Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js
Alerts on Windows creation of router/tanstack runner and router_runtime files used in a TanStack supply-chain attack pattern.
Leonardo Gasparini, Huntrule TeamWindowsfile_eventMedium182Free2026-05-12Linux File Creation Indicators for TanStack Runner and Persistence Components
Alerts on creation of TanStack-style runner/persistence filenames on Linux, including .claude/.vscode router_runtime.js and /tmp/transformers.pyz.
Leonardo Gasparini, Huntrule TeamLinuxfile_eventMedium173Free2026-05-12Windows DNS Queries to git-tanstack.com and filev2.getsession.org
Alert on Windows DNS lookups of git-tanstack.com and filev2.getsession.org tied to supply-chain C2/exfil.
Leonardo Gasparini, Huntrule TeamWindowsdns_queryMedium143Free2026-05-12Linux: Detect modprobe-based authencesn crypto module auto-load via kmod
Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".
Gene Kazimiarovich, Huntrule TeamLinuxprocess_creationHigh123Free2026-05-09WSL InstallLocation Registry Key Modification on Windows
Alerts on suspicious registry modifications to the WSL InstallLocation key while excluding known legitimate MSI/WSL locations.
Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_setMedium90Free2026-05-05Windows Process Creation: Masqueraded wsl.exe Execution
Flags process launches masquerading as wsl.exe by matching Image path suffix while excluding legitimate OriginalFileName values.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh50Free2026-05-05Windows Process Creation: Suspicious reg.exe or PowerShell Editing of WSL InstallLocation Registry
Flags reg.exe or PowerShell command lines editing the WSL InstallLocation registry value under Lxss MSI.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh120Free2026-05-05Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths
Alert on System32 wsl.exe spawning a wsl.exe child process when the child path isn’t in known legitimate WSL locations.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh110Free2026-05-05Windows File Event: Possible Modification of wsl.exe from Installed Location
Alerts on attempts to modify wsl.exe in installed WSL/WindowsApps locations, indicating potential binary replacement for proxy execution.
Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsfile_eventMedium130Free2026-05-05Webserver Alerts for libredtail-http User-Agent HTTP Requests
Alerts on web requests carrying the "libredtail-http" User-Agent, indicating likely automated malicious probing.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team—webserverMedium201Free2026-04-30Linux auditd: Detect AF_ALG socket() syscall (address family 38) for crypto API abuse
Flags AF_ALG (38) socket() creations from Linux auditd while filtering common legitimate crypt/VPN tools.
Gene Kazimiarovich, Huntrule TeamLinuxauditdHigh153Free2026-04-30Windows Print.EXE Sensitive File Dump for Credential Access
Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.
Ayush Anand (Securityinbits), Huntrule TeamWindowsprocess_creationHigh181Free2026-04-28Cisco Network Device 802.1X (dot1x) Disabled via port-control Force-Authorized
Alerts on Cisco configuration changes that disable 802.1X on a port (force-authorized or no dot1x port-control).
Luc Génaux, Huntrule TeamCiscoaaaMedium745Free2026-04-28GCP Google Workspace: Alert on Suspicious Login Classifications
Alerts on Google Workspace login audit events classified by Google as suspicious, including less secure app and programmatic login types.
Tom Kluter, Huntrule TeamGcpgoogle_workspace.loginMedium233Free2026-04-28Google Workspace login activity: Out-of-domain email forwarding
Flags Google Workspace out-of-domain email forwarding events from audit logs on login.googleapis.com.
Tom kluter, Huntrule TeamGcpgoogle_workspace.loginMedium112Free2026-04-28