Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Juniper BGP Logs: Missing MD5 Digest in Route Authentication
Flags Juniper BGP log messages indicating a missing MD5 digest, highlighting potential exposure from unauthenticated routing sessions.
Tim Brown, Huntrule TeamJuniperbgpLow241Free2023-01-09Huawei BGP Authentication Failures Indicating Failed Session Attempts
Flags Huawei BGP authentication failure log events that may indicate credential attempts or routing manipulation.
Tim Brown, Huntrule TeamHuaweibgpLow296Free2023-01-09Cisco LDP MD5 Authentication Failure Events
Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.
Tim Brown, Huntrule TeamCiscoldpLow152Free2023-01-09Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks
Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.
Tim Brown, Huntrule TeamCiscobgpLow318Free2023-01-09Windows PowerShell: Detect Set-Alias/New-Alias Usage in Script Block Logging
Alerts on PowerShell scripts that create aliases via Set-Alias/New-Alias, a common obfuscation technique, using ScriptBlockText logging.
frack113, Huntrule TeamWindowsps_scriptLow535Free2023-01-08AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole
Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.
Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule TeamAwscloudtrailLow152Free2023-01-06Linux auditd: Access to hidden files or hidden directories (/. paths)
Alerts when Linux auditd shows PATH values referencing hidden files or hidden directories (excluding common dev/cache paths).
David Burkett, @signalblur, Huntrule TeamLinuxauditdLow188Free2022-12-30Linux Privilege Capability Discovery via getcap
Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow212Free2022-12-28Windows ETW Logging Disabled via SCM Registry TracingDisabled Key
Detects SCM ETW logging being disabled by setting the TracingDisabled registry DWORD for services.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow162Free2022-12-09Windows Registry Change Disables ETW for rpcrt4.dll via ExtErrorInformation
Flags Windows registry updates that disable ETW logging for rpcrt4.dll through ExtErrorInformation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow335Free2022-12-09Windows Defender SubmitSamplesConsent Disabled (Real-Time Protection)
Flags Windows Defender configuration changes disabling automatic sample submission (SubmitSamplesConsent=0x0).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowswindefendLow369Free2022-12-06Windows Security Event Add/Remove Computer Account (4741/4743)
Alerts on Windows domain computer account create/delete activity via Security event 4741 and 4743.
frack113, Huntrule TeamWindowssecurityLow100Free2022-10-14Windows Driver Load of Known Vulnerable Drivers by File Name
Alerts when Windows loads a driver whose filename matches a list of known vulnerable drivers.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdriver_loadLow173Free2022-10-03Process Creation: curl on Linux
Flags Linux process starts for the curl binary, indicating potential remote file download or web requests.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow140Free2022-09-15Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData
Hunts Windows processes whose command lines reference GUID-named folders in user AppData/Temp locations.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationLow110Free2022-09-01