Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Azure Activity Logs: Point-to-site VPN Gateway Modified or Deleted
Flags Azure Point-to-site VPN gateway modifications or deletions from Activity Log operation events.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium464Free2021-08-08Azure Firewall Rule Configuration Modified or Deleted via Activity Logs
Flags Azure Activity Log write/delete operations that modify or delete firewall rule groups or rule collection groups.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium171Free2021-08-08Azure Firewall Rule Collection Modified or Deleted via Activity Logs
Alerts on Azure Firewall rule collection write or delete operations for Application, NAT, or Network components.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium192Free2021-08-08Azure Firewall Created, Modified, or Deleted via Activity Log
Alerts on Azure Firewall write or delete events in Azure Activity Logs, signaling potential defense impairment.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium163Free2021-08-08Azure Activity Logs: DNS Zone Write or Delete Operations
Alerts on Azure Activity Log events indicating DNS zone WRITE or DELETE operations.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium191Free2021-08-08Azure Kubernetes Service Service Account Modified or Deleted Activity Log Events
Alerts on Azure Activity Log events where a Kubernetes service account is written, deleted, or impersonated.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium172Free2021-08-07Azure Kubernetes Activity Logs: Write/Delete of ConfigMaps or Secrets
Alerts on Azure AKS activity log operations that write or delete Kubernetes ConfigMaps or Secrets.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium316Free2021-08-07Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding Written or Deleted
Alerts on Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding write or delete events that may indicate permission changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium446Free2021-08-07Azure Activity Logs: Kubernetes ClusterRole/Role Write, Delete, Bind, or Escalate Changes
Alerts on Azure Kubernetes RBAC Role/ClusterRole writes, deletions, bind, or escalation actions in activity logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium374Free2021-08-07Azure Activity Logs: Kubernetes Network Policy Write/Delete Changes
Alerts on Azure Activity Log events that modify or remove Kubernetes network policies for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium262Free2021-08-07Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted
Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow193Free2021-08-07Azure Activity Logs: Container Registry Created or Deleted
Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow512Free2021-08-07Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)
Flags Exchange web requests with ProxyShell-like /autodiscover.json query patterns and PowerShell/EWS-related parameters, often returning HTTP 401.
Florian Roth (Nextron Systems), Rich Warren, Huntrule Team—webserverHigh258Free2021-08-07Windows AnyDesk Silent Installation via Command-Line Flags
Identifies AnyDesk being silently installed on Windows using --install, --start-with-win, and --silent command-line flags.
Ján Trenčanský, Huntrule TeamWindowsprocess_creationHigh333Free2021-08-06Windows esentutl Usage with /p Flag for Credential Access
Flags Windows executions of esentutl when used with the /p parameter to access credentials-related files.
sam0x90, Huntrule TeamWindowsprocess_creationMedium192Free2021-08-06