Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,454 rules
Azure PIM Invalid License Alert Incident
Alerts when Azure PIM reports an invalid or missing license condition for the organization.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzurepimHigh272Free2023-09-14Azure PIM Stale Sign-In Alert for Privileged Role Accounts
Alerts when Azure PIM reports a privileged account has gone stale due to no sign-in activity.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzurepimHigh301Free2023-09-14Windows: Headless Chromium Browser Execution via --headless
Alerts on headless Chromium-based browser launches on Windows using the "--headless" command-line flag.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationLow80Free2023-09-12Windows Process Creation: wmic.exe call terminate Attempt
Alerts on wmic.exe being executed with “call terminate”, indicating an attempt to terminate a process on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium122Free2023-09-11Windows Process Creation: Execution of Renamed curl.exe via PE Metadata
Alerts on Windows process launches whose PE metadata matches curl.exe even when the executable image is renamed.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium469Free2023-09-11Windows Chromium Headless Execution with Mockbin/Mocky URL
Alerts when a Chromium-based browser runs headless on Windows with a mockbin-like URL in the command line.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh123Free2023-09-11Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts
Alerts on .dmp/.dump/.hdmp file creation by common Windows shells and scripting engines.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium172Free2023-09-07Okta user.session.start via anonymising proxy service
Identifies Okta user session starts where the session is marked as using an anonymizing proxy.
kelnage, Huntrule TeamOktaoktaHigh384Free2023-09-07Okta: End-user Reported Suspicious Activity Account Event Detection
Flags Okta end-user self-submitted reports of potentially suspicious activity on their account.
kelnage, Huntrule TeamOktaoktaHigh338Free2023-09-07Okta Admin Console: New admin console activity via policy.evaluate_sign_on heuristics
Alerts when Okta policy evaluation shows POSITIVE debug heuristics for activity targeting the Okta Admin Console.
kelnage, Huntrule TeamOktaoktaHigh111Free2023-09-07Okta System Log: New Identity Provider Created via system.idp.lifecycle.create
Alerts on Okta events indicating a new identity provider was created.
kelnage, Huntrule TeamOktaoktaMedium133Free2023-09-07Azure (Entra ID) Risk Detection: Threat Intelligence-Driven Unusual User Activity
Flags Azure AD risk investigation events tied to threat-intelligence sign-in indicators using riskdetection telemetry.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh217Free2023-09-07Azure Risk Detection: Attempted Primary Refresh Token (PRT) Access
Identifies Azure risk events indicating an attempted PRT access that can enable lateral movement or credential theft.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh242Free2023-09-07Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP
Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh101Free2023-09-07Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate
Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh152Free2023-09-07