Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows: DirLister.exe Execution for Directory Listing Discovery
Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.
frack113, Huntrule TeamWindowsprocess_creationLow225Free2022-08-20Windows DNS Query for _ldap.* Using LDAP-Related Discovery
Alerts on _ldap.* DNS queries from uncommon Windows processes, indicating potential LDAP/DNS service discovery.
frack113, Huntrule TeamWindowsdns_queryLow261Free2022-08-20Windows: User Profiles Service EventID 1511 indicating potential CVE-2022-21919 or CVE-2021-34484 LPE
Alerts on User Profiles Service Event ID 1511, a possible signal of LPE exploitation attempts associated with CVE-2022-21919 or CVE-2021-34484.
Cybex, Huntrule TeamWindowsapplicationLow436Free2022-08-16Windows File Creation Time Altered to a Previous Year
Alerts on Windows events where a file’s creation time is altered to a different year, excluding common benign system/update tooling.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_changeLow100Free2022-08-12Azure Audit Logs: End User Consent for Application (Non-Admin Consent)
Identifies end-user consent grants to applications in Azure AD audit logs.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsLow185Free2022-07-28Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.
MikeDuddington, '@dudders1', Huntrule TeamAzuresigninlogsLow130Free2022-07-27Windows curl.exe Process Creation
Alerts on execution of curl.exe on Windows, which may indicate remote downloads or web requests.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationLow140Free2022-07-05Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication
Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsLow354Free2022-06-28Windows DNS Queries Containing ufile.io Domain
Alerts on Windows DNS lookups where the queried name contains ufile.io, indicating potential exfiltration-related activity.
yatinwad, TheDFIRReport, Huntrule TeamWindowsdns_queryLow140Free2022-06-23Windows PowerShell: Suspicious GPO Discovery via Get-GPO
Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.
frack113, Huntrule TeamWindowsps_scriptLow221Free2022-06-04Windows JScript Compiler (jsc.exe) Process Execution
Identifies execution of jsc.exe (JScript Compiler) from Windows process creation logs.
frack113, Huntrule TeamWindowsprocess_creationLow305Free2022-05-02Zeek DNS: Detect NKN Seed Domain Queries
Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.
Michael Portera (@mportatoes), Huntrule TeamZeekdnsLow162Free2022-04-21Windows File Access to Browser Credential Stores by Uncommon Processes
Detects suspicious process access to Firefox/Chromium credential store files on Windows, excluding common system and known benign paths.
frack113, X__Junior (Nextron Systems), Huntrule TeamWindowsfile_accessLow70Free2022-04-09Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)
Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.
Max Altgelt (Nextron Systems), Huntrule TeamWindowssecurityLow191Free2022-04-06Windows PowerShell User Discovery via Current Username APIs
Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.
frack113, Huntrule TeamWindowsps_scriptLow283Free2022-04-04