Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
macOS Process Creation: nscurl File Download Arguments
Flags nscurl executions on macOS that include download-oriented command-line options, indicating potential remote file retrieval.
Daniel Cortez, Huntrule TeamMacosprocess_creationMedium253Free2024-06-04Windows: Suspicious Qemu execution with low-memory and network-tunneling flags
Alerts on Windows Qemu command lines using low -m values plus -netdev/connect= and -nographic.
Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR), Huntrule TeamWindowsprocess_creationMedium242Free2024-06-03Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)
Alerts when Windows Recall is enabled by setting the DisableAIDataAnalysis policy value to 0.
Sajid Nawaz Khan, Huntrule TeamWindowsregistry_setMedium171Free2024-06-02Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value
Flags deletion of WindowsAI\DisableAIDataAnalysis policy value indicating Windows Recall may be enabled.
Sajid Nawaz Khan, Huntrule TeamWindowsregistry_deleteMedium6510Free2024-06-02Windows Recall Enabled via reg.exe Registry Changes (Windows)
Flags reg.exe commands that delete or set DisableAIDataAnalysis to 0 under WindowsAI to enable Windows Recall.
Sajid Nawaz Khan, Huntrule TeamWindowsprocess_creationMedium252Free2024-06-02Windows Executable Connects to portmap.io Domain Over Network
Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.
Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium172Free2024-05-31Windows Network Connections Initiated by Processes in C:\Users\Public
Flags outbound network connections initiated by a process whose image path is under C:\Users\Public on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium130Free2024-05-31DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)
Flags Windows file activity in C:\temp for DarkGate loader staging using .au3 and autoit3.exe artifacts.
Tomasz Dyduch, Josh Nickels, Huntrule TeamWindowsfile_eventMedium131Free2024-05-31macOS: Time Machine Exclusion Added via tmutil addexclusion
Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium181Free2024-05-29macOS: Disable Time Machine via tmutil
Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium389Free2024-05-29macOS tmutil Time Machine Backup Deletion Attempts
Flags tmutil executions with delete in the command line that attempt to remove Time Machine backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium3810Free2024-05-29Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)
Alerts when Acrobat/Office/PDF readers launch common browsers with HTTP(S) URLs, excluding known Microsoft and Foxit redirect patterns.
Joseph Kamau, Huntrule TeamWindowsprocess_creationMedium405Free2024-05-27Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS
Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_accessLow534Free2024-05-27Windows Network Connections to Cloudflared Tunnel Domains
Alerts when a Windows process initiates outbound connections to Cloudflared tunnel domain hostnames.
Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium476Free2024-05-27Windows: File Creation by mysqld.exe With Script/Executable Extensions
Alerts on file creation by mysqld.exe producing .bat/.exe/.ps1/.vbs and other executable or script file types on Windows.
Joseph Kamau, Huntrule TeamWindowsfile_eventHigh323Free2024-05-27