Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell
Detects Windows command-line activity that adds a user to the local Remote Desktop Users group using net localgroup or Add-LocalGroupMember.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh462Free2021-12-06Windows: Network connections initiated to api.mega.co.nz or mega.nz
Identifies initiated Windows outbound connections to api.mega.co.nz/mega.nz for potential file-transfer staging.
Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionLow237Free2021-12-06Windows: Remote Network Share Writes to desktop.ini
Flags remote network-shared desktop.ini being written to with high-impact permissions in Windows Security logs.
Tim Shelton (HAWK.IO), Huntrule TeamWindowssecurityMedium3910Free2021-12-06Windows sc.exe Service Query Execution via Process Creation
Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.
frack113, Huntrule TeamWindowsprocess_creationLow160Free2021-12-06Windows System Logs: Windows Update Client errors (connection, install, uninstall, revert, commit)
Alerts on Windows Update Client errors in System logs, including connection, install, uninstall, revert, and commit failures.
frack113, Huntrule TeamWindowssystemInformational278Free2021-12-04Windows Process Command Line Containing Whoami as First Parameter
Flags Windows process creations with command lines containing '.exe whoami' to surface potential discovery behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh243Free2021-11-29Windows Regsvr32.exe Executed with Suspicious File Extension Masquerading as DLL
Alerts when REGSVR32.exe runs with a command-line argument ending in a suspicious masquerade file extension.
Florian Roth (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationHigh221Free2021-11-29Windows File Writes from NPPSpy Hacktool: NPPSpy.txt and NPPSpy.dll
Alerts on Windows file events writing NPPSpy.txt or NPPSpy.dll, consistent with credential dumping by the NPPSpy hacktool.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh172Free2021-11-29Linux auditd: getcap scanning for setuid/setgid-capable files under root
Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.
Pawel Mazur, Huntrule TeamLinuxauditdLow163Free2021-11-28Windows LSASS Process Clone Execution Observed
Alerts on process creation where LSASS creates a new LSASS clone, which may indicate credential dumping activity.
Florian Roth (Nextron Systems), Samir Bousseaden, Huntrule TeamWindowsprocess_creationCritical512Free2021-11-27Windows LSASS Memory Access via Process Access Flags From Suspicious Paths
Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_accessMedium190Free2021-11-27Windows extrac32.exe CAB extraction via Alternate Data Stream execution
Flags Windows executions of extrac32.exe that target a .cab and include an alternate data stream path indicator.
frack113, Huntrule TeamWindowsprocess_creationMedium273Free2021-11-26Windows Diantz.exe Command-Line ADS CAB Creation
Flags Diantz commands that create or reference a .cab using an Alternate Data Stream (ADS) pattern on Windows.
frack113, Huntrule TeamWindowsprocess_creationMedium326Free2021-11-26Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder
Alerts on Visual Studio–staged dump64.exe masquerading, potentially indicating an attempt to bypass Windows Defender AV.
Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh151Free2021-11-26Windows ConfigSecurityPolicy.EXE Used for HTTP/FTP Arbitrary File Transfers
Alert when ConfigSecurityPolicy.exe runs with ftp/http/https URLs in the command line, indicating potential file transfer abuse.
frack113, Huntrule TeamWindowsprocess_creationMedium203Free2021-11-26