Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules
Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementLow373Free2021-08-22Zeek DNS Queries Ending in Known Crypto Mining Pool Domains
Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.
Saw Winn Naung, Azure-Sentinel, @neu5ron, Huntrule TeamZeekdnsLow161Free2021-08-19AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.
Austin Songer, Huntrule TeamAwscloudtrailLow496Free2021-08-16GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditLow193Free2021-08-14Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted
Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow223Free2021-08-07Azure Activity Logs: Container Registry Created or Deleted
Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow532Free2021-08-07Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
frack113, Huntrule TeamWindowsprocess_creationLow181Free2021-07-27AWS CloudTrail: IAMUser STS GetSessionToken Use
Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow231Free2021-07-24AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals
Alert on CloudTrail AssumeRole events initiated from an already assumed role session.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow237Free2021-07-24AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow311Free2021-07-24AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail
Flags CloudTrail activity indicating an ElastiCache security group was modified or deleted.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow457Free2021-07-24AWS CloudTrail: ElastiCache Cache Security Group Created
Flags CloudTrail events indicating a new ElastiCache cache security group was created.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow222Free2021-07-24AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount
Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow231Free2021-07-22AWS Route 53 Domain Transfer Lock Disabled via CloudTrail
Alerts when Route 53 domain transfer protection is removed through DisableDomainTransferLock events in CloudTrail.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow4610Free2021-07-22Windows Security: Detect Scheduled Task Deletion (EventID 4699)
Flags Windows scheduled task deletions from Security EventID 4699 while excluding common MRT and Firefox-related tasks.
David Strassegger, Tim Shelton, Huntrule TeamWindowssecurityLow220Free2021-01-22