Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Registry: Wow6432Node CurrentVersion Autorun Key Modification
Flags registry writes to Wow6432Node\...\CurrentVersion autostart and Explorer persistence locations, excluding common benign installer activity.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium132Free2019-10-25Windows Registry WinSock2 Autostart Extensibility Point Modification
Flags registry modifications to WinSock2 Parameters catalog entries consistent with persistence via ASEP.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium465Free2019-10-25Windows Registry Autostart Script Keys Modification via System Scripts Policies
Detects Registry writes to System Scripts policy ASEP subkeys for Startup/Shutdown/Logon/Logoff on Windows.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium121Free2019-10-25Windows Registry Session Manager ASEP Modification via Auto-Start Extensibility Points
Flags registry modifications to Session Manager autostart extensibility points under CurrentControlSet\Control\Session Manager.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium213Free2019-10-25Windows Registry Modification of Internet Explorer Autostart Extension Keys (ASEP)
Flags Windows registry changes to Internet Explorer ASEP extension/toolbar keys associated with persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium152Free2019-10-25Windows Registry: Modification of Windows NT CurrentVersion Autostart Extensibility Points
Alerts on Windows registry changes to Winlogon/ASEP-related keys under Windows NT CurrentVersion that may enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium345Free2019-10-25Windows Registry CurrentVersion Autostart/Run Key Modification Monitoring
Alerts on registry writes to Windows CurrentVersion autostart and Run/RunOnce persistence keys, excluding known benign patterns.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium122Free2019-10-25Windows Registry CurrentControlSet Control Autorun/ASEP Key Modification
Alerts on Registry changes to Windows ASEP-related keys under CurrentControlSet\Control that can enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium326Free2019-10-25Windows Registry Autorun/ASEP Key Modification for Persistence
Alerts on registry modifications to common Windows autorun and persistence extensibility keys indicative of auto-start behavior.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name), Huntrule TeamWindowsregistry_setMedium326Free2019-10-25Windows Registry Classes Autorun Key Modification for Persistence
Alerts on registry changes under Windows Classes shell extension/ASEP paths that may enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium142Free2019-10-25Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence
Alerts on Windows registry changes involving AppCertDlls paths that can enable malicious DLL loading for persistence.
Ilyas Ochkov, oscd.community, Huntrule TeamWindowsregistry_eventMedium83Free2019-10-25Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key
Flags registry value deletions on a Narrator Feedback-Hub AppX DelegateExecute path used for persistence.
Dmitriy Lifanov, oscd.community, Huntrule TeamWindowsregistry_eventHigh161Free2019-10-25Windows: Registry CreateKey/Rename of HKLM\SYSTEM\CurrentControlSet\Control\MiniNt
Flags registry creation or renaming of the MiniNt key that can impair Windows event logging after reboot.
Ilyas Ochkov, oscd.community, Huntrule TeamWindowsregistry_eventHigh83Free2019-10-25Windows reg.exe Direct Modification of Registry Autostart Extensibility Keys (ASEP)
Flags reg.exe adding registry autostart (ASEP) entries under common Run/Winlogon/Policy paths.
Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium389Free2019-10-25Windows netsh.exe "add helper" execution for custom helper DLL loading
Flags netsh.exe being run with "add helper" parameters that can register a custom helper DLL.
Victor Sergeev, oscd.community, Huntrule TeamWindowsprocess_creationMedium277Free2019-10-25