Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
146 rules
Windows WMI StdRegProv Registry Enumeration via wmic.exe
Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium432Free2025-07-30Windows Process Information Discovery via Registry Queries (reg.exe/powershell)
Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.
lazarg, Huntrule TeamWindowsprocess_creationLow111Free2025-06-12Linux sysinfo Syscall for System Information Discovery
Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.
Milad Cheraghi, Huntrule TeamLinuxauditdLow213Free2025-05-30Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties
Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.
frack113, Huntrule TeamWindowsps_scriptMedium299Free2025-03-05Windows: Notepad Password File Discovery via Process Creation
Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.
The DFIR Report, Huntrule TeamWindowsprocess_creationLow122Free2025-02-21MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium329Free2024-05-27Windows WMI Disk and Volume Discovery via WMIC.exe
Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.
Stephen Lincoln '@slincoln-aiq' (AttackIQ), Huntrule TeamWindowsprocess_creationMedium454Free2024-02-02Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries
Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.
"@kostastsale, Huntrule Team"Windowsnetwork_connectionMedium111Free2024-01-26macOS Process Execution of system_profiler for System Discovery via Specific Data Types
Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.
Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule TeamMacosprocess_creationMedium444Free2024-01-02macOS System Information Discovery via sw_vers with product/build flags
Detects sw_vers executions on macOS that request product name/version or build version details.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium133Free2023-12-20macOS Process Discovery via ioreg I/O Kit Registry Queries
Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium162Free2023-12-20Windows WMIC System Information Discovery via WMI Command-Line Queries
Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationLow120Free2023-12-19Windows Process Creation Signals for Pikabot System Discovery
Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsprocess_creationHigh203Free2023-10-27Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium172Free2023-09-04Linux Process Execution of esxcli VM Listing Commands
Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium123Free2023-09-04