Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

407 rules

PowerShell Net.WebClient DownloadFile/DownloadString Usage (Classic)
Flags PowerShell Classic commands using Net.WebClient to download content via DownloadFile or DownloadString.
Florian Roth (Nextron Systems), Huntrule TeamWindowsps_classic_startLow233
Free2017-03-05
Windows: Detects Access to ADMIN$ Network Share (Event 5140)
Alerts on Windows Security event 5140 entries where an access request targets the ADMIN$ share.
Florian Roth (Nextron Systems), Huntrule TeamWindowssecurityLow104
Free2017-03-04