Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,446 rules
Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution
Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setHigh81Free2023-08-02Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.
Muhammad Faisal, Huntrule TeamWindowsprocess_creationMedium143Free2023-08-02Windows Process Creation: csc.exe Used for Dynamic .NET Compilation
Flags Windows runs of csc.exe with /noconfig /fullpaths and an @-file, consistent with dynamic .NET compilation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-08-02Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path
Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh124Free2023-08-01Windows Registry: New AppCompatFlags custom shim databases targeting system processes
Alerts on Windows registry writes to AppCompatFlags Custom shim paths targeting common system processes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh303Free2023-08-01Windows sdbinst.exe Installing Shim Database with Uncommon Extension
Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium464Free2023-08-01Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll
Alerts when VMMap loads an unsigned dbghelp.dll from C:\Debuggers, suggesting DLL sideloading on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh122Free2023-07-28Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths
Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscreate_remote_threadHigh249Free2023-07-28FortiGate Web Exploitation Indicators for CVE-2023-27997 via Remote Host/Login Checks
Flags GET/POST requests to FortiGate /remote validation/login endpoints containing "enc=" as potential CVE-2023-27997 exploitation indicators.
Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverMedium371Free2023-07-28Windows: Alert on wget.exe downloading files from an IP with output flags
Flags Windows wget.exe usage to download HTTP URLs from IPs and write outputs to script/binary extensions.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3510Free2023-07-27Windows: curl.exe Local File Read via file:/// Command Line
Flags curl.exe runs that include file:/// to access local files on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-07-27Windows: Curl.exe Insecure Proxy/DOH Transfer Flags
Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium70Free2023-07-27Suspicious curl.exe File Downloads From Direct IP Addresses on Windows
Alerts on Windows curl.exe commands downloading from an IP address with HTTP/S and suspect file extensions.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh111Free2023-07-27Windows Process Execution: curl.exe with Custom User-Agent Header
Flags Windows executions of curl.exe that include a User-Agent header in the command line.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium133Free2023-07-27Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar
Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium341Free2023-07-27