Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)
Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.
frack113, Duc.Le-GTSC, Huntrule TeamWindowsps_scriptMedium324Free2021-08-03Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse
Identifies Windows processes with command-line arguments consistent with ADCSPwn targeting ADCS and a specified port.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh429Free2021-07-31Windows Process Creation: Recon Data Export via Command Prompt Redirection
Alerts when recon-related Windows utilities are launched with command-line output redirected to temp locations.
frack113, Huntrule TeamWindowsprocess_creationMedium93Free2021-07-30Windows: Suspicious Cabinet (CAB) File Expansion via expand.exe from Uncommon Paths
Flags expand.exe ("-F:") extracting cabinets when used from suspicious/uncommon Windows paths.
Bhabesh Raj, X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium467Free2021-07-30Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging
Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.
frack113, Huntrule TeamWindowsps_scriptMedium326Free2021-07-30PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)
Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.
frack113, Huntrule TeamWindowsps_scriptMedium415Free2021-07-30Windows Named Pipe Creation: Cobalt Strike Malleable Profile PipeName Patterns
Alerts on Sysmon named pipe creation with PipeName patterns commonly used by Cobalt Strike malleable C2.
Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems), Huntrule TeamWindowspipe_createdHigh141Free2021-07-30Windows Named Pipe Creation Matching Cobalt Strike Malleable C2 Profile Patterns
Alerts on Windows named pipe creation with PipeName patterns consistent with Cobalt Strike Malleable C2 behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowspipe_createdCritical214Free2021-07-30Windows WinDivert Driver Load via Image or Known IMPHASHes
Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.
Florian Roth (Nextron Systems), Huntrule TeamWindowsdriver_loadHigh133Free2021-07-30PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows
Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh309Free2021-07-29Windows Process Creation: Automated Document and Directory Discovery via dir and findstr
Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.
frack113, Huntrule TeamWindowsprocess_creationMedium224Free2021-07-28PowerShell Script Block Collection of Documents via Recursive Get-ChildItem
Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.
frack113, Huntrule TeamWindowsps_scriptMedium323Free2021-07-28Windows: WinZip executed with password flag and archive parameters indicative of data staging
Flags Windows executions of WinZip/WinZip64 using a password flag and archive parameters that can support data staging.
frack113, Huntrule TeamWindowsprocess_creationMedium158Free2021-07-27Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
frack113, Huntrule TeamWindowsprocess_creationLow111Free2021-07-27Windows: 7-Zip password-protected archive creation for potential data exfiltration
Flags 7-Zip archive creation on Windows with a password flag and archive-action parameters.
frack113, Huntrule TeamWindowsprocess_creationMedium196Free2021-07-27