Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)
Detects Windows file drops of specific DLLs and a Windows Temp batch filename pattern associated with a Winnti dropper scenario.
Alexander Rausch, Huntrule TeamWindowsfile_eventHigh149Free2020-06-24Windows Process Creation: Detect reg.exe Add Control Panel CPL Items
Alerts on reg.exe adding Control Panel CPL items via CurrentVersion\Control Panel\CPLs, a common vector for stealthy execution/persistence.
Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_), Huntrule TeamWindowsprocess_creationHigh81Free2020-06-22Windows Process Creation: IE Security Registry Values Disabled via Command Line
Alerts on Windows command lines that set IE hardening-related registry values to disable security features.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3710Free2020-06-19Linux Remote File Copy via scp, rsync, or sftp
Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.
Ömer Günal, Huntrule TeamLinux—Low282Free2020-06-18Windows Registry Modification via Process Creation Command Lines Indicative of Ke3chang/TidePool
Alerts on Windows process command lines that set IE hardening and related Internet Explorer registry properties consistent with Ke3chang/TidePool.
Markus Neis, Swisscom, Huntrule TeamWindowsprocess_creationHigh73Free2020-06-18Linux process commands stopping firewall and security services
Flags Linux commands that stop/disable firewall/security services or set SELinux enforcement to 0.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationMedium278Free2020-06-17Linux Process Sets HTTP/HTTPS Proxy Environment Variables
Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow196Free2020-06-17Linux Syslog Alerts for Stopping Built-in Security Tools
Alerts on syslog text indicating security tools are being stopped: iptables, firewalld, cbdaemon, or falcon-sensor.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxsyslogMedium132Free2020-06-17Linux process activity: chown root and setuid/setgid chmod flags
Alerts on Linux command lines that set root ownership and enable setuid/setgid via chmod u+s or g+s.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow121Free2020-06-16Windows Process Creation: Possible Path Traversal in cmd.exe Command Line
Alerts on Windows cmd.exe executions with "../.." path traversal indicators in parent/child command lines.
xknow @xknow_infosec, Tim Shelton, Huntrule TeamWindowsprocess_creationHigh435Free2020-06-11Windows Pcap Driver Installation via EID 4697 ServiceFileName
Flags Windows driver install events (Security 4697) where the service file name matches known Pcap-related driver keywords.
Cian Heasley, Huntrule TeamWindowssecurityMedium151Free2020-06-10Windows file indicators for Octopus Scanner malware artifacts
Alerts on Windows file activity for Octopus Scanner-related filenames (Cache134.dat, ExplorerSync.db) in AppData.
NVISO, Huntrule TeamWindowsfile_eventHigh301Free2020-06-09Windows Registry Markers for FlowCloud Malware Configuration and Keylogger Components
Detects registry activity referencing specific HARDWARE marker GUID keys and the Setup\PrintResponsor path on Windows.
NVISO, Huntrule TeamWindowsregistry_eventCritical123Free2020-06-09Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access
Alerts on Windows consent-store registry entries showing webcam/microphone access tied to Temp or public user paths.
Den Iuzvyk, Huntrule TeamWindowsregistry_eventHigh132Free2020-06-07Windows processes accessing microphone and webcam via CapabilityAccessManager ConsentStore
Identifies Windows processes interacting with non-packaged app consent entries for microphone and webcam access.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowssecurityMedium201Free2020-06-07