Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,501 rules
Windows node.exe Execution with -e/--eval and suspicious child process usage
Alerts on node.exe started with -e/--eval and command-line indicators of child_process and net.socket connect activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh222Free2022-09-09Windows Process Creation: SharpEvtMute Execution (Event Log Tampering)
Alerts on SharpEvtMute.exe runs with event-log filter and encoded command-line parameters on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh171Free2022-09-07Windows SysmonEnte Process Access Attempt (Sysmon.exe/ Sysmon64.exe/ Sysmon64a.exe)
Flags attempts to access Sysmon binaries consistent with SysmonEnte execution based on TargetImage, GrantedAccess, and CallTrace.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh455Free2022-09-07Windows: Detect EvtMuteHook.dll Load by IMPHASH Match (SharpEvtMute)
Detects DLL loads with a specific IMPHASH consistent with EvtMuteHook.dll used for event log tampering.
Florian Roth (Nextron Systems), Huntrule TeamWindowsimage_loadHigh122Free2022-09-07Windows suspicious file download URLs using direct IP address with script/binary extensions
Alerts on Windows downloads from HTTP/HTTPS direct IP URLs targeting script/binary/shortcut-like filenames.
Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule TeamWindowscreate_stream_hashHigh223Free2022-09-07Windows Process Creation: WinAPI Function Names in Command-Line
Alerts on Windows processes whose command lines reference WinAPI functions/modules commonly used for dynamic invocation and memory/process manipulation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh271Free2022-09-06Windows Process Creation: Renamed Sysinternals Sdelete Execution
Alerts on Windows processes created with OriginalFileName sdelete.exe but executed via renamed sdelete binary paths.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh132Free2022-09-06Windows SharpChisel Command-Line Execution via SharpChisel.exe
Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh202Free2022-09-05Windows: Detect QuarksPwDump.exe Credential Dumping via Command-Line Parameters
Flags QuarksPwDump.exe executions on Windows that attempt local/domain hash and related data dumping.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh183Free2022-09-05Windows File Events: Suspicious Executable File Name Creation
Alerts on Windows file creation with suspicious executable filename patterns, including .bat.exe/.sys.exe and deceptive path-based names.
frack113, Huntrule TeamWindowsfile_eventHigh232Free2022-09-05Windows Registry Tampering Targeting Sophos AV Tamper Protection Enabled Flags
Flags Windows registry changes that disable Sophos AV tamper protection by clearing specific enabled DWORD values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh268Free2022-09-02Windows Process Creation: reg.exe Adds or Copies SafeBoot Registry Keys
Flags reg.exe with add/copy used against SafeBoot registry keys in Windows process creation logs.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh503Free2022-09-02Windows Process Execution of Fast Reverse Proxy (FRP) frpc.exe or frps.exe
Alerts on Windows execution of FRP components (frpc.exe/frps.exe) with FRP indicators via command line or known hashes.
frack113, Florian Roth, Huntrule TeamWindowsprocess_creationHigh439Free2022-09-02Windows certutil.exe Initiates Network Connections to Common Service Ports
Alerts when certutil.exe initiates outbound network connections to ports 80, 135, 443, or 445 on Windows.
frack113, Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh258Free2022-09-02Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services
Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.
Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh172Free2022-09-01