Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)
Alerts on VSSAudit security event source registration in Windows Security logs using Event IDs 4904/4905.
Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule TeamWindowssecurityInformational4010Free2020-10-20macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow408Free2020-10-19macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths
Flags macOS process executions ending with shutdown, reboot, or halt indicating possible host power disruption.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationInformational245Free2020-10-19macOS System Network Connection Discovery via who, w, last, lsof, or netstat
Flags macOS process executions of who/w/last/lsof/netstat used to discover network or session information.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational231Free2020-10-19macOS Security Software Discovery via grep of Known Security Software Names
Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium386Free2020-10-19macOS Process Creation: grep 'password' or laZagne Credential Extraction
Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh131Free2020-10-19macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational253Free2020-10-19macOS: Disable Security Tools via launchctl unload or spctl disable
Detects macOS attempts to impair security by unloading known security agent plists via launchctl or disabling Gatekeeper with spctl.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium161Free2020-10-19macOS Keychain Credential Dump via security find-certificate/export and dump-keychain
Alerts on /usr/bin/security usage indicative of Keychain export/dump activity on macOS.
Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems), Huntrule TeamMacosprocess_creationMedium162Free2020-10-19macOS process using touch to modify file timestamps and hide file changes
Flags on macOS touch indicating file timestamp attribute changes for stealthy file activity.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium283Free2020-10-19macOS Process Execution: dd and truncate used for binary padding
Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh181Free2020-10-19macOS Base64 Utility Decoding Command Activity
Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow273Free2020-10-19Linux System Network Connections Discovery via who, w, last, lsof, or netstat
Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow151Free2020-10-19Linux process discovery via grep/egrep searching for security software strings
Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow192Free2020-10-19Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed
Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.
Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule TeamLinuxprocess_creationInformational200Free2020-10-19