Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: Detect tscon.exe launched under SYSTEM context
Alerts on tscon.exe starting under a SYSTEM-associated user context based on Windows process creation logs.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh329Free2018-03-17Windows Registry Image File Execution Options Debugger Backdoor (sethc.exe/utilman.exe/osk.exe)
Alerts on registry Debugger hijacks for Windows login/accessibility binaries using Image File Execution Options.
Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsregistry_eventCritical504Free2018-03-15Windows Backdoor Execution via Sticky Keys and Login-Screen Accessibility Tools
Flags winlogon.exe spawning command/script tools referencing login-screen accessibility binaries (sethc.exe, utilman.exe, osk.exe, etc.).
Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationCritical211Free2018-03-15Windows Process Creation with taskmgr.exe as Parent Process
Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationLow122Free2018-03-13Windows WMI Script Event Consumer Execution via scrcons.exe
Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.
Thomas Patzke, Huntrule TeamWindowsprocess_creationMedium367Free2018-03-07Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe
Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.
Thomas Patzke, Huntrule TeamWindowsimage_loadHigh103Free2018-03-07Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)
Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.
Thomas Patzke, Huntrule TeamWindowsfile_eventHigh449Free2018-03-07Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY
Flags PowerShell-launched schtasks.exe /Create commands matching default PowerSploit/Empire scheduled task persistence behavior.
Markus Neis, @Karneades, Huntrule TeamWindowsprocess_creationHigh271Free2018-03-06Windows rundll32 Trojan Loader Execution via Local AppData and .dat Parameters
Flags rundll32.exe launched with AppData/local .dat and .dll patterns consistent with Trojan loader behavior.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh152Free2018-03-01Windows process creation: Winword launching FLTLDR.exe exploitation behavior
Alerts when Winword spawns a FLTLDR.exe child process, matching a CVE-2017-0261-style exploit chain.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium173Free2018-02-22WinWord spawning MicroScMgmt.exe indicative of CVE-2015-1641 exploitation on Windows
Alerts when Winword.exe starts MicroScMgmt.exe, matching a known CVE-2015-1641 exploitation behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical161Free2018-02-22Linux syslog: Detect suspicious BIND/named error messages
Alerts on Linux syslog messages with BIND named fatal or denied DNS error strings.
Florian Roth (Nextron Systems), Huntrule TeamLinuxsyslogHigh182Free2018-02-20Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash
Flags successful Windows NewCredentials (LogonType 9) logons using seclogo with Negotiate, consistent with Overpass-the-Hash behavior.
Roberto Rodriguez (source), Dominik Schaudel (rule), Huntrule TeamWindowssecurityHigh80Free2018-02-12Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\SAM-*
Flags creation of QuarksPwDump .dmp dump files in Temp with a SAM-* filename pattern.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventCritical383Free2018-02-10Windows msiexec Process Creation With Web URL Parameters
Alerts when msiexec is launched with command-line web URL indicators in its parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium171Free2018-02-09