Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows PowerShell: Disable Windows Firewall Profile via Set-NetFirewallProfile
Flags PowerShell commands that disable one or more Windows Firewall profiles via Set-NetFirewallProfile -Enabled $false.
Austin Songer @austinsonger, Huntrule TeamWindowsps_scriptMedium162Free2021-10-12OneLogin: Detect API user account lock or suspension events
Flags OneLogin API events indicating a user account was locked or suspended.
Austin Songer @austinsonger, Huntrule TeamOneloginonelogin.eventsLow313Free2021-10-12OneLogin: User Assumes Another Account via Event Type 3
Alerts on OneLogin events indicating a user assumed another user account via event_type_id 3.
Austin Songer @austinsonger, Huntrule TeamOneloginonelogin.eventsLow321Free2021-10-12Azure Sign-in Logs: Conditional Access Blocks User Token Issuance (ResultType 53003)
Flags Azure sign-in attempts blocked by Conditional Access due to token issuance denial.
AlertIQ, Huntrule TeamAzuresigninlogsMedium4310Free2021-10-10Azure Sign-in Log MFA Interrupted via Strong Auth Failures
Identifies Azure sign-ins that fail during strong/MFA authentication, suggesting blocked credential attempts.
AlertIQ, Huntrule TeamAzuresigninlogsMedium345Free2021-10-10Azure AD Sign-in Attempts to Disabled Accounts
Alerts on Azure AD sign-in attempts that fail because the target account is disabled.
AlertIQ, Huntrule TeamAzuresigninlogsMedium413Free2021-10-10Azure AD Sign-In Logs: Account Locked After Too Many Failed Password/User ID Attempts
Flags Azure sign-in events where accounts are locked due to excessive failed logons from wrong user ID or password.
AlertIQ, Huntrule TeamAzuresigninlogsMedium358Free2021-10-10Azure Audit Logs: User registered security info (authentication method change)
Flags Azure AD audit events where a user registers new authentication security info.
AlertIQ, Huntrule TeamAzureauditlogsMedium123Free2021-10-10Linux auditd: Detect processes using --cpu-priority command-line parameter (possible miner behavior)
Alerts on Linux processes whose command line includes --cpu-priority, a common miner CPU tuning flag.
Florian Roth (Nextron Systems), Huntrule TeamLinuxauditdCritical181Free2021-10-09Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries
Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.
bohops, Bhabesh Raj, Huntrule TeamWindowsprocess_creationHigh213Free2021-10-08Windows Named Pipe Access to ADFS/WID Database by Uncommon Process
Alert on named pipe creation to the AD FS WID SQL query endpoint when initiated by uncommon processes.
Roberto Rodriguez @Cyb3rWard0g, Huntrule TeamWindowspipe_createdMedium252Free2021-10-08Windows Registry Writes for NetWire-Related Keys
Flags newly added Windows registry keys with paths containing \\software\\NetWire, consistent with potential NetWire-related persistence.
Christopher Peacock, Huntrule TeamWindowsregistry_addHigh203Free2021-10-07Webserver: Successful IIS shortname fuzzing scan using "~1" parameter
Alerts on successful IIS probing requests containing ~1 and ending with a.aspx using GET/OPTIONS.
frack113, Huntrule TeamWebwebserverMedium302Free2021-10-06Apache HTTP Server Web Path Traversal Attempt via Encoded Traversal Sequences (CVE-2021-41773)
Alerts on Apache requests with encoded traversal strings that return 200/301, consistent with CVE-2021-41773 probing.
daffainfo, Florian Roth, Huntrule Team—webserverHigh191Free2021-10-05Azure AD Audit Logs: User Added to Administrator Role
Flags Azure AD audit events where a user is added to an Admin/Administrator role.
Raphaël CALVET, @MetallicHack, Huntrule TeamAzureauditlogsMedium133Free2021-10-04