Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,289 rules
Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events
Alerts when an Office app loads a .NET DLL from the GAC_MSIL directory.
Antonlovesdnb, Huntrule TeamWindowsimage_loadHigh70Free2020-02-19Windows Process Memory Dump via comsvcs.dll using rundll32
Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.
Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh81Free2020-02-18AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance
Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.
faloker, Huntrule TeamAwscloudtrailHigh461Free2020-02-12AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.
faloker, Huntrule TeamAwscloudtrailHigh81Free2020-02-12AWS GuardDuty CreateIPSet Trusted IP Set Changes (CloudTrail)
Alerts on CloudTrail GuardDuty CreateIPSet events that add or update trusted IP address sets.
faloker, Huntrule TeamAwscloudtrailHigh102Free2020-02-11Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)
Alert on Windows DNS analytical EventID 257 queries for GALLIUM-linked suspicious QNAMEs.
Tim Burrell, Huntrule TeamWindowsdns-server-analyticHigh306Free2020-02-07Windows Process Creation alerts on GALLIUM-associated hash IOCs
Flags Windows process executions where the file hash matches hardcoded GALLIUM-associated SHA256/SHA1 IOCs.
Tim Burrell, Huntrule TeamWindowsprocess_creationHigh1610Free2020-02-07Windows: Flag SettingSyncHost.exe used to execute RoamDiag.cmd from cmd.exe
Flags non-System32/SysWOW64 processes spawned by SettingSyncHost.exe running RoamDiag.cmd via cmd.exe /c -outputpath.
Anton Kutepov, oscd.community, Huntrule TeamWindowsprocess_creationHigh356Free2020-02-05PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)
Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh83Free2020-01-29Windows renamed dctask64.exe execution via known IMPHASH values
Flags Windows process creations where a renamed dctask64.exe execution matches known IMPHASH values.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh41Free2020-01-28Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh102Free2020-01-28Windows MSTSC Shadowing CommandLine Using shadow:
Flags Windows processes launching MSTSC with noconsentprompt and shadow: parameters consistent with RDP session shadowing.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh71Free2020-01-24AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled
Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.
vitaliy0x1, Huntrule TeamAwscloudtrailHigh112Free2020-01-21Windows Process Command Lines Using System32/SysWow64 Tasks Folder
Alerts on process command lines referencing the writable System32/SysWow64 Tasks folders with common file staging/copy primitives.
Sreeman, Huntrule TeamWindowsprocess_creationHigh63Free2020-01-13Windows Process: curl Download with HTTP Output Redirect and Command Chaining
Flags Windows commands where curl downloads over HTTP with -o and then executes via command chaining with '&'.
Sreeman, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh40Free2020-01-13