Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: Potential Dridex-Related Execution via svchost/regsvr32 and Recon Tools
Alerts on suspicious svchost.exe or regsvr32.exe process executions with matching command-line and parent/child patterns indicative of Dridex activity.
Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical378Free2019-01-10PowerShell Executed From AppData on Windows (Command Line Indicators)
Flags PowerShell command lines that include AppData paths (Local/Roaming), indicating possible user-profile script execution.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationMedium172Free2019-01-09Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled
Flags Windows process command lines that reference Outlook’s EnableUnsafeClientMailRules security setting.
Markus Neis, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh181Free2018-12-27Windows Process Creation: SecurityXploded PasswordDump.exe Execution
Alerts on Windows executions of SecurityXploded PasswordDump.exe based on process metadata and filename.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical532Free2018-12-19Windows Process Creation: Rubeus HackTool Execution Indicators
Flags Windows process executions of Rubeus.exe when command lines include Kerberos attack-related actions.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical186Free2018-12-19Windows Process Creation: Command Line Obfuscation via Escape Characters
Identifies Windows process command lines containing escape-character URL obfuscation patterns.
juju4, Huntrule TeamWindowsprocess_creationMedium192Free2018-12-11Windows Remote Thread Injection Indicators via Process StartAddress Suffixes
Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.
Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community, Huntrule TeamWindowscreate_remote_threadHigh425Free2018-11-30Zeek SMB spoolss Named Pipe (IPC$) Access
Flags Zeek SMB events accessing the spoolss named pipe via IPC$.
OTR (Open Threat Research), @neu5ron, Huntrule TeamZeeksmb_filesMedium338Free2018-11-28Windows Service Control Manager: WerFaultSvc Installed via Service Creation (Event ID 7045)
Alerts on Windows Event 7045 service creation for "WerFaultSvc" as an indicator of dropper-style persistence.
Florian Roth (Nextron Systems), Huntrule TeamWindowssystemCritical443Free2018-11-23Windows: Suspicious Executable Downloads Missing File Metadata Fields
Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).
Markus Neis, Sander Wiebing, Huntrule TeamWindowsprocess_creationMedium191Free2018-11-22Windows Process Creation—CommandLine Indicators for APT29 2018 Phishing Campaign
Alerts on Windows command-line substrings seen in the 2018 APT29 phishing campaign indicators.
Florian Roth (Nextron Systems), @41thexplorer, Huntrule TeamWindowsprocess_creationCritical93Free2018-11-20Windows File Events: Detect ds7002*.lnk, .pdf, and .zip Indicators
Flags Windows file events with target filenames containing ds7002.lnk, ds7002.pdf, or ds7002.zip.
"@41thexplorer, Huntrule Team"Windowsfile_eventCritical101Free2018-11-20Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.
David Ledbetter (shellcode), Florian Roth (Nextron Systems), Huntrule TeamWindowsps_scriptHigh263Free2018-11-17Windows: Potential Kerberoasting SPN Enumeration via setspn.exe
Detects Windows setspn.exe runs with SPN query command-line parameters that may indicate Kerberoasting preparation.
Markus Neis, keepwatch, Huntrule TeamWindowsprocess_creationMedium605Free2018-11-14Windows ProcDump Command Lines Targeting LSASS Memory Dumps
Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh212Free2018-10-30