Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,311 rules
Windows Registry: mpnotify SIP Provider Persistence via Winlogon
Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh411Free2022-07-21Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)
Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh392Free2022-07-21Windows Registry Persistence via HtmlHelp Author Location Modification
Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh143Free2022-07-21Windows Registry Persistence via hhctrl CLSID InprocServer32 Default Modification
Flags registry changes to the hhctrl COM CLSID InprocServer32 (Default) to load a custom binary instead of the system hhctrl.ocx.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh382Free2022-07-21Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key
Flags registry modifications adding a Debugger entry under Windows Error Reporting Hangs, a potential crash-triggered persistence technique.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh264Free2022-07-21Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM
Alerts when PSEXESVC spawns a child process running as LOCAL SYSTEM (AUTHORI/AUTORI) on the local host.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh384Free2022-07-21Windows PsExec Service Binary Renamed Execution via psexesvc.exe
Alerts when psexesvc.exe is executed from a non-standard path, suggesting renamed or relocated PsExec service usage.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2022-07-21Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut
Alert on explorer.exe writing Startup-folder LNK files whose names include {0AFACED1-E828-11D1-9187-B532F1E9575D}, indicating shortcut-based persistence.
Greg (rule), Huntrule TeamWindowsfile_eventHigh71Free2022-07-21Linux Process Command-Line Indicators of Apache Spark Shell Command Injection Attempt
Alerts on Linux process creation where a bash-spawned command line contains `id -Gn ` injection-like backtick or quote patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh267Free2022-07-20Weblog Detection of Apache Spark Shell Command Injection Payloads (?doAs=`)
Alerts on web requests containing "?doAs=`" that may indicate Spark shell command injection attempts.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh112Free2022-07-19Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads
Detects Rejetto HFS HTTP requests with a crafted search parameter and command/script execution indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh278Free2022-07-19Windows UEFI Persistence: Detect wpbbin.exe Execution
Alerts on execution of C:\Windows\System32\wpbbin.exe, a potential indicator of UEFI persistence on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh92Free2022-07-18Windows UEFI Persistence Indicator: Creation of C:\Windows\System32\wpbbin.exe
Flags creation of C:\Windows\System32\wpbbin.exe, a potential UEFI persistence artifact.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh442Free2022-07-18Windows Registry Fax Device Provider ImageName changed to load external DLL
Alerts when Fax Device Providers\ImageName registry values change in a way consistent with DLL-loading persistence.
frack113, Huntrule TeamWindowsregistry_setHigh103Free2022-07-17Windows Registry: User Account Changed for FAX Service
Flags registry changes that alter the FAX service’s associated user account on Windows.
frack113, Huntrule TeamWindowsregistry_setHigh245Free2022-07-17