Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
768 rules
PowerShell GzipStream Decompression Attempts on Windows
Detects Windows PowerShell commands using GZipStream and ::Decompress to decompress encoded Gzip data.
Hieu Tran, Huntrule TeamWindowsprocess_creationMedium123Free2023-03-13Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic
Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh121Free2023-03-10Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)
Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh197Free2023-03-08Windows PowerShell Stop-Service Used to Stop a Service
Flags PowerShell executions that include the Stop-Service cmdlet to stop a Windows service.
Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationLow131Free2023-03-05Windows PowerShell Set-Service StartupType Change to Disabled or Manual
Alerts on PowerShell Set-Service commands changing a service startup type to Disabled or Manual on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium227Free2023-03-04PowerShell Creates Windows Service via New-Service and -BinaryPathName
Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.
Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowsprocess_creationLow372Free2023-02-20Windows PowerShell Console History File Deleted (PSReadLine)
Flags deletion of the PowerShell PSReadLine ConsoleHost_history.txt file, which can remove command history evidence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium102Free2023-02-15Windows Process Execution of Script Interpreters After Extraction from Compressed Files
Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.
"@kostastsale, Huntrule Team"Windowsprocess_creationMedium90Free2023-02-15Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh90Free2023-02-02Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation
Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium447Free2023-01-31Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation
Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium123Free2023-01-31Windows PowerShell Base64-Encoded WMI Class Invocation
Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.
Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh92Free2023-01-30Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names
Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_moduleHigh415Free2023-01-23PowerShell on Windows adding Windows capabilities via Add-WindowsCapability
Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-01-22Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)
Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.
frack113, Huntrule TeamWindowsprocess_creationMedium60Free2023-01-22