Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,362 rules
Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs
Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.
Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule TeamWindowssecurityHigh60Free2023-01-19Windows RDP Successful Logon (4624 LogonType 10) from Public IP
Alerts on successful RDP (LogonType 10) from a non-private, non-local source IP in Windows Security Event 4624.
Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule TeamWindowssecurityMedium70Free2023-01-19Okta Admin Role Assignment Created via iam.resourceset.bindings.add
Detects creation of new admin role assignments in Okta when an IAM resource set binding is added.
Nikita Khalimonenkov, Huntrule TeamOktaoktaMedium371Free2023-01-19GitHub Audit Log: Delete Actions for Codespaces, Environments, Projects, and Repositories
Alerts on GitHub audit log deletion actions for Codespaces, environments, projects, and repositories.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditMedium4210Free2023-01-19Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)
Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh103Free2023-01-18Linux iptables/ufw Firewall Rule Flush via Process Execution
Flags Linux iptables/ufw activity that flushes firewall rules and can allow broad network traffic.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium387Free2023-01-18Linux UFW Disable Attempt via Process Execution
Flags Linux commands that stop/flush/unload or disable UFW, reducing firewall protection and exposure.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium248Free2023-01-18Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events
Alerts on Windows Defender Firewall configurations where all rules are deleted (Event 2033/2059), signaling potential defense impairment.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfirewall-asHigh163Free2023-01-17PowerShell Data Exfiltration Using Audio File (WAV BinaryWriter) on Windows
Alerts on PowerShell script blocks that appear to write data into an audio (WAV) file for potential exfiltration.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium142Free2023-01-16Windows DNS Client: DNS queries containing "ufile.io"
Alerts on Windows DNS Client queries where the queried name includes "ufile.io".
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientLow173Free2023-01-16Windows DNS Client: MEGA userstorage subdomain DNS query (EventID 3008)
Detects Windows DNS client queries for MEGA userstorage subdomains by matching the query name string.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientMedium122Free2023-01-16Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names
Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientCritical4410Free2023-01-16Windows DNS Client: DNS query for anonfiles.com domain
Alerts when Windows DNS client logs show a DNS query containing .anonfiles.com.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns-clientHigh161Free2023-01-16Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate
Alerts when AppX package execution/signature subject matches a known suspicious certificate in Windows telemetry.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsappxpackaging-omMedium112Free2023-01-16Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)
Flags execution of common Sysinternals binaries when launched through the Windows AppX runtime.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsappmodel-runtimeLow316Free2023-01-16