Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.
Craig Young, oscd.community, Georg Lauenstein, Huntrule TeamWindowsprocess_creationMedium133Free2021-07-24Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
Alerts on Windows execution of common SMB/NTLM relay and “Potato” privilege escalation hacktool indicators via process creation fields.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical161Free2021-07-24Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches
Flags execution of Windows impacket compiled binaries based on distinctive tool names in the process Image.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh409Free2021-07-24Azure Activity Logs: Kubernetes Pod Deletion via Connected Clusters API
Flags Azure Activity Log events indicating Kubernetes pods were deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium93Free2021-07-24Azure Kubernetes Events Deleted via Activity Logs
Identifies Azure Activity Log entries where Kubernetes event records are deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium4610Free2021-07-24AWS CloudTrail: IAMUser STS GetSessionToken Use
Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow111Free2021-07-24AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals
Alert on CloudTrail AssumeRole events initiated from an already assumed role session.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow167Free2021-07-24AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow181Free2021-07-24AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail
Flags CloudTrail activity indicating an ElastiCache security group was modified or deleted.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow377Free2021-07-24AWS CloudTrail: ElastiCache Cache Security Group Created
Flags CloudTrail events indicating a new ElastiCache cache security group was created.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow142Free2021-07-24Windows File Writes of HiveNightmare-Style SAM Export Artifacts
Identifies Windows SAM export files written with HiveNightmare-style filename patterns in file events.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh368Free2021-07-23Windows Registry Changes Enabling DNS-over-HTTPS via Edge, Chrome, or Firefox Policies
Alerts on registry policy updates that enable DNS-over-HTTPS for Edge, Chrome, or Firefox on Windows.
Austin Songer, Huntrule TeamWindowsregistry_setMedium112Free2021-07-22AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount
Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow161Free2021-07-22AWS Route 53 Domain Transfer Lock Disabled via CloudTrail
Alerts when Route 53 domain transfer protection is removed through DisableDomainTransferLock events in CloudTrail.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow3910Free2021-07-22Windows Process Creation: Netcat (ncat/cat) Suspicious Execution
Alerts on Windows process launches of Netcat-like binaries with typical listener/proxy or remote execution command-line flags.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh396Free2021-07-21