Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,511 rules
Kubernetes Pod exec via API creates exec subresource requests
Detects Pod container exec session creation in Kubernetes audit logs, which can enable remote command execution.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium172Free2024-03-26Kubernetes Audit: Deleted Events
Identifies Kubernetes audit log entries where the events resource is deleted via the delete verb.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium4010Free2024-03-26Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow123Free2024-03-26Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows
Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.
Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule TeamWindowsregistry_setHigh312Free2024-03-22Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe
Flags schtasks.exe creating a weekly scheduled task that runs "shutdown /l /f" on Windows.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium121Free2024-03-22Windows: Word LNK via cmd.exe Start Menu shortcut leading to .doc execution
Flags cmd.exe command lines that invoke a Word Start Menu .lnk to launch a .doc.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium172Free2024-03-22Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh181Free2024-03-20Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow142Free2024-03-19Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2024-03-11Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow362Free2024-03-11Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files
Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh465Free2024-03-11macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow194Free2024-03-11TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow4010Free2024-03-11OpenCanary VNC Connection Attempt Observed
Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh359Free2024-03-08OpenCanary TFTP Service Receives a Request
Alerts on OpenCanary logs showing a recorded request to the TFTP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh467Free2024-03-08