Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

6,266 rules

Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium111
Free2022-07-22
Windows Service Installation: PDQDeployRunner Remote Service Creation (Service Control Manager)
Flags new Windows services installed with PDQDeployRunner-* naming via Service Control Manager event 7045.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium153
Free2022-07-22
Windows: Detect New PDQDeploy Service Installation via Service Control Manager
Flags new Windows services installed via SCM Event 7045 that reference PDQDeployService.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium141
Free2022-07-22
Windows Registry SIP Persistence via New Cryptography Provider Registration
Detects suspicious Windows registry writes that register a new SIP/Cryptography provider DLL for persistence or defense impairment.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium163
Free2022-07-21
Windows Registry: Detect DLLPathOverride Persistence in ContentIndex Natural Language
Alerts on Windows registry changes to ContentIndex Natural Language DLLPathOverride values tied to SearchIndexer.exe persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh318
Free2022-07-21
Windows Registry: mpnotify SIP Provider Persistence via Winlogon
Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh411
Free2022-07-21
Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)
Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh392
Free2022-07-21
Windows Registry: New IFilter Registration via PersistentHandler/CLSID Keys
Flags registry writes that register new Windows Search IFilters/persistent handlers via PersistentHandler and CLSID key patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium297
Free2022-07-21
Windows Registry Persistence via HtmlHelp Author Location Modification
Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh143
Free2022-07-21
Windows Registry AMSI Provider Persistence via Providers Key
Alerts on registry activity creating/modifying AMSI provider entries under the Microsoft AMSI Providers keys.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium288
Free2022-07-21
Windows Registry Persistence via hhctrl CLSID InprocServer32 Default Modification
Flags registry changes to the hhctrl COM CLSID InprocServer32 (Default) to load a custom binary instead of the system hhctrl.ocx.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh382
Free2022-07-21
Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key
Flags registry modifications adding a Debugger entry under Windows Error Reporting Hangs, a potential crash-triggered persistence technique.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh264
Free2022-07-21
Windows Registry Persistence via Disk Cleanup Handler Autorun Keys
Flags registry changes under Windows Disk Cleanup Handler VolumeCaches that set Autorun and command-like handler values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium2010
Free2022-07-21
Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence
Flags registry writes that set an AeDebug Debugger .dll value, enabling debugger execution on application crashes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium113
Free2022-07-21
Windows Registry Disk Cleanup Handler Persistence via VolumeCaches Key Creation
Detects creation of non-default Disk Cleanup Handler registry entries under VolumeCaches that may establish persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_addMedium141
Free2022-07-21