Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,262 rules
Windows wmic.exe Used to Start or Stop Services
Alerts on wmic.exe command lines invoking startservice or stopservice via service calls.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium112Free2022-06-20Windows WMIC Process Creation Recon for Unquoted Service Paths
Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium161Free2022-06-20Windows Hotfix Inventory Recon via wmic.exe qfe
Detects wmic.exe executions with "qfe" used to enumerate installed Windows hotfixes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium147Free2022-06-20Windows CLI Enumeration of 3rd-Party Credential Registry Keys
Alerts when Windows processes use command-line queries to enumerate credential-containing third-party registry keys.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium459Free2022-06-20Windows Dsacls.EXE Password Spraying Check via /user and /passwd
Flags dsacls.exe executions that specify both /user: and /passwd:, consistent with password spraying attempts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium1810Free2022-06-20Windows: dsacls.exe used to grant potentially over-permissive access rights
Alerts on dsacls.exe commands using /G to grant wide or permissive ACL permissions.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium152Free2022-06-20PowerShell WMI Service Enumeration for Unquoted Service Path Recon
Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium82Free2022-06-20Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns
Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh348Free2022-06-20Linux sudoers file access via text-based utilities (cat/grep/head/etc.)
Alerts on Linux process executions that use common text tools to access /etc/sudoers content.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium224Free2022-06-20Linux Process Command-Line Printing of Shell History Files
Alerts when Linux commands print or page shell history files via the command line for recon.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium163Free2022-06-20Linux Shell History File Deletion via rm/unlink/shred
Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh151Free2022-06-20Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider
Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.
frack113, Huntrule TeamWindowsregistry_setHigh132Free2022-06-19Windows: Chromium-Based Browser Launched via Script Host with --load-extension
Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.
Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh100Free2022-06-19Windows Chromium-Based Browser Launched With --load-extension Flag
Alerts when a Chromium-based browser starts with --load-extension= to load a custom extension.
Aedan Russell, frack113, X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2022-06-19Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)
Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsfile_eventHigh193Free2022-06-19