Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,522 rules
Windows DISM Enables PowerShell Web Access Feature via Command Line
Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.
Michael Haag, Huntrule TeamWindowsprocess_creationHigh102Free2024-09-03Windows PowerShell Web Access Installation via PowerShell Script Block
Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.
Michael Haag, Huntrule TeamWindowsps_scriptHigh307Free2024-09-03Windows Process Deletes Its Own Executable File
Flags Windows file deletion events where a process removes its own executable image.
Max Altgelt (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium183Free2024-09-03Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe
Alerts on non-initiated (incoming) network connections tied to AnyDesk.exe or AnyDeskMSI.exe on Windows.
"@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"Windowsnetwork_connectionMedium132Free2024-09-02Linux: rsync Used to Spawn a Shell via Command-Line -e
Alerts when rsync is run with -e to execute a shell interpreter on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth, Huntrule TeamLinuxprocess_creationHigh181Free2024-09-02Linux Inline Python (-c) Calling os.system to Spawn Shell
Flags Linux processes launching inline Python (-c) that invokes os.system() to execute a shell.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh482Free2024-09-02Linux process execution of shell via nice utility
Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh353Free2024-09-02Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection
Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh328Free2024-09-02Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh222Free2024-09-02Linux: Shell Command Execution Using flock -u with Common Shell Paths
Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh404Free2024-09-02Linux Find Command Used to Execute a Shell via -exec
Flags Linux /find executions that use -exec to launch a shell interpreter.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh130Free2024-09-02Linux env Execution Spawning Common Shells
Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh142Free2024-09-02Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh293Free2024-09-02Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()
Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh121Free2024-09-02Windows Task Scheduler DLL Loaded From Uncommon Directory
Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadLow110Free2024-09-02