Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Linux process execution of shell via nice utility
Flags Linux process creation where nice is used to spawn a shell (bash/dash/fish/sh/zsh).
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh323Free2024-09-02Linux: Git Process Used to Launch a Shell via Bash/Dash/Sh Input Redirection
Flags Linux command lines where git usage (with -p and help) triggers bash/dash/sh execution via stdin redirection.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh308Free2024-09-02Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh192Free2024-09-02Linux: Shell Command Execution Using flock -u with Common Shell Paths
Flags Linux process creation where flock is invoked with a user option and common shell paths on the command line.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh374Free2024-09-02Linux Find Command Used to Execute a Shell via -exec
Flags Linux /find executions that use -exec to launch a shell interpreter.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh90Free2024-09-02Linux env Execution Spawning Common Shells
Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh92Free2024-09-02Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh273Free2024-09-02Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()
Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh91Free2024-09-02Windows Task Scheduler DLL Loaded From Uncommon Directory
Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadLow80Free2024-09-02Linux: SSH ProxyCommand Triggering Interactive Shell Execution
Flags Linux ssh invocations that embed shell execution and redirection via ProxyCommand/local command options.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh286Free2024-08-29Windows Registry: Disable Python function execution warnings in Excel
Alerts on registry updates that disable Excel Python function execution warnings via the PythonFunctionWarnings DWORD.
Nasreddine Bencherchali (Nextron Systems), @Kostastsale, Huntrule TeamWindowsregistry_setHigh141Free2024-08-23Windows DNS Client detects queries to Put.io subdomains (api.put.io, upload.put.io)
Alert on Windows DNS Client queries containing api.put.io or upload.put.io.
Omar Khaled (@beacon_exe), Huntrule TeamWindowsdns-clientMedium425Free2024-08-23Windows Cmd.exe: SET /p file append/override pattern via set /p=
Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.
Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan), Huntrule TeamWindowsprocess_creationLow80Free2024-08-22macOS chflags Hidden Flag Set via chflags hidden parameter
Alerts when chflags is run with the hidden flag on macOS to make files or directories less visible.
Omar Khaled (@beacon_exe), Huntrule TeamMacosprocess_creationMedium311Free2024-08-21Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0
Alerts on Azure Entra user updates that change StrongAuthenticationRequirement to a disabled State ("State":0).
Harjot Singh (@cyb3rjy0t), Huntrule TeamAzureauditlogsMedium209Free2024-08-21