Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Okta MFA Deactivation or Full Factor Reset Event Detection
Flags Okta events indicating MFA deactivation or reset_all actions by a user or actor.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium477Free2021-09-21Azure Activity Logs: New CloudShell Created via Microsoft.Portal Consoles Write
Alerts on Azure portal activity indicating a Cloud Shell console was created.
Austin Songer, Huntrule TeamAzureactivitylogsMedium461Free2021-09-21Windows: Xwizard.exe Execution from Non-Default Directory
Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.
Christian Burkard (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh625Free2021-09-20Detect suspicious AD SelfService web requests targeting report generation and API endpoints
Flags web requests with URL query strings targeting known ADSelfService exploitation paths for CVE-2021-40539.
Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems), Huntrule Team—webserverHigh120Free2021-09-20Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
Alert on HTTP 200 POST /wsman with no Authorization header and a non-empty body in Zeek logs, consistent with OMIGOD unauthenticated RCE attempts.
Nate Guagenti (neu5ron), Huntrule TeamZeekhttpHigh336Free2021-09-20PowerShell Add-DnsClientNrptRule Modifies NRPT Namespaces
Flags PowerShell scripts that add DNS Name Resolution Policy Table rules for a specified namespace.
Borna Talebi, Huntrule TeamWindowsps_scriptHigh292Free2021-09-14Linux screen capture using xwd saving a .xwd file
Flags xwd screen capture executions that write captured output to a .xwd file on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow183Free2021-09-13Okta User Account Lockout Triggered by Max Sign-In Attempts
Flags Okta user account lockouts triggered by exceeding the max sign-in attempts threshold.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium222Free2021-09-12Okta: Unauthorized App Access Attempt Based on System Log Message
Alerts when Okta logs show a user attempted unauthorized access to an app.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium493Free2021-09-12Okta: Detect security.threat.detected events in threat insight
Flags Okta System Log security.threat.detected events indicating a detected potential security threat.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium505Free2021-09-12Okta Policy Rule Updated or Deleted
Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium132Free2021-09-12Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow221Free2021-09-12Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
Flags Okta System Log events when a Network Zone is deactivated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium533Free2021-09-12Okta Sign-On Policy Updated or Rule Deleted
Flags Okta sign-on policy updates and sign-on rule deletions in application policies.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium192Free2021-09-12Okta Application Lifecycle Update or Deletion Events
Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium212Free2021-09-12