Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,449 rules
Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)
Identifies Windows Gpg4win (gpg.exe/gpg2.exe) decryption commands that include a passphrase keyword.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-08-09Windows Provisioning Registry Key Abuse Leading to Indirect Execution via Provlaunch.exe
Flags Windows command lines referencing the provisioning commands registry path commonly abused for Provlaunch.exe-based indirect execution.
Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh3510Free2023-08-08Windows: Alert on Suspicious Child Processes Spawned by provlaunch.exe
Detects provlaunch.exe launching suspicious child executables and processes from common temp/task paths on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh212Free2023-08-08Windows Named Pipe Creation: Default RemCom Pipe Name
Alerts on creation of named pipes with names containing "\RemCom" on Windows.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium121Free2023-08-07Windows Named Pipe Created for CSExec Default Pipe Name
Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowspipe_createdMedium345Free2023-08-07Windows RemComSvc Service Installation and Execution
Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium3610Free2023-08-07Windows Service Control Manager Detects CSExecSvc Installation and Execution
Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium163Free2023-08-07Azure risk detection: anomalousToken risk events
Flags Azure Entra ID risk events indicating anomalous token lifetime or use from unfamiliar locations.
Mark Morowczynski '@markmorow', Huntrule TeamAzureriskdetectionHigh122Free2023-08-07Windows Browser-Injected rundll32 Execution Indicative of GuLoader Activity
Flags rundll32.exe being launched from a browser process, matching GuLoader-style injected browser execution behavior on Windows.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh376Free2023-08-07Windows Portable Gpg.exe Execution from Uncommon Paths
Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium455Free2023-08-06Windows RemCom Service File Creation via RemComSvc.exe Filename
Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium409Free2023-08-04Windows CSExec Service File Creation (csexecsvc.exe)
Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium92Free2023-08-04Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries
Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium103Free2023-08-03Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading
Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium365Free2023-08-03Windows DLL Sideloading via mfdetours.dll using mftrace.exe
Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium60Free2023-08-03