Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Microsoft 365 Cloud App Security: Unusual Large Volume of File Deletion
Alerts when Microsoft 365 threat telemetry shows a user successfully deleting an unusually large number of files.
austinsonger, Huntrule TeamM365threat_managementMedium271Free2021-08-19Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload
Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.
austinsonger, Huntrule TeamM365threat_managementMedium492Free2021-08-19Fortinet WAF: Detect POST to /api/v2.0/user/remoteserver.saml (CVE-2021-22123 attempt)
Flags suspicious Fortinet WAF HTTP POST requests targeting a remoteserver.saml API query pattern consistent with CVE-2021-22123 exploitation.
Bhabesh Raj, Florian Roth, Huntrule Team—webserverCritical162Free2021-08-19Windows PowerShell: Add-Content to $profile for Potential Persistence
Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium293Free2021-08-18Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Flags Zeek DCE/RPC calls with operation names starting "efs" that may indicate suspicious EFS RPC usage.
"@neu5ron, @Antonlovesdnb, Mike Remen, Huntrule Team"Zeekdce_rpcMedium161Free2021-08-17Windows Procdump Process Execution
Alerts on execution of Sysinternals Procdump (32/64 variants) based on process creation image path.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium572Free2021-08-16Google Cloud VPN Tunnel Insert or Delete via Audit Logs
Alerts on Google Cloud audit events showing VPN tunnel insertion or deletion.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium161Free2021-08-16Azure Activity Logs: Alert Suppression Rule Write Operations
Flags when an Azure alert suppression rule is created via the security alerts suppression write operation.
Austin Songer, Huntrule TeamAzureactivitylogsMedium457Free2021-08-16Azure Key Vault secret modified or deleted activity
Flags Azure Key Vault secret write, update, delete, purge, and restore operations in Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium496Free2021-08-16Azure Key Vault Modified or Deleted via Activity Log Operations
Alerts on Azure Activity Log Key Vault management operations: write, delete, deploy actions, or access policy changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium162Free2021-08-16Azure Key Vault Key Modified or Deleted via Activity Log Operations
Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium153Free2021-08-16Azure Application Security Group Modified or Deleted via Activity Log Write/Delete
Flags Azure Activity Log events showing Application Security Group write (modify) or delete operations.
Austin Songer, Huntrule TeamAzureactivitylogsMedium203Free2021-08-16Azure Application Gateway Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that modify or delete Application Gateway resources.
Austin Songer, Huntrule TeamAzureactivitylogsMedium332Free2021-08-16AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.
Austin Songer, Huntrule TeamAwscloudtrailLow496Free2021-08-16Antivirus alerts on known hacktool and attack tool signatures
Alerts on Antivirus detections matching hacktool signature prefixes or offensive tool names for investigation.
Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team—antivirusHigh273Free2021-08-16