Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
60 rules
macOS Python Site-Packages .pth File Creation
Alerts on new .pth files created under macOS Python site-packages, a mechanism that can execute code at Python startup.
Andreas Braathen (mnemonic.io), Huntrule TeamMacosfile_eventMedium140Free2024-04-25Linux: Detect Python .pth Path Configuration File Creation in site-packages
Alerts on creation of Python .pth files in /lib/python3.X/site-packages on Linux, which can trigger code at Python startup.
Andreas Braathen (mnemonic.io), Huntrule TeamLinuxfile_eventMedium160Free2024-04-25Windows iexpress.exe Creates Self-Extracting Binaries Using SED Files From Suspicious Paths
Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.
Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh295Free2024-02-05Windows: Alerts on Creation of .sed Self-Extraction Directive File
Flags creation of newly created .sed directive files on Windows, which can be used for self-extracting package abuse.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsfile_executable_detectedMedium341Free2024-02-05Windows Process Creation: IExpress.exe Creating Self-Extracting Packages
Identifies IExpress.exe usage to generate self-extracting packages, including makecab.exe involvement and IExpress command-line patterns.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationMedium240Free2024-02-05Windows Process: winget adds new download source via 'source add' with IP/endpoint
Alerts on winget.exe being used to add a new package download source specified by an IP address.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium150Free2023-04-17Windows Winget adds HTTP package source
Alerts when winget is used to add a package source pointing to an http:// URL.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh180Free2023-04-17Windows: winget.exe adds new download sources via 'source add'
Alerts on winget.exe usage to add new package download sources using 'source add'.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium160Free2023-04-17Linux Package Removal via yum, apt, dpkg, or rpm Commands
Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.
Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow3310Free2023-03-09Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation
Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium487Free2023-01-31Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation
Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium163Free2023-01-31Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate
Alerts when AppX package execution/signature subject matches a known suspicious certificate in Windows telemetry.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsappxpackaging-omMedium192Free2023-01-16Windows AppX Deployment: Uncommon Appx Path Added to Deployment Pipeline
Alerts when an AppX package is queued for processing from uncommon paths or URLs in Windows AppX deployment server events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsappxdeployment-serverMedium121Free2023-01-11Windows AppX Deployment Blocked by Local Policy
Detects blocked AppX package deployments on Windows via AppXDeployment-Server policy-denial Event IDs.
frack113, Huntrule TeamWindowsappxdeployment-serverMedium193Free2023-01-11Windows AppX Package Deployment: Suspicious AppX Installation Attempts by PackageFullName
Alerts on Windows AppX deployment events tied to a known-malicious AppX package identifier.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsappxdeployment-serverMedium192Free2023-01-11