Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,522 rules
Google Workspace login event flagged with gov_attack_warning
Alerts on Google Workspace login audit events marked with gov_attack_warning by Google’s risk signals.
Tom Kluter, Huntrule TeamGcpgoogle_workspace.loginMedium153Free2026-04-28Kubernetes audit log signals potential tool and shell enumeration/execution activity
Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.
uniqu3-us3r, Huntrule TeamKubernetesauditMedium191Free2026-04-28Azure Entra ID Sign-ins with User-Agent Containing "axios"
Flags Azure Entra ID sign-ins with a user agent containing "axios", indicating potential automated sign-in activity.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamAzuresigninlogsLow200Free2026-04-28Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)
Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.
uniqu3-us3r, Huntrule Team—proxyLow161Free2026-04-28Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Flags Linux processes writing fs.suid_dumpable to enable SUID core dumps, which can expose privileged process memory.
Milad Cheraghi, Huntrule TeamLinuxprocess_creationMedium477Free2026-04-28Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type
Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium468Free2026-04-27Windows SFTP.exe Indirect Command Execution via ProxyCommand
Flags SFTP.exe executions that include ProxyCommand=, indicating potential indirect command execution.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium271Free2026-04-27Windows PUA: MemProcFS memory dump mounting via -device
Detects MemProcFS.exe execution with -device on Windows, consistent with mounting memory dumps for potential credential access.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh424Free2026-04-27Windows Defender windefend Event 1119 flags RedSun TieringEngineService.exe EICAR test file
Alerts on WinDefend 1119 remediation failures involving TieringEngineService.exe marked with EICAR content or triggered by RedSun.exe.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowswindefendCritical256Free2026-04-17Windows Named Pipe Created with Name "REDSUN"
Flags creation of the named pipe \REDSUN on Windows, consistent with RedSun-style IPC used during exploitation.
Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost, Huntrule TeamWindowspipe_createdCritical151Free2026-04-17Windows File Creation: TieringEngineService.exe in RS- prefixed Temp Directory
Detects creation of TieringEngineService.exe under an RS-{GUID}-prefixed directory in %TEMP% on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost, Huntrule TeamWindowsfile_eventCritical183Free2026-04-17Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts
Flags Windows file creation under Temp\_MEI* where NetExec nxc data files are dropped, indicating likely NetExec execution.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventHigh201Free2026-04-08Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)
Alerts on the Windows process/command-line pattern consistent with the Axios npm compromise execution and C2 fetch.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh363Free2026-04-01macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup
Flags macOS command-line patterns showing osascript execution plus npm package download and staged file cleanup.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamMacosprocess_creationHigh319Free2026-04-01Linux process chain for Axios NPM compromise: curl download with nohup and python3
Flags Linux executions where curl downloads /tmp/ld.py and the payload is run via nohup python3 from an Axios-related node process.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh101Free2026-04-01