Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block
Flags PowerShell scripts referencing SslStream and client-side certificate validation during SSL client authentication.
frack113, Huntrule TeamWindowsps_scriptLow203Free2022-01-23Windows Office Macro File Creation from Browser or Email Client
Flags Windows creation of macro-enabled Office files (.docm/.xlsm/.pptm) initiated by common browsers or email clients.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow237Free2022-01-23Windows Office Macro File Creation via Office Applications
Alerts on creation of macro-enabled Office documents/templates by Office apps on Windows, excluding Office temporary files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow231Free2022-01-23Windows Registry: Internet Settings Zone and Cache-related Key Modifications
Flags registry writes to Windows Internet Settings-related keys that can be abused to alter zone trust or store persistence data.
frack113, Huntrule TeamWindowsregistry_setLow213Free2022-01-22Windows Code Integrity: Unmet Signing Level Requirements When Loading a File (Event ID 3033/3034)
Alerts on Code Integrity file-load attempts failing signing level requirements, based on Event ID 3033/3034 in Windows Code Integrity logs.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalLow212Free2022-01-20Linux doas Command Execution Identified
Flags Linux executions of the doas utility based on process image path ending with /doas.
Sittikorn S, Teoderick Contreras, Huntrule TeamLinuxprocess_creationLow111Free2022-01-20Windows: Deletion of TeamViewer log files
Alerts on deletion of TeamViewer *.log files on Windows, excluding deletions performed by svchost.exe.
frack113, Huntrule TeamWindowsfile_deleteLow221Free2022-01-16Windows msiexec.exe Initiates Outbound HTTP(S) Connection on Port 80/443
Alerts when msiexec.exe starts outbound connections to ports 80 or 443, indicating potential remote package retrieval.
frack113, Huntrule TeamWindowsnetwork_connectionLow120Free2022-01-16Windows rmdir Directory Removal via cmd.exe Execution
Monitors cmd.exe process creation where rmdir is used with /s and/or /q to delete directories and reduce forensic artifacts.
frack113, Huntrule TeamWindowsprocess_creationLow170Free2022-01-15Windows del/erase Command-Line File Deletion via cmd.exe
Flags cmd.exe executions running del/erase for file removal, including common flags like /f, /s, and /q.
frack113, Huntrule TeamWindowsprocess_creationLow309Free2022-01-15Windows PowerShell ScriptBlock Use of Remove-Item to Delete Files or Folders
Alerts on PowerShell ScriptBlockText containing Remove-Item/del/rm/rd-style -Path deletion commands.
frack113, Huntrule TeamWindowsps_scriptLow100Free2022-01-15Windows Dynamic C# Compilation Generates .cmdline Artifact
Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.
frack113, Huntrule TeamWindowsfile_eventLow547Free2022-01-09PowerShell script exfiltration using Invoke-WebRequest with POST or PUT
PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.
frack113, Huntrule TeamWindowsps_scriptLow255Free2022-01-07Windows Process Creation: Suspicious systeminfo.exe Execution
Alerts on execution of systeminfo.exe (or sysinfo.exe) via Windows process creation logs for system discovery.
frack113, Huntrule TeamWindowsprocess_creationLow253Free2022-01-01Windows Process Creation: Suspicious reg.exe Query for MachineGuid
Detects reg.exe queries for MachineGuid under SOFTWARE\Microsoft\Cryptography via process creation logs.
frack113, Huntrule TeamWindowsprocess_creationLow465Free2022-01-01