Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,512 rules
Windows File Creation: System DLL Named .dll in Uncommon Locations
Alerts on creation of .dll files named like system DLLs in unexpected Windows directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium183Free2024-06-24Windows DNS Queries to azurewebsites.net From Non-Browser Processes
Alerts on DNS queries to azurewebsites.net from processes other than common browsers, using Windows DNS query and process image telemetry.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns_queryMedium257Free2024-06-24Windows CSharp Streamer RAT Potentially Loaded .NET Executable from Temp dat####.tmp
Identifies .NET executable image loads from a CSharp Streamer RAT-like Temp .tmp path pattern on Windows.
Luca Di Bartolomeo, Huntrule TeamWindowsimage_loadHigh402Free2024-06-22Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains
Alerts on initiated outbound connections from Windows hosts to LocaltoNet/.localtonet.com tunneling domains.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsnetwork_connectionHigh173Free2024-06-17Linux: Network connections initiated to LocaltoNet tunneling subdomains
Alerts when a Linux host initiates outbound connections to LocaltoNet (.localto.net/.localtonet.com) tunneling subdomains.
Andreas Braathen (mnemonic.io), Huntrule TeamLinuxnetwork_connectionHigh4810Free2024-06-17macOS Process Creation: nscurl File Download Arguments
Flags nscurl executions on macOS that include download-oriented command-line options, indicating potential remote file retrieval.
Daniel Cortez, Huntrule TeamMacosprocess_creationMedium123Free2024-06-04Windows: Suspicious Qemu execution with low-memory and network-tunneling flags
Alerts on Windows Qemu command lines using low -m values plus -netdev/connect= and -nographic.
Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR), Huntrule TeamWindowsprocess_creationMedium232Free2024-06-03Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)
Alerts when Windows Recall is enabled by setting the DisableAIDataAnalysis policy value to 0.
Sajid Nawaz Khan, Huntrule TeamWindowsregistry_setMedium171Free2024-06-02Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value
Flags deletion of WindowsAI\DisableAIDataAnalysis policy value indicating Windows Recall may be enabled.
Sajid Nawaz Khan, Huntrule TeamWindowsregistry_deleteMedium4610Free2024-06-02Windows Recall Enabled via reg.exe Registry Changes (Windows)
Flags reg.exe commands that delete or set DisableAIDataAnalysis to 0 under WindowsAI to enable Windows Recall.
Sajid Nawaz Khan, Huntrule TeamWindowsprocess_creationMedium222Free2024-06-02Windows Executable Connects to portmap.io Domain Over Network
Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.
Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium142Free2024-05-31Windows Network Connections Initiated by Processes in C:\Users\Public
Flags outbound network connections initiated by a process whose image path is under C:\Users\Public on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium90Free2024-05-31DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)
Flags Windows file activity in C:\temp for DarkGate loader staging using .au3 and autoit3.exe artifacts.
Tomasz Dyduch, Josh Nickels, Huntrule TeamWindowsfile_eventMedium101Free2024-05-31macOS: Time Machine Exclusion Added via tmutil addexclusion
Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium151Free2024-05-29macOS: Disable Time Machine via tmutil
Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium349Free2024-05-29