Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,530 rules
AWS CloudTrail ConsoleLogin Failed authentication
Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium231Free2025-10-19AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium184Free2025-10-19Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes
Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.
andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh130Free2025-10-18Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths
Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh131Free2025-10-18Kaspersky Endpoint Security Service Stopped via Command Line on Linux
Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.
Milad Cheraghi, Huntrule TeamLinuxprocess_creationHigh219Free2025-10-18AWS KMS Imported Key Material Import or Deletion via CloudTrail
Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.
toopricey, Huntrule TeamAwscloudtrailHigh143Free2025-10-18AWS CloudTrail Successful ConsoleLogin Events Without MFA
Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.
Thuya@Hacktilizer, Ivan Saakov, Huntrule TeamAwscloudtrailMedium142Free2025-10-18GitHub Audit Events: Repository Archived/Unarchived Status Change
Alerts on GitHub audit events indicating a repository was archived or unarchived.
Ivan Saakov, Huntrule TeamGithubauditLow385Free2025-10-18GitHub Pages repository site changed to public (repo.pages_public audit event)
Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.
Ivan Saakov, Huntrule TeamGithubauditLow483Free2025-10-18Windows Process Execution: Restic Backup Tool Command-Line Indicators
Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.
Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh141Free2025-10-17Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep
Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.
Milad Cheraghi, Nasreddine Bencherchali, Huntrule TeamLinuxprocess_creationHigh286Free2025-10-17Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
Flags Linux processes running Python’s built-in HTTP server modules via command line.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationMedium152Free2025-10-17Linux auditctl -D used to delete all audit rules
Flags auditctl -D executions that delete all audit rules and watchers on Linux.
Mohamed LAKRI, Huntrule TeamLinuxprocess_creationHigh476Free2025-10-17Windows Process Creation: Executable Launches Identical Self Instance (Sacrificial Process)
Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.
frack113, Huntrule TeamWindowsprocess_creationLow100Free2025-10-17AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent
Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.
Adan Alvarez @adanalvarez, Huntrule TeamAwscloudtrailMedium301Free2025-10-12