Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Windows DLL Sideloading Suspected for ms<wbr>corsvc.dll via ImageLoad
Alerts on non-standard loads of msocrsvc.dll, a potential DLL sideloading opportunity on Windows.
Wietze Beukema, Huntrule TeamWindowsimage_loadMedium123Free2024-07-11Windows DLL Sideloading via MpSvc.dll Image Load Anomaly
Flags Windows module loads of MpSvc.dll outside typical Defender/WinSxS locations that may indicate DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Wietze Beukema, Huntrule TeamWindowsimage_loadMedium287Free2024-07-11Potential DLL Sideloading: Image Load of DbgModel.dll on Windows
Alerts when a process loads DbgModel.dll from a non-standard path, suggesting possible DLL sideloading.
Gary Lobermier, Huntrule TeamWindowsimage_loadMedium379Free2024-07-11AWS CloudTrail SSM SendCommand Successful Execution for Instance
Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh227Free2024-07-11AWS RDS Security Group Changes via CloudTrail
Flags CloudTrail RDS events that create, delete, or change DB security group ingress rules.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium153Free2024-07-11AWS CloudTrail ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups
Alerts on CloudTrail events that change ELB/ALB security groups by applying or setting load balancer security groups.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium101Free2024-07-11AWS CloudTrail Security Group Ingress/Egress Rule Changes
Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium389Free2024-07-11AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table
Flags CloudTrail EC2 CreateRoute events indicating a new route was added to an AWS route table.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium323Free2024-07-11AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules
Identifies when EC2 network ACL entries are created in AWS via CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailLow142Free2024-07-11AWS CloudTrail: Instance Profile Role Assumed Actions Outside SSM RegisterManagedInstance
Identifies CloudTrail activity from assumed-role instance identities when it is not part of SSM RegisterManagedInstance.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh93Free2024-07-11Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted
Flags Kubernetes audit events where Secret resources are created, updated, patched, replaced, or deleted.
kelnage, Huntrule TeamKubernetesauditMedium82Free2024-07-11Kubernetes RBAC RoleBinding Created or Modified via Audit Events
Alerts on Kubernetes RBAC RoleBinding/ClusterRoleBinding create or update actions seen in audit logs.
kelnage, Huntrule TeamKubernetesauditMedium143Free2024-07-11Kubernetes CronJob/Job Created or Modified via API Audit Events
Alert on Kubernetes batch CronJob/Job create or modification audit verbs that may enable scheduled workload execution.
kelnage, Huntrule TeamKubernetesauditMedium82Free2024-07-11Kubernetes API Audit: Admission Webhook Configuration Modified
Kubernetes audit alerts on API modifications to mutating/validating webhook configurations that can enable persistence or credential access.
kelnage, Huntrule TeamKubernetesauditMedium71Free2024-07-11Windows: Microsoft Word Loads WLL Add-In Files
Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.
Steffen Rogge (dr0pd34d), Huntrule TeamWindowsimage_loadLow80Free2024-07-10