Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Security 4611: Rubeus-Indicative New Trusted Logon Process Registration
Alerts on Windows Security Event 4611 registering a new trusted logon process named 'User32LogonProcesss'.
Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule TeamWindowssecurityHigh141Free2019-10-24Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection
Flags auditd activity where /etc/ld.so.preload is modified, indicating potential shared object injection.
E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Huntrule TeamLinuxauditdHigh112Free2019-10-24Windows Process Execution of Common Tunneling Tools (httptunnel, plink, socat, stunnel)
Alerts on Windows execution of htptunnel.exe, plink.exe, socat.exe, or stunnel.exe that may be used for tunneling.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowsprocess_creationMedium70Free2019-10-24Windows Registry COM Hijacking via TreatAs Subkey in CLSID
Alerts on registry modifications to HKU\Classes\CLSID\*\TreatAs that may indicate COM object hijacking/persistence.
Kutepov Anton, oscd.community, Huntrule TeamWindowsregistry_setMedium255Free2019-10-23Windows: Sysmon filter driver unloaded using fltMC.exe
Identifies fltMC.exe commands attempting to unload the Sysmon filter driver via “unload sysmon”.
Kirill Kiryanov, oscd.community, Huntrule TeamWindowsprocess_creationHigh467Free2019-10-23Linux auditd: dd overwrites a file using /dev/null or /dev/zero
Flags dd command lines that overwrite files by sourcing data from /dev/null or /dev/zero.
Jakob Weinzettl, oscd.community, Huntrule TeamLinuxauditdLow112Free2019-10-23Windows Process Creation: File/Folder Permission Changes via cacls/icacls/net attrib/takeown
Alerts when Windows permission/ownership changes are attempted using ACL and ownership tools with grant/inheritance-related command-line flags.
Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium130Free2019-10-23Windows Raw Disk Access by Uncommon Process Paths
Alerts on Windows raw disk access by processes from uncommon or suspicious locations.
Teymur Kheirkhabarov, oscd.community, Huntrule TeamWindowsraw_access_threadLow91Free2019-10-22Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin
Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.
Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades), Huntrule TeamWindowsprocess_creationHigh91Free2019-10-22Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands
Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.
Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowsprocess_creationMedium365Free2019-10-22Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY
Flags reg.exe command lines exporting or saving HKLM registry hives tied to SAM, SYSTEM, and SECURITY.
Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113, Huntrule TeamWindowsprocess_creationHigh3610Free2019-10-22Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)
Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.
Aleksey Potapov, oscd.community, Huntrule TeamWindowsprocess_creationHigh169Free2019-10-22Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage
Flags Windows processes whose command lines contain Mimikatz names and credential-dumping module/function arguments.
Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton, Huntrule TeamWindowsprocess_creationHigh133Free2019-10-22Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS
Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.
Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowsprocess_creationHigh162Free2019-10-22Windows Volume Shadow Copy Symlink Creation Using mklink
Flags Windows mklink commands that reference HarddiskVolumeShadowCopy to create symlinks.
Teymur Kheirkhabarov, oscd.community, Huntrule TeamWindowsprocess_creationHigh193Free2019-10-22