Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: SafetyKatz LSASS dump default file indicator (Temp\debug.bin)
Flags Windows file events with a target path ending in \Temp\debug.bin, consistent with SafetyKatz LSASS dump output.
Markus Neis, Huntrule TeamWindowsfile_eventHigh273Free2018-07-24Web server access to WebLogic keystore JavaScript webshell URLs
Flags web requests attempting to access JavaScript content within a WebLogic keystore path.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical321Free2018-07-22Windows Registry Explorer Run Key Persistence Pointing to Suspicious Paths
Alerts on writes to the Explorer Run policy registry key with details pointing to suspicious filesystem paths.
Florian Roth (Nextron Systems), oscd.community, Huntrule TeamWindowsregistry_setHigh132Free2018-07-18Windows Registry Events: CMSTP Execution via cmmgr32.exe TargetObject
Flags registry events referencing \cmmgr32.exe, consistent with CMSTP-related execution behavior on Windows.
Nik Seetharaman, Huntrule TeamWindowsregistry_eventHigh241Free2018-07-16Windows CMSTP Process Spawning Child Process
Alerts on child processes spawned by Windows cmstp.exe, a common signal for CMSTP abuse.
Nik Seetharaman, Huntrule TeamWindowsprocess_creationHigh276Free2018-07-16Windows Process Access to cmlua.dll by CMSTP Connection Manager Profile Installer
Alerts on Windows process access events whose call trace includes cmlua.dll, indicating potential CMSTP-related execution.
Nik Seetharaman, Huntrule TeamWindowsprocess_accessHigh478Free2018-07-16Windows PowerShell Remote Thread Creation Into Uncommon Target Processes
Alerts on PowerShell creating remote threads in rundll32.exe or regsvr32.exe on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowscreate_remote_threadMedium275Free2018-06-25Windows Sysprep Execution Targeting AppData Directory
Alerts when sysprep.exe runs with an AppData directory present in the command line on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium153Free2018-06-22Windows NTLM authentication events (Event ID 8002)
Alerts on Windows NTLM authentication occurrences based on Event ID 8002 from Microsoft-Windows-NTLM/Operational.
Florian Roth (Nextron Systems), Huntrule TeamWindowsntlmLow2810Free2018-06-08Windows Process Creation: svchost.exe Spawns mshta.exe (LethalHTA)
Alerts on Windows instances where svchost.exe spawns mshta.exe, indicating potential LethalHTA execution.
Markus Neis, Huntrule TeamWindowsprocess_creationHigh163Free2018-06-07Suspicious Telegram API proxy access without Telegram User-Agent
Alerts on api.telegram.org requests where the User-Agent lacks common Telegram bot identifiers.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium152Free2018-06-05Suspicious DNS queries to api.telegram.org for Telegram Bot API traffic
Flags DNS queries to api.telegram.org that may indicate Telegram Bot API usage by bots or malware.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsMedium207Free2018-06-05Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
Alerts on NTFS ADS creation where the stream hash includes a non-null IMPHASH marker, consistent with hidden executables.
Florian Roth (Nextron Systems), @0xrawsec, Huntrule TeamWindowscreate_stream_hashMedium131Free2018-06-03Suspicious DNS Queries Containing Base64-Padding Pattern (==.)
Alerts on DNS queries containing the base64 delimiter pattern '==.' consistent with encoded data in DNS.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsMedium262Free2018-05-10Cobalt Strike-style DNS Beaconing Queries (DNS)
Flags DNS queries with Cobalt Strike-style stage subdomain patterns used for covert beaconing.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsCritical181Free2018-05-10