Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: IIS appcmd Native Module Installation via Command Line
Alerts on appcmd.exe commands installing IIS native-code modules using a -name: parameter, excluding iissetup-launched setups.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium92Free2019-12-11Proxy access to raw paste endpoints on paste.ee and Pastebin-style services
Alerts on proxy requests for raw paste service URLs that can be used to stage or fetch malicious payloads.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh171Free2019-12-05Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)
Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.
Thomas Patzke, Huntrule TeamWindowssecurityLow123Free2019-12-04Windows Security: Detect Domain Trust Creation (Event ID 4706)
Alerts on Windows Event ID 4706 indicating a new trust was created to a domain.
Thomas Patzke, Huntrule TeamWindowssecurityMedium399Free2019-12-03Windows Security: Failed Code Integrity Checks (Event 5038/6281)
Alerts on Windows Security code integrity failures (Event 5038/6281) that may indicate modified or corrupted binaries.
Thomas Patzke, Huntrule TeamWindowssecurityInformational322Free2019-12-03Windows Security Event 6416 for USB Mass Storage Device Plug-In or DiskDrive Recognition
Flags Windows Event ID 6416 entries where a DiskDrive/USB Mass Storage Device is detected as connected.
Keith Wright, Huntrule TeamWindowssecurityLow106Free2019-11-20Windows CVE-2019-1388 UAC Consent to Internet Explorer Execution as LOCAL_SYSTEM
Flags UAC consent.exe launching iexplore.exe running as SYSTEM, consistent with CVE-2019-1388 exploitation.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical307Free2019-11-20Windows ProcDump Execution via Renamed Binary
Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh100Free2019-11-18Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI
Alerts on web requests with a Guacamole-related URI query pattern associated with a Pulse Secure CVE-2019-11510 exploitation attempt.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical159Free2019-11-18Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs
Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.
"@SBousseaden, Florian Roth, Huntrule Team"WindowssecurityHigh151Free2019-11-15Windows Process Creation: Suspicious SetupComplete.cmd execution for CVE-2019-1378 exploitation
Alerts on cmd.exe parent command lines executing SetupComplete.cmd or PartnerSetupComplete.cmd from Windows Setup script paths.
Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro, Huntrule TeamWindowsprocess_creationHigh197Free2019-11-15Windows msiexec.exe Execution from Uncommon Directory
Alerts when msiexec.exe starts from a non-standard path, which may indicate masquerading.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3410Free2019-11-14Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process
Alerts when a non-PowerShell executable loads System.Management.Automation.dll on Windows, indicating possible PowerShell execution in another process.
Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsimage_loadMedium131Free2019-11-14Suspicious APT User-Agent Strings in Proxy Logs
Alerts when proxy requests contain known APT-style user agent strings indicating likely malicious client behavior.
Florian Roth (Nextron Systems), Markus Neis, Huntrule TeamWebproxyHigh182Free2019-11-12Proxy User-Agent Matching APT40 Dropbox Tool on api.dropbox.com
Alerts on proxy requests using a fixed Chrome 36 user-agent to api.dropbox.com.
Thomas Patzke, Huntrule Team—proxyHigh172Free2019-11-12