Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
AWS CloudTrail: Instance Profile Role Assumed Actions Outside SSM RegisterManagedInstance
Identifies CloudTrail activity from assumed-role instance identities when it is not part of SSM RegisterManagedInstance.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh243Free2024-07-11Kubernetes Audit: Secrets Created, Patched, Replaced, Updated, or Deleted
Flags Kubernetes audit events where Secret resources are created, updated, patched, replaced, or deleted.
kelnage, Huntrule TeamKubernetesauditMedium162Free2024-07-11Kubernetes RBAC RoleBinding Created or Modified via Audit Events
Alerts on Kubernetes RBAC RoleBinding/ClusterRoleBinding create or update actions seen in audit logs.
kelnage, Huntrule TeamKubernetesauditMedium273Free2024-07-11Kubernetes CronJob/Job Created or Modified via API Audit Events
Alert on Kubernetes batch CronJob/Job create or modification audit verbs that may enable scheduled workload execution.
kelnage, Huntrule TeamKubernetesauditMedium152Free2024-07-11Kubernetes API Audit: Admission Webhook Configuration Modified
Kubernetes audit alerts on API modifications to mutating/validating webhook configurations that can enable persistence or credential access.
kelnage, Huntrule TeamKubernetesauditMedium191Free2024-07-11Windows: Microsoft Word Loads WLL Add-In Files
Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.
Steffen Rogge (dr0pd34d), Huntrule TeamWindowsimage_loadLow160Free2024-07-10Windows: Detect regedit.exe creating a PDF file
Alerts when RegEdit.exe creates a .pdf file on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh376Free2024-07-08Windows Registry: DisableHypervisorEnforcedPagingTranslation Set to 1
Alerts when Windows disables Hypervisor Enforced Paging Translation by setting DisableHypervisorEnforcedPagingTranslation to 1.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh293Free2024-07-05Windows Security Event 4698: Kapeka-like Scheduled Task Creation
Flags suspicious Kapeka-like scheduled task creation via Event 4698 using TaskContent paths, rundll32/.wll command markers, and OneDrive/Sens Api task names.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowssecurityHigh428Free2024-07-03Windows Registry Seed Value Set Under Cryptography\Providers (Kapeka SIP Persistence)
Flags registry set operations creating/setting a "Seed" value under the Cryptography Providers key path on Windows.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setMedium222Free2024-07-03Windows Registry Run Key Autorun Entries Targeting Kapeka Backdoor
Flags Windows Run key registry changes whose data matches a Kapeka-style rundll32 .wll (#1) autorun entry.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setHigh191Free2024-07-03Kapeka backdoor execution via rundll32.exe with export ordinal #1 and -d on Windows
Flags rundll32.exe command lines launching a Kapeka payload from ProgramData/AppData Local using export ordinal #1 with "-d".
Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh299Free2024-07-03Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun
Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationHigh594Free2024-07-03Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe
Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadHigh373Free2024-07-03Windows file drop: Kapeka-style decrypted backdoor indicators in AppData with .wll naming
Alerts on suspicious Kapeka backdoor file drops in Windows AppData/Common AppData using .wll naming patterns.
Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh536Free2024-07-03