationLow256Free2021-12-07Windows PowerShell Process Creation with DInjector Cradle Flags (/am51 and /password)
Identifies Dinject PowerShell cradle usage by matching command-line flags '/am51' and '/password' in Windows process creation.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical5010Free2021-12-07Windows: Suspicious PowerShell Interactive History Files Created as SYSTEM
Alerts on creation of PowerShell interactive history/profile files under SYSTEM, signaling privileged PowerShell activity.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh304Free2021-12-07