Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
407 rules
Linux auditd: Hidden file or directory creation via leading-dot paths in execve
Alerts on Linux process executions creating or modifying dot-prefixed (hidden) files/directories.
Pawel Mazur, Huntrule TeamLinuxauditdLow152Free2021-09-06Linux Audio Capture via arecord and ecasound (auditd execve and memfd_create)
Detects Linux execution of arecord for audio capture and ecasound using memfd_create for in-memory data handling.
Pawel Mazur, Milad Cheraghi, Huntrule TeamLinuxauditdLow377Free2021-09-04Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads
Triggers on auditd events showing host enumeration commands and system identity file access on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow183Free2021-09-03PowerShell discovery of Win32_PnPEntity via ScriptBlockText
Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.
frack113, Huntrule TeamWindowsps_scriptLow373Free2021-08-23Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules
Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementLow203Free2021-08-22Zeek DNS Queries Ending in Known Crypto Mining Pool Domains
Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.
Saw Winn Naung, Azure-Sentinel, @neu5ron, Huntrule TeamZeekdnsLow81Free2021-08-19AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.
Austin Songer, Huntrule TeamAwscloudtrailLow356Free2021-08-16GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditLow133Free2021-08-14Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted
Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow163Free2021-08-07Azure Activity Logs: Container Registry Created or Deleted
Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow362Free2021-08-07Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
frack113, Huntrule TeamWindowsprocess_creationLow161Free2021-07-27AWS CloudTrail: IAMUser STS GetSessionToken Use
Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow111Free2021-07-24AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals
Alert on CloudTrail AssumeRole events initiated from an already assumed role session.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow177Free2021-07-24AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow211Free2021-07-24AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail
Flags CloudTrail activity indicating an ElastiCache security group was modified or deleted.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow377Free2021-07-24