Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
DNS Queries to Katz Stealer–Associated Domains (Network)
Alerts on DNS queries for domains associated with Katz Stealer.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—dnsHigh344Free2025-05-22Windows DLL Load Indicators for Katz Stealer 2025 Variants
Alerts on Windows image loads of DLLs with Katz Stealer-associated names/paths.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh323Free2025-05-22Windows DNS Queries to Katz Stealer-Related Domains
Alerts on Windows DNS queries to domains associated with Katz Stealer malware infrastructure.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsdns_queryHigh315Free2025-05-22Windows RMM Tool MeshAgent Execution with Renamed MeshServiceName
Identifies renamed MeshAgent executions on Windows by matching --meshServiceName with OriginalFileName containing meshagent.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamWindowsprocess_creationHigh121Free2025-05-19Windows MeshAgent Remote Access Tool Command Line Execution Indicators
Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamWindowsprocess_creationMedium70Free2025-05-19Windows Impacket-Pattern File Creation: sessionresume_[a-zA-Z]{8} Indicator
Flags Windows file creations of filenames matching Impacket sessionresume pattern ('sessionresume_<8 letters>').
The DFIR Report, IrishDeath, Huntrule TeamWindowsfile_eventHigh142Free2025-05-19macOS Process Creation: MeshAgent renamed execution via --meshServiceName
Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamMacosprocess_creationHigh174Free2025-05-19macOS Process Creation: MeshAgent Remote Access via --meshServiceName
Alerts on macOS process executions containing --meshServiceName, indicating potential MeshAgent remote access usage.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamMacosprocess_creationMedium120Free2025-05-19Webserver POST Uploads Java Web Shell Files in SAP NetViewer
Alerts on POST requests to /irj/ endpoints uploading Java extension files with octet-stream content type.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—webserverHigh153Free2025-05-14SAP NetViewer Webshell Command Execution via JSP cmd Parameter
Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—webserverHigh287Free2025-05-14Windows WER BugCheck Crash Dump Reporting via Event ID 1001
Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.
Jason Mull, Huntrule TeamWindowssystemMedium112Free2025-05-12Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths
Flags SAP NetWeaver web work/root processes spawning Windows command/script tools that may indicate server-side execution.
Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium82Free2025-04-28Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)
Alerts when SAP NetWeaver work/root paths spawn common shells or utilities on Linux, indicating potential malicious command execution.
Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium2910Free2025-04-28Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)
Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.
Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventMedium123Free2025-04-28Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories
Alerts on Linux file creation of .jsp/.java/.class under SAP NetWeaver IRJ servlet paths that may indicate webshell deployment.
Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxfile_eventMedium363Free2025-04-28