Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
407 rules
Linux Clipboard Data Collection via xclip -sel clip -o
Alerts on Linux processes running xclip to output clipboard content using -sel clip -o.
Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule TeamLinuxprocess_creationLow3710Free2021-10-15Linux Cron Directory File Creation via File Events
Flags new Linux cron-related files created under standard cron directories, excluding a few known benign paths.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule TeamLinuxfile_eventLow218Free2021-10-15OneLogin: Detect API user account lock or suspension events
Flags OneLogin API events indicating a user account was locked or suspended.
Austin Songer @austinsonger, Huntrule TeamOneloginonelogin.eventsLow133Free2021-10-12OneLogin: User Assumes Another Account via Event Type 3
Alerts on OneLogin events indicating a user assumed another user account via event_type_id 3.
Austin Songer @austinsonger, Huntrule TeamOneloginonelogin.eventsLow161Free2021-10-12AWS Glue Dev Endpoint Lifecycle Events (Create/Update/Delete) via CloudTrail
Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow151Free2021-10-03Linux xclip Clipboard Image Collection via Image MIME Types
Flags xclip usage that outputs image/* data from the clipboard on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow132Free2021-10-01Clipboard Data Collection via xclip (auditd Linux EXECVE)
Alerts on xclip command lines that request clipboard/clip selection output (-o) on Linux systems monitored by auditd.
Pawel Mazur, Huntrule TeamLinuxauditdLow123Free2021-09-24AWS CloudTrail: Lambda Function Updated with New Layer Attached
Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.
Austin Songer, Huntrule TeamAwscloudtrailLow142Free2021-09-23Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.
Pawel Mazur, Huntrule TeamLinuxauditdLow1710Free2021-09-21Linux screen capture using xwd saving a .xwd file
Flags xwd screen capture executions that write captured output to a .xwd file on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow153Free2021-09-13Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow141Free2021-09-12Linux steghide steganography: Extract hidden files from JPG/PNG
Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow231Free2021-09-11Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef
Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.
Pawel Mazur, Huntrule TeamLinuxauditdLow347Free2021-09-11Linux auditd: Unzip files extracted from JPG/PNG images
Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.
Pawel Mazur, Huntrule TeamLinuxauditdLow102Free2021-09-09Linux auditd: cat appends ZIP data to image files
Alerts when cat is used to handle .jpg/.png with an associated .zip argument, consistent with hiding ZIP data in images.
Pawel Mazur, Huntrule TeamLinuxauditdLow101Free2021-09-09