Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
463 rules
macOS Screen Capture via /usr/sbin/screencapture Process Execution
Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow192Free2020-10-13macOS GUI Credential Prompt Capture via osascript
Flags osascript command lines that script system dialogs referencing authentication and password-related terms.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow313Free2020-10-13Windows Indirect Command Execution via Program Compatibility Assistant pcwrun.exe
Alerts on child processes spawned by pcwrun.exe, indicating indirect command execution via Program Compatibility Assistant.
A. Sungurov , oscd.community, Huntrule TeamWindowsprocess_creationLow181Free2020-10-12Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building
Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.
Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton, Huntrule TeamWindowsprocess_creationLow483Free2020-10-11Linux Local Groups Discovery via /groups or /etc/group File Enumeration
Detects Linux commands and utilities used to enumerate local groups and read /etc/group.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamLinuxprocess_creationLow419Free2020-10-11Windows regini.exe Execution Leading to Registry Key Changes
Alerts on Windows executions of regini.exe that can import registry changes from text files.
Eli Salem, Sander Wiebing, oscd.community, Huntrule TeamWindowsprocess_creationLow291Free2020-10-08Windows net.exe Unmount Share (/delete) Execution
Alerts on net.exe/net1.exe commands that include "share" and "/delete", indicating share unmount/removal on Windows.
oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule TeamWindowsprocess_creationLow192Free2020-10-08macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow112Free2020-10-08Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u
Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.
Alejandro Ortuno, oscd.community, CheraghiMilad, Huntrule TeamLinuxprocess_creationLow565Free2020-10-08Linux Password Policy Discovery via chage and passwd Commands
Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.
Ömer Günal, oscd.community, Pawel Mazur, Huntrule TeamLinuxauditdLow233Free2020-10-08Windows Registry Key Export via regedit.exe (-E) to File
Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.
Oddvar Moe, Sander Wiebing, oscd.community, Huntrule TeamWindowsprocess_creationLow193Free2020-10-07macOS Local User Account Creation via dscl or sysadminctl
Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow130Free2020-10-06Linux at/atd Process Execution via /at or /atd
Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.
Ömer Günal, oscd.community, Huntrule TeamLinuxprocess_creationLow5310Free2020-10-06Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)
Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.
oscd.community, Natalia Shornikova, Huntrule TeamWindowsprocess_creationLow150Free2020-10-06Linux process discovery via common process listing and monitoring tools
Flags Linux execution of common tools used to enumerate running processes.
Ömer Günal, oscd.community, CheraaghiMilad, Huntrule TeamLinuxprocess_creationLow150Free2020-10-06