Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Processes Creating PCRE.NET Temp Package Files
Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsfile_eventHigh192Free2020-10-29Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents
Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.
Semanur Guneysu @semanurtg, oscd.community, Huntrule TeamWindowsprocess_creationHigh171Free2020-10-28Windows Registry Persistence via Office Test Startup Key
Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.
omkar72, Huntrule TeamWindowsregistry_eventMedium496Free2020-10-25Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32
Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.
Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh302Free2020-10-23macOS Emond Launch Daemon Rule Install Monitoring via plist and emondClients Paths
Alerts on macOS Emond rule plist or emond client database changes that may indicate persistence setup.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosfile_eventMedium161Free2020-10-23macOS Remote System Discovery via arp or ping enumeration
Identifies macOS arp -a or ping to private/local IP ranges used for remote system enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational202Free2020-10-22Linux Remote System Discovery via arp and ping Process Execution
Flags Linux arp or ping commands with LAN/loopback/link-local IP range arguments consistent with remote host discovery.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationLow253Free2020-10-22macOS Process Network Service Scanning via nc or nmap/telnet
Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow142Free2020-10-21macOS AppleScript Execution via osascript with -e, .scpt, or .js
Flags osascript usage on macOS with -e and script indicators consistent with executing AppleScript.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationMedium130Free2020-10-21Linux: Process Execution of Network Scanning and Recon Tools
Flags Linux process executions of common network scanning/recon utilities based on executable name (and netcat listen flag filtering).
Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]), Huntrule TeamLinuxprocess_creationLow164Free2020-10-21Linux auditd: Network service enumeration via telnet, nmap, or netcat
Alerts when telnet/nmap/netcat-style binaries are executed on Linux via auditd, consistent with service discovery scanning.
Alejandro Ortuno, oscd.community, Huntrule TeamLinuxauditdLow509Free2020-10-21Windows Registry: Detect esentutl.exe activity under VSS service keys
Flags registry changes under VSS service keys when initiated by esentutl.exe, consistent with VSS-related abuse.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsregistry_eventHigh202Free2020-10-20Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe
Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsprocess_accessHigh211Free2020-10-20Windows DLL image load: credui.dll loaded by an uncommon process
Detects credui.dll or wincredui.dll being loaded by a process other than common system binaries.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsimage_loadMedium344Free2020-10-20Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)
Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.
Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule TeamWindowssystemLow518Free2020-10-20