Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Security Event 4663: ISO CD-ROM device mount activity
Alerts on Windows file-access events consistent with ISO mounting by activity under \\Device\\CdRom.
Syed Hasan (@syedhasan009), Huntrule TeamWindowssecurityMedium191Free2021-05-29Windows rundll32.exe Started Without Command-Line Parameters
Alerts on Windows process launches of rundll32.exe with no parameters, excluding likely benign parent paths.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh153Free2021-05-27Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent
Alerts when regedit.exe is launched by TrustedInstaller.exe or ProcessHacker.exe.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh394Free2021-05-27Windows Service Control Manager: ProcessHacker service runs as LocalSystem
Flags Windows service installs for ProcessHacker-prefixed services running as LocalSystem.
Florian Roth (Nextron Systems), Huntrule TeamWindowssystemHigh241Free2021-05-27Windows: Rclone Configuration File Creation via rclone config path
Alerts on creation of rclone config files under a Windows user profile path.
Aaron Greetham (@beardofbinary) - NCC Group, Huntrule TeamWindowsfile_eventMedium193Free2021-05-26Windows DNS Queries for userstorage.mega.co.nz Subdomain
Alerts on DNS queries referencing MEGA userstorage subdomains from Windows hosts.
Aaron Greetham (@beardofbinary) - NCC Group, Huntrule TeamWindowsdns_queryMedium132Free2021-05-26Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike
Alerts on Windows 7045 service installs with ImagePath patterns consistent with Cobalt Strike-style PowerShell and execution.
Florian Roth (Nextron Systems), Wojciech Lesicki, Huntrule TeamWindowssystemCritical255Free2021-05-26Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads
Flags Windows Event 4697 service installs whose service command strings match hidden/encoded PowerShell payload patterns.
Florian Roth (Nextron Systems), Wojciech Lesicki, Huntrule TeamWindowssecurityHigh163Free2021-05-26Windows Named Pipe Creation Matching Cobalt Strike Default Pipe Prefixes
Flags Windows named pipe creation where PipeName matches known Cobalt Strike default pipe prefixes.
Florian Roth (Nextron Systems), Wojciech Lesicki, Huntrule TeamWindowspipe_createdCritical221Free2021-05-25Linux PAM TTY Audit Enabling via /etc/pam.d Modification
Alerts on auditd-observed edits to PAM system-auth/password-auth tied to TTY input auditing.
Pawel Mazur, Huntrule TeamLinuxauditdHigh192Free2021-05-24Windows Process Creation: PsExec/PAExec Flags Indicating SYSTEM Execution
Flags indicating PsExec/PAExec-style execution as LOCAL SYSTEM using cmd/powershell/pwsh in process command lines.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh4810Free2021-05-22Windows Process Creation: Renamed PAExec Application Execution
Flags Windows executions of a renamed PAExec binary using process metadata and known IMPHASH values.
Florian Roth (Nextron Systems), Jason Lynch, Huntrule TeamWindowsprocess_creationHigh282Free2021-05-22Wazuh CVE-2021-26814 RCE Exploitation via Directory Traversal in Web Requests
Detects Wazuh-related web requests attempting path traversal through the /manager/files query parameter.
Florian Roth (Nextron Systems), Huntrule Team—webserverHigh275Free2021-05-22Windows: WinRM Service Process Spawning Command-Line and Scripting Utilities
Flags suspicious child shells and admin utilities spawned by the WinRM host process (wsmprovhost.exe) on Windows.
Andreas Hunkeler (@Karneades), Markus Neis, Huntrule TeamWindowsprocess_creationHigh323Free2021-05-20PowerShell Script Block Logging: PowerView cmdlet names match
Alerts when PowerShell ScriptBlockText includes PowerView/PowerSploit reconnaissance cmdlet names tied to domain and access discovery.
Bhabesh Raj, Huntrule TeamWindowsps_scriptHigh3910Free2021-05-18