Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows SystemNightmare Exploitation Attempt via PrintNightmare Command Lines
Alerts on Windows process command lines matching SystemNightmare/PrintNightmare exploitation indicators that may enable LOCAL_SYSTEM shell access.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical213Free2021-08-11Exchange ProxyLogon activity: IIS POST SetObject Reset VirtualDirectory requests
Alerts on successful POSTs to ECP DDIService SetObject resetting a VirtualDirectory with a '$' username suffix.
frack113, Huntrule Team—webserverCritical111Free2021-08-10Windows Maldoc Process Injection via winword.exe CallTrace from LittleCorporal
Flags winword.exe process injection where the call trace matches LittleCorporal-generated Maldoc activity on Windows.
Christian Burkard (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh182Free2021-08-09PowerShell ShellIntel Commandlet Abuse via ScriptBlock Logging
Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.
Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule TeamWindowsps_scriptHigh231Free2021-08-09Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment
Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.
Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems), Huntrule TeamWindowsmsexchange-managementCritical294Free2021-08-09Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation
Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsmsexchange-managementCritical4410Free2021-08-09GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted
Alerts on GCP Kubernetes audit events showing Secrets being updated, patched, or deleted via Kubernetes API calls.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium277Free2021-08-09GCP Kubernetes RBAC RoleBinding Create/Patch/Update/Delete Audit Events
Flags GCP audit events where Kubernetes RBAC RoleBindings/ClusterRoleBindings are created, modified, or removed.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium161Free2021-08-09AWS CloudTrail UpdateLoginProfile: Password/Authentication Profile Modified for Another User
Flags AWS IAM UpdateLoginProfile events where an account updates another user’s login profile password.
toffeebr33k, Huntrule TeamAwscloudtrailHigh4910Free2021-08-09Windows Process Creation: Detects Volume Shadow Copy Listing via vssadmin
Alerts on Windows command lines that list VSS shadow copies and write results to log.txt.
Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh182Free2021-08-09Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths
Flags Exchange-targeted web requests with /autodiscover.json plus exploit URI fragments returning 200/301.
Florian Roth (Nextron Systems), Rich Warren, Huntrule Team—webserverCritical163Free2021-08-09Azure Activity Logs: VPN Connection Modified or Deleted
Alerts on Azure VPN connection updates or removals recorded in Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium228Free2021-08-08Azure Activity Logs: Virtual Network Modified or Deleted
Alerts on Azure Activity Log operations that modify (WRITE) or delete (DELETE) Virtual Network resources.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium162Free2021-08-08Azure Virtual Network Device Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that write or delete virtual network devices such as NICs, virtual appliances, hubs, and routers.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium163Free2021-08-08Azure Activity Log: Network Security Group Config Modified or Deleted
Alerts on Azure Activity Log operations indicating NSG or NSG security rule changes (write/delete) that can weaken network security.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium182Free2021-08-08