Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Security Events: SID History Added to Active Directory Object
Flags Windows Security events indicating Active Directory SIDHistory changes that can grant additional privileges.
Thomas Patzke, @atc_project (improvements), Huntrule TeamWindowssecurityMedium509Free2017-02-19Windows Application Logs: Match Antivirus/Malware Signature Keywords
Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.
Florian Roth (Nextron Systems), Arnim Rupp, Huntrule TeamWindowsapplicationHigh93Free2017-02-19Windows Webshell Command Strings in Webserver GET Requests
Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWebwebserverHigh151Free2017-02-19Windows Driver Load from Temporary Directory Paths
Detects Windows driver loads whose ImageLoaded path contains the temporary directory (\Temp\).
Florian Roth (Nextron Systems), Huntrule TeamWindowsdriver_loadHigh4210Free2017-02-12Windows Security: Detect LSASS handle access for SAM_DOMAIN (0x705)
Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.
sigma, Huntrule TeamWindowssecurityHigh112Free2017-02-12Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)
Alerts on Windows Security failures for Kerberos TGT-related operations using specific Kerberos event IDs and status codes.
Florian Roth (Nextron Systems), Huntrule TeamWindowssecurityHigh291Free2017-02-10Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)
Flags Windows Kerberos service ticket requests using RC4 encryption while excluding '$' machine/service accounts.
Florian Roth (Nextron Systems), Huntrule TeamWindowssecurityMedium345Free2017-02-06Windows Event Logs: Mimikatz Keyword Indicators
Detects Mimikatz-related keywords in Windows event logs while filtering Sysmon EventID 15 to limit noise.
Florian Roth (Nextron Systems), David ANDRE (additional keywords), Huntrule TeamWindows—High467Free2017-01-10Windows Event Log Cleared (Microsoft-Windows-Eventlog EventID 104)
Alerts when Windows event logs are cleared, based on Microsoft-Windows-Eventlog Event ID 104 from System telemetry.
Florian Roth (Nextron Systems), Huntrule TeamWindowssystemMedium231Free2017-01-10Windows Security and Eventlog Cleared via Event IDs 517 or 1102
Flags Windows event log clearing using Security Event ID 517 and Microsoft-Windows-Eventlog Event ID 1102.
Florian Roth (Nextron Systems), Huntrule TeamWindowssecurityHigh448Free2017-01-10Windows Webshell Recon Command-Line Keywords via Web Server Processes
Flags Windows process chains where web server parents spawn reconnaissance- and execution-related command lines indicative of webshell activity.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson, Huntrule TeamWindowsprocess_creationHigh397Free2017-01-01