Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Windows Security 4663: Uncommon Processes Access Browser Credential Store Files
Flags 4663 file access to browser credential stores (Chromium/Firefox) by processes outside common system/benign paths.
Daniel Koifman (@Koifsec), Nasreddine Bencherchali, Huntrule TeamWindowssecurityLow80Free2024-10-21Windows IIS module removal event (IIS-configuration EventID 29)
Detects removal of an IIS module from Windows IIS configuration events (Event ID 29).
Nasreddine Bencherchali, Huntrule TeamWindowsiis-configurationLow123Free2024-10-06Windows IIS Configuration: New Module Added to /system.webServer/modules
Flags IIS configuration events where a new module is added under /system.webServer/modules.
frack113, Huntrule TeamWindowsiis-configurationMedium378Free2024-10-06IIS HTTP Logging Disabled via dontLog Configuration Change (Windows)
Alerts on IIS configuration updates that disable HTTP logging by setting dontLog to true for successful requests.
frack113, Huntrule TeamWindowsiis-configurationHigh412Free2024-10-06Windows IIS Configuration: Disable ETW Logging/Processing via logTargetW3C Change
Identifies IIS configuration edits that remove/disable ETW logging or processing for W3C log targeting.
frack113, Nasreddine Bencherchali, Huntrule TeamWindowsiis-configurationMedium241Free2024-10-06Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes
Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.
"@Kostastsale, Huntrule Team"Windowsprocess_creationMedium465Free2024-09-22Windows Process Initiated Connections to .btunnel.co.in Domains
Flags initiated outbound connections to .btunnel.co.in domains from a Windows host.
Kamran Saifullah, Huntrule TeamWindowsnetwork_connectionMedium142Free2024-09-13Windows: GPO Modification Adds Startup/Logon Script References
Flags GPO changes that add startup/logon scripts (SYSVOL scripts.ini) for user or computer targets using Windows directory/audit events.
Elastic, Josh Nickels, Marius Rothenbücher, Huntrule TeamWindowssecurityMedium133Free2024-09-06Windows Security: Group Policy Object modification adds privileges to user accounts
Alerts on Windows GPO attribute changes that correspond to adding privileges or making users local admins.
Elastic, Josh Nickels, Marius Rothenbücher, Huntrule TeamWindowssecurityMedium111Free2024-09-04Windows DISM Enables PowerShell Web Access Feature via Command Line
Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.
Michael Haag, Huntrule TeamWindowsprocess_creationHigh82Free2024-09-03Windows PowerShell Web Access Installation via PowerShell Script Block
Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.
Michael Haag, Huntrule TeamWindowsps_scriptHigh267Free2024-09-03Windows Process Deletes Its Own Executable File
Flags Windows file deletion events where a process removes its own executable image.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium123Free2024-09-03Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe
Alerts on non-initiated (incoming) network connections tied to AnyDesk.exe or AnyDeskMSI.exe on Windows.
"@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"Windowsnetwork_connectionMedium102Free2024-09-02Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule TeamLinuxprocess_creationHigh161Free2024-09-02Linux Inline Python (-c) Calling os.system to Spawn Shell
Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh442Free2024-09-02