Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,453 rules
Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1
Flags registry changes that set SCHANNEL TLS 1.0/1.1 Enabled to 1 on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium243Free2023-09-05Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.
Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea), Huntrule TeamWindowsregistry_setHigh301Free2023-09-05Suspicious CommandLine Parameters for Electron Apps on Windows
Alerts on Electron app execution with command-line flags consistent with subprocess and renderer/utility launching behavior.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium173Free2023-09-05Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS
Flags Windows command lines that set IE ZoneMap ProtocolDefaults for HTTP to the My Computer (zone 0) trust level.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh268Free2023-09-05Windows: Detect VMMap loading a signed dbghelp.dll from C:\Debuggers\
Alerts on vmmap.exe/vmmap64.exe loading a signed dbghelp.dll from C:\Debuggers, consistent with potential DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium133Free2023-09-05Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application
Alert on deletion of the Zone.Identifier ADS by an uncommon process on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium91Free2023-09-04Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium172Free2023-09-04Linux Process Creation: ESXi esxcli VM kill via vm process kill flags
Triggers when esxcli is executed with VM process kill arguments, indicating a potential ESXi VM termination.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium112Free2023-09-04Linux Process Execution of esxcli VM Listing Commands
Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium123Free2023-09-04Linux Process Creation: ESXi esxcli system discovery via system namespace
Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium275Free2023-09-04Linux Process: ESXi syslog configuration changed via esxcli system syslog config set
Detects esxcli commands that set ESXi syslog configuration based on command-line terms.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium81Free2023-09-04Linux ESXi esxcli Storage Information Discovery via esxcli storage commands
Flags Linux process executions of esxcli with storage discovery subcommands like get/list.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium251Free2023-09-04Linux Process Creating esxcli System Permission Set Admin for an Account
Alerts when esxcli is run to set Admin permissions via the system/permission set flags.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh143Free2023-09-04Linux Process Execution of esxcli Network Commands for ESXi Network Discovery
Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium111Free2023-09-04Windows File Deletion: Remove Zone.Identifier Alternate Data Stream
Alerts on Windows deletions of the Zone.Identifier ADS, which attackers may remove to evade zone-based security controls.
frack113, Huntrule TeamWindowsfile_deleteLow170Free2023-09-04