Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
407 rules
macOS Local User Account Creation via dscl or sysadminctl
Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow80Free2020-10-06Linux at/atd Process Execution via /at or /atd
Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow4910Free2020-10-06Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)
Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.
oscd.community, Natalia Shornikova, Huntrule TeamWindowsprocess_creationLow100Free2020-10-06Linux process discovery via common process listing and monitoring tools
Flags Linux execution of common tools used to enumerate running processes.
Ömer Günal, oscd.community, CheraaghiMilad, Huntrule TeamLinuxprocess_creationLow110Free2020-10-06Windows findstr.exe Subfolder and Case-Insensitive Search Flags
Alerts on findstr.exe executions that include both -s (subfolders) and -i (case-insensitive) flags.
Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationLow142Free2020-10-05Linux: Process executing update-ca-certificates or update-ca-trust
Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow182Free2020-10-05Windows Process Proxying: explorer.exe Spawned from cmd.exe or PowerShell
Flags cmd.exe/powershell.exe launching explorer.exe, indicating possible proxy-based execution on Windows.
Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Huntrule TeamWindowsprocess_creationLow110Free2020-10-05Windows VirtualBox Driver Registration or VM Startup via Process Command Line
Alerts on Windows processes whose command lines reference VirtualBox driver registration or VM start/control actions.
Janantha Marasinghe, Huntrule TeamWindowsprocess_creationLow186Free2020-09-26Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse
Alerts on MicrosoftAccountTokenProvider.dll loads on Windows, with process-based exclusions, as a signal for potential Azure Browser SSO token activity.
Den Iuzvyk, Huntrule TeamWindowsimage_loadLow171Free2020-07-15PowerShell Classic bXOR Operator Usage in Command Line
Identifies PowerShell classic executions from ConsoleHost using the -bxor operator in the command line.
Teymur Kheirkhabarov, Harish Segar, Huntrule TeamWindowsps_classic_startLow70Free2020-06-29Linux Remote File Copy via scp, rsync, or sftp
Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.
Ömer Günal, Huntrule TeamLinux—Low142Free2020-06-18Linux Process Sets HTTP/HTTPS Proxy Environment Variables
Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow156Free2020-06-17Linux process activity: chown root and setuid/setgid chmod flags
Alerts on Linux command lines that set root ownership and enable setuid/setgid via chmod u+s or g+s.
Ömer Günal, Huntrule TeamLinuxprocess_creationLow111Free2020-06-16Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses
Flags Zeek HTTP PUT requests with a WebDAV User-Agent that target non-excluded network addresses.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamZeekhttpLow153Free2020-05-02Windows Image Load of System.Drawing.ni.dll
Alerts when a Windows process loads System.Drawing.ni.dll, which may indicate visual data collection activity.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsimage_loadLow50Free2020-05-02