Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,456 rules
Windows DNS Queries to Visual Studio Code Tunnel Domains
Alerts on Windows DNS queries to .tunnels.api.visualstudio.com, matching Visual Studio Code tunnel endpoints.
citron_ninja, Huntrule TeamWindowsdns_queryMedium189Free2023-10-25Windows DNS Queries to Devtunnels .devtunnels.ms Domains
Alerts on Windows DNS queries for .devtunnels.ms domains, which may indicate DevTunnels-based C2 or persistence.
citron_ninja, Huntrule TeamWindowsdns_queryMedium112Free2023-10-25Okta New User Created via user.lifecycle.create Event
Flags Okta events indicating new user account creation via user.lifecycle.create.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamOktaoktaInformational100Free2023-10-25Okta admin function access via proxy (requestUri contains admin and isProxy enabled)
Flags Okta requests targeting admin URIs when the event indicates the traffic is proxied.
Muhammad Faisal @faisalusuf, Huntrule TeamOktaoktaMedium425Free2023-10-25Windows: Detect creation of code_tunnel.json indicating VS Code tunneling utility use
Alerts on Windows file creation of code_tunnel.json, indicating VS Code tunneling may be active.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium60Free2023-10-25Okta: Access to /reports/password-health endpoint outside expected Admin Console use
Flags requests to Okta Password Health report endpoints (/reports/password-health/*) for threat hunting.
Muhammad Faisal (@faisalusuf), Huntrule TeamOktaoktaLow70Free2023-10-25Okta: Detect new or activated user accounts named svc_network_backup
Alerts on Okta account creation or activation events for target display names containing svc_network_backup.
Muhammad Faisal (@faisalusuf), Huntrule TeamOktaoktaMedium347Free2023-10-25Windows File Creation: inetmgr.exe in \Windows\ADFS\bg\ Path
Alerts on creation of \Windows\ADFS\bg\inetmgr.exe in Windows file events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh386Free2023-10-24Windows Security Event 4698 Scheduled Task Creation for TeamCity UI
Flags Windows scheduled task creation events where the task name is TeamCity Settings UI and content contains a specific marker.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityCritical301Free2023-10-24Windows Registry Events: Scheduled Task Creation via TaskCache Tree Key
Flags registry activity creating TaskCache Tree entries tied to TeamCity settings UI during exploitation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_eventHigh162Free2023-10-24Windows Process Creation Command-Line Indicator Matching 'uTYNkfKxHiZrx3KJ'
Triggers on Windows process creation events with command line containing 'uTYNkfKxHiZrx3KJ'.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh113Free2023-10-24Windows DLL Side-Loading via ProgramData Image Load Indicators (clip.exe and wsmprovhost.exe)
Flags ProgramData clip.exe or wsmprovhost.exe launching with suspicious DLL loads from ProgramData.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh93Free2023-10-24Windows File Creation Indicators Linked to Diamond Sleet Artifacts
Flags Windows file creations under \ProgramData matching specific payload component filename indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh71Free2023-10-24Windows DNS queries containing Diamond Sleet–related domains
Alerts on Windows DNS queries for QueryName values containing specific Diamond Sleet–related domains.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns_queryHigh142Free2023-10-24Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering
Alerts on Windows findstr.exe executions that filter output using security software and antivirus-related keywords.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationMedium202Free2023-10-20