Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
4,488 rules
RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts
Alerts on MS-DRSR RPC Firewall events where non-standard opcodes target the DRSR interface from non-DC hosts.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh388Free2022-01-01RPC Firewall AtScv Remote Schedule Task Information Recon
Identifies remote AtScv RPC calls that access scheduled task information via RPC Firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh387Free2022-01-01Windows ATSvc Remote RPC Scheduled Task Creation or Execution (RPC Firewall)
Identifies remote ATSvc RPC calls for scheduled task creation/execution using RPC Firewall EventID 3 and OpNum 0/1.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh524Free2022-01-01Windows Winlogon Notify Registry Key DLL Persistence (logon)
Alerts on DLL-specified Winlogon Notify logon entries created via registry set events.
frack113, Huntrule TeamWindowsregistry_setHigh332Free2021-12-30Windows: File creation of C:\program.exe enabling unquoted service path execution
Flags creation of C:\program.exe that can be used to hijack unquoted Windows service binary paths.
frack113, Huntrule TeamWindowsfile_eventHigh508Free2021-12-30Windows Registry Startup: Chrome VPN Extensions Installed via Extension Registry Keys
Flags Windows Registry updates that register VPN/proxy Chrome extensions via the Chrome Extensions update_url key.
frack113, Huntrule TeamWindowsregistry_setHigh191Free2021-12-28Windows Process Creation: Suspicious Kernel Dump via dtrace.exe lkd(0) and syscall:::return
Alerts on Windows process executions of dtrace.exe with command lines consistent with kernel dumping (lkd).
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh446Free2021-12-28PowerShell ScriptBlock Requesting Kerberos Tickets via System.IdentityModel.Tokens.KerberosRequestorSecurityToken
Alerts on PowerShell ScriptBlock text that builds Kerberos ticket requests using KerberosRequestorSecurityToken and .GetRequest().
frack113, Huntrule TeamWindowsps_scriptHigh252Free2021-12-28PowerShell Script Blocks Register Malicious XLL via Office COM Automation on Windows
Detects PowerShell Script Block content that uses COM automation to call .RegisterXLL for an Office XLL add-in.
frack113, Huntrule TeamWindowsps_scriptHigh514Free2021-12-28Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line
Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh230Free2021-12-27Windows Process Execution of Hashcat.exe for Password Cracking
Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.
frack113, Huntrule TeamWindowsprocess_creationHigh479Free2021-12-27Windows: Findstr searches GPP cpassword in SYSVOL XML
Alerts when Windows findstr/find searches SYSVOL XML files for GPP cpassword.
frack113, Huntrule TeamWindowsprocess_creationHigh497Free2021-12-27Windows PowerShell Copies a DLL into System32 or SysWOW64
Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptHigh193Free2021-12-27Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks
Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.
frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule TeamWindowsprocess_creationHigh121Free2021-12-26Java keytool Spawns System Shells or Scripting Utilities on Windows
Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.
Andreas Hunkeler (@Karneades), Huntrule TeamWindowsprocess_creationHigh150Free2021-12-22