Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,525 rules
AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector
Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.
suktech24, Huntrule TeamAwscloudtrailHigh2010Free2025-11-27WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)
Alerts on WerFaultSecure.exe loading dbgcore.dll or dbghelp.dll, a behavior tied to EDR impairment and potential monitoring evasion.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadMedium160Free2025-11-27Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combination
Alerts on Windows command lines containing Grixba-like mode/input/scan parameter combinations during reconnaissance.
yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh143Free2025-11-26Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
Flags node.exe or bun.exe spawning trufflehog/gitleaks to perform secret or credential scanning.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh502Free2025-11-25Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe
Alerts when ArcSOC.exe launches cmd/cscript/mshta/powershell/wscript and similar interpreters, indicating potential remote code execution.
Micah Babinski, Huntrule TeamWindowsprocess_creationHigh130Free2025-11-25ArcSOC.exe Creates Suspicious Script/Executable Files on Windows
Alerts when ArcSOC.exe creates files with script/executable extensions such as .exe, .ps1, .aspx, or .bat.
Micah Babinski, Huntrule TeamWindowsfile_eventHigh173Free2025-11-25Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)
Flags Linux cases where node or bun processes launch trufflehog or gitleaks to search for secrets.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh112Free2025-11-25Windows Process Creation: Bun executes bun_environment.js via node.exe
Flags node.exe spawning bun.exe with a command line containing bun_environment.js and a GitHub runner release download.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh458Free2025-11-25Windows Process Creation: Shai-Hulud String Indicators in Command Line
Alerts on Windows process executions whose command line includes Shai-Hulud indicator strings.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh182Free2025-11-25Linux Bun Runtime Execution: bun_environment.js via node-parent process
Flags /node-launched /bun executions running bun_environment.js with an external runner release download URL.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh228Free2025-11-25Linux Process Creation: Shai-Hulud String Indicators in Command Line
Alerts on Linux process command lines containing Shai-Hulud or SHA1HULUD indicator strings.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh153Free2025-11-25Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution
Alerts when browser-launched processes include clickfix-style command markers plus tool and captcha-related terms on Windows.
0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh495Free2025-11-24Windows WSASS Process Execution via WerFaultSecure.EXE
Alerts on Windows process creation showing wsass.exe running with WerFaultSecure.exe and a PID-like argument.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh211Free2025-11-23Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs
Flags MMC launching GPME to target Default Domain/Default Domain Controllers GPO objects by GUID via gpobject.
TropChaud, Huntrule TeamWindowsprocess_creationMedium476Free2025-11-22Windows ImageLoad of Unsigned .node Native Add-on Files
Alerts on Windows loading of unsigned or unverifiable .node files, indicating potential native code execution in Electron-based apps.
Jonathan Beierle (@hullabrian), Huntrule TeamWindowsimage_loadMedium152Free2025-11-22