Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,491 rules
Windows Scheduled Task Creation via schtasks with Suspicious Command-Line Patterns
Flags schtasks.exe /Create commands containing suspicious interpreter, encoding, hidden execution, or unusual path/script components.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh472Free2022-02-23Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior
Alerts on explorer.exe executions that include /NOUACCHECK, indicating potential bypass of UAC checks for child processes.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh293Free2022-02-23Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)
Flags Windows execution of tor.exe or Tor Browser’s bundled Firefox from the expected installation path.
frack113, Huntrule TeamWindowsprocess_creationHigh182Free2022-02-20Windows Sysmon DNS Query to .onion or Tor Gateway Domains
Alerts when Windows Sysmon DNS queries target .onion or Tor gateway/proxy-related domain suffixes.
frack113, Huntrule TeamWindowsdns_queryHigh457Free2022-02-20Windows DNS Client Query for .onion and Tor-related Domains
Alerts on Windows DNS queries resolving .onion and related Tor/hidden-service domains.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientHigh173Free2022-02-20Windows: Rundll32 Executing Registered COM Local Servers via Command-Line { }
Flags rundll32.exe launching COM local servers using -sta/-localserver with braced arguments.
frack113, Huntrule TeamWindowsprocess_creationHigh224Free2022-02-13Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
Flags schtasks.exe scheduling that triggers PowerShell to decode a base64 payload pulled from Windows Registry.
pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh90Free2022-02-12Windows reg.exe Used to Modify RDP Terminal Server Registry Values
Flags reg.exe command lines that modify Terminal Server registry values controlling RDP enablement and behavior.
pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, Huntrule TeamWindowsprocess_creationHigh3110Free2022-02-12Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Alerts on cmd.exe launching cool.exe/zero.exe with ZeroLogon PoC-style arguments and follow-on taskkill or PowerShell activity.
"@Kostastsale, TheDFIRReport, Huntrule Team"Windowsprocess_creationHigh253Free2022-02-12Windows process creation: flag suspicious program names and PowerShell script indicators
Alerts on suspicious Windows process image names and PowerShell command-line script/tool patterns commonly used in malicious tooling.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh182Free2022-02-11Windows File Creation Indicators for Local SAM Database Exports
Alerts on Windows file creations with filenames indicative of a local SAM export or backup artifact.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh228Free2022-02-11Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)
Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh182Free2022-02-10Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes
Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh231Free2022-02-10Windows LSASS Memory Access Triggered by Source Image Containing 'dump' Keyword
Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh180Free2022-02-10Windows Script Interpreter Execution From Suspicious Folders via Command-Line Flags
Flags-and-location-based detection of cscript/wscript/mshta-style script execution launched from TEMP/Public/user directories.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh438Free2022-02-08