Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Linux File Creation Indicators for TanStack Runner and Persistence Components
Alerts on creation of TanStack-style runner/persistence filenames on Linux, including .claude/.vscode router_runtime.js and /tmp/transformers.pyz.
Leonardo Gasparini, Huntrule TeamLinuxfile_eventMedium133Free2026-05-12Windows DNS Queries to git-tanstack.com and filev2.getsession.org
Alert on Windows DNS lookups of git-tanstack.com and filev2.getsession.org tied to supply-chain C2/exfil.
Leonardo Gasparini, Huntrule TeamWindowsdns_queryMedium103Free2026-05-12Linux: Detect modprobe-based authencesn crypto module auto-load via kmod
Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".
Gene Kazimiarovich, Huntrule TeamLinuxprocess_creationHigh93Free2026-05-09Webserver Alerts for libredtail-http User-Agent HTTP Requests
Alerts on web requests carrying the "libredtail-http" User-Agent, indicating likely automated malicious probing.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team—webserverMedium101Free2026-04-30Linux auditd: Detect AF_ALG socket() syscall (address family 38) for crypto API abuse
Flags AF_ALG (38) socket() creations from Linux auditd while filtering common legitimate crypt/VPN tools.
Gene Kazimiarovich, Huntrule TeamLinuxauditdHigh123Free2026-04-30Windows Print.EXE Sensitive File Dump for Credential Access
Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.
Ayush Anand (Securityinbits), Huntrule TeamWindowsprocess_creationHigh81Free2026-04-28Cisco Network Device 802.1X (dot1x) Disabled via port-control Force-Authorized
Alerts on Cisco configuration changes that disable 802.1X on a port (force-authorized or no dot1x port-control).
Luc Génaux, Huntrule TeamCiscoaaaMedium525Free2026-04-28GCP Google Workspace Suspicious Login Events (Google Classified)
Alerts on Google Workspace login audit events classified by Google as suspicious, including less secure app and programmatic login types.
Tom Kluter, Huntrule TeamGcpgoogle_workspace.loginMedium93Free2026-04-28Google Workspace login activity: Out-of-domain email forwarding
Flags Google Workspace out-of-domain email forwarding events from audit logs on login.googleapis.com.
Tom kluter, Huntrule TeamGcpgoogle_workspace.loginMedium112Free2026-04-28Google Workspace login event flagged with gov_attack_warning
Alerts on Google Workspace login audit events marked with gov_attack_warning by Google’s risk signals.
Tom Kluter, Huntrule TeamGcpgoogle_workspace.loginMedium143Free2026-04-28Kubernetes audit log signals potential tool and shell enumeration/execution activity
Finds allowed Kubernetes API audit requests with URI-encoded/visible shells or recon tool user agents that may indicate enumeration or secret scanning.
uniqu3-us3r, Huntrule TeamKubernetesauditMedium161Free2026-04-28Azure Entra ID Sign-ins with User-Agent Containing "axios"
Flags Azure Entra ID sign-ins with a user agent containing "axios", indicating potential automated sign-in activity.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamAzuresigninlogsLow140Free2026-04-28Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)
Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.
uniqu3-us3r, Huntrule Team—proxyLow101Free2026-04-28Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Flags Linux processes writing fs.suid_dumpable to enable SUID core dumps, which can expose privileged process memory.
Milad Cheraghi, Huntrule TeamLinuxprocess_creationMedium457Free2026-04-28Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type
Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium418Free2026-04-27