Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
AWS Glue Dev Endpoint Lifecycle Events (Create/Update/Delete) via CloudTrail
Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow191Free2021-10-03Linux xclip Clipboard Image Collection via Image MIME Types
Flags xclip usage that outputs image/* data from the clipboard on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow182Free2021-10-01Windows: Suspicious Driver Installation via pnputil.exe
Flags pnputil.exe command lines indicating driver install/add actions targeting .inf files on Windows.
Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger, Huntrule TeamWindowsprocess_creationMedium195Free2021-09-30Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:
Alerts on DataSvcUtil.exe runs with /in:, /out:, and /uri: parameters that may indicate data exfiltration activity.
Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger, Huntrule TeamWindowsprocess_creationMedium141Free2021-09-30macOS firmwarepasswd Command-Line Manipulation
Alerts on firmwarepasswd usage on macOS indicating firmware password set, full, delete, or check actions.
Austin Songer @austinsonger, Huntrule TeamMacosprocess_creationMedium243Free2021-09-30Windows Prefetch File Deletion via .pf File Removal
Flags deletion of .pf files in \\Windows\\Prefetch, a possible attempt to remove execution artifacts.
Cedric MAURUGEON, Huntrule TeamWindowsfile_deleteHigh324Free2021-09-29Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll
Alert on loading C:\Windows\ADFS\version.dll, a DLL hijacking indicator consistent with the FoggyWeb technique.
Florian Roth (Nextron Systems), Huntrule TeamWindowsimage_loadCritical503Free2021-09-27Web Path Traversal Exploitation Attempts via Encoded Traversal in URL Query
Alerts on web requests with URL query path traversal patterns targeting /etc/ and other sensitive filesystem paths.
Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWebwebserverMedium151Free2021-09-25Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)
Alerts on Windows executions of rdrleakdiag.exe that request full or targeted memory dumps via /memdmp or /fullmemdmp.
Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh5010Free2021-09-24Clipboard Data Collection via xclip (auditd Linux EXECVE)
Alerts on xclip command lines that request clipboard/clip selection output (-o) on Linux systems monitored by auditd.
Pawel Mazur, Huntrule TeamLinuxauditdLow133Free2021-09-24VMware vCenter Server file upload exploitation attempt for CVE-2021-22005 via POST telemetry endpoint
Identifies POST requests targeting a vCenter telemetry upload endpoint consistent with CVE-2021-22005 exploitation attempts.
Sittikorn S, Huntrule Team—webserverHigh122Free2021-09-24AWS CloudTrail: Lambda Function Updated with New Layer Attached
Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.
Austin Songer, Huntrule TeamAwscloudtrailLow182Free2021-09-23AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates
Flags CloudTrail activity involving SAML provider updates plus SAML role assumptions in AWS, which can enable backdoor access.
Austin Songer, Huntrule TeamAwscloudtrailMedium375Free2021-09-22PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)
Identifies PowerShell use of Get-StorageDiagnosticInfo with -IncludeLiveDump to trigger a live memory dump on Windows.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsps_scriptHigh213Free2021-09-21Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.
Pawel Mazur, Huntrule TeamLinuxauditdLow2410Free2021-09-21