Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,507 rules
OpenCanary SMB service records file open requests
Triggers when OpenCanary logs an SMB file open request to its monitored host.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh289Free2024-03-08OpenCanary SIP Request on Honeypot Node
Alerts on OpenCanary logs showing SIP request activity on a configured SIP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh191Free2024-03-08OpenCanary Redis Action Command Attempt
Alerts when OpenCanary reports an attempted action command against its Redis service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh458Free2024-03-08OpenCanary NTP Monlist Request Observed
Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh183Free2024-03-08OpenCanary MySQL Service: Login Attempt Recorded
Flags OpenCanary events indicating a MySQL service login attempt on the monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh191Free2024-03-08OpenCanary: MSSQL Windows Authentication Login Attempt (Logtype 9002)
Alerts on OpenCanary MSSQL events where Windows Authentication login attempts are observed.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh251Free2024-03-08OpenCanary MSSQL SQLAuth Login Attempt Detected (logtype 9001)
Flags MSSQL SQLAuth login attempts recorded by OpenCanary for credential-access style activity.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh152Free2024-03-08OpenCanary HTTPPROXY Login Attempt Shows Proxied Page Access
Alerts on OpenCanary HTTPPROXY events indicating a proxy request for another page.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh333Free2024-03-08OpenCanary: HTTP Form POST Login Attempt Observed on Port Service
Alerts on OpenCanary HTTP Form POST events indicating a login attempt to an exposed service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh345Free2024-03-08OpenCanary application telemetry: HTTP GET requests received by monitored service
Alerts when OpenCanary logs an HTTP GET request to a monitored service endpoint.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh172Free2024-03-08OpenCanary Git Service: Git Clone Request Observed
Flags OpenCanary Git service logs showing a Git clone request, indicating possible repository access attempts.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh81Free2024-03-08OpenCanary FTP Login Attempt on Port 2000
Flags OpenCanary application events indicating an FTP login attempt on a monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh171Free2024-03-08Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType
Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.
"@SerkinValery, Huntrule Team"WindowssystemLow101Free2024-03-07Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.
"@SerkinValery, Huntrule Team"WindowssystemLow364Free2024-03-07GitHub Secret Scanning Disabled for Enterprise or Repository
Flags GitHub audit events that disable secret scanning for an enterprise or repository, reducing exposed secret detection.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditHigh407Free2024-03-07