Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
AWS Glue Dev Endpoint Lifecycle Events (Create/Update/Delete) via CloudTrail
Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow191Free2021-10-03Linux xclip Clipboard Image Collection via Image MIME Types
Flags xclip usage that outputs image/* data from the clipboard on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow182Free2021-10-01Clipboard Data Collection via xclip (auditd Linux EXECVE)
Alerts on xclip command lines that request clipboard/clip selection output (-o) on Linux systems monitored by auditd.
Pawel Mazur, Huntrule TeamLinuxauditdLow143Free2021-09-24AWS CloudTrail: Lambda Function Updated with New Layer Attached
Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.
Austin Songer, Huntrule TeamAwscloudtrailLow182Free2021-09-23Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.
Pawel Mazur, Huntrule TeamLinuxauditdLow2410Free2021-09-21Linux screen capture using xwd saving a .xwd file
Flags xwd screen capture executions that write captured output to a .xwd file on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow183Free2021-09-13Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow231Free2021-09-12Linux steghide steganography: Extract hidden files from JPG/PNG
Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow351Free2021-09-11Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef
Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.
Pawel Mazur, Huntrule TeamLinuxauditdLow377Free2021-09-11Linux auditd: Unzip files extracted from JPG/PNG images
Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.
Pawel Mazur, Huntrule TeamLinuxauditdLow182Free2021-09-09Linux auditd: cat appends ZIP data to image files
Alerts when cat is used to handle .jpg/.png with an associated .zip argument, consistent with hiding ZIP data in images.
Pawel Mazur, Huntrule TeamLinuxauditdLow101Free2021-09-09Linux auditd: Hidden file or directory creation via leading-dot paths in execve
Alerts on Linux process executions creating or modifying dot-prefixed (hidden) files/directories.
Pawel Mazur, Huntrule TeamLinuxauditdLow172Free2021-09-06Linux Audio Capture via arecord and ecasound (auditd execve and memfd_create)
Detects Linux execution of arecord for audio capture and ecasound using memfd_create for in-memory data handling.
Pawel Mazur, Milad Cheraghi, Huntrule TeamLinuxauditdLow427Free2021-09-04Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads
Triggers on auditd events showing host enumeration commands and system identity file access on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow203Free2021-09-03PowerShell discovery of Win32_PnPEntity via ScriptBlockText
Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.
frack113, Huntrule TeamWindowsps_scriptLow473Free2021-08-23