Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)
Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow103Free2024-03-26Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt
Alerts on Kubernetes selfsubjectrulesreviews API calls that enumerate the caller’s RBAC permissions.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow112Free2024-03-26Kubernetes Privileged Pod Created via Pod Creation Requests
Flags Kubernetes pod creates where container capabilities are set to all, indicating possible privileged access setup.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow354Free2024-03-26Kubernetes Audit: Pod Creation in kube-system Namespace
Flags Kubernetes audit events creating pods in the kube-system namespace, a common place to camouflage malicious workloads.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium433Free2024-03-26Kubernetes Pod Created With hostPath Volume Mount
Alerts on Kubernetes pod creation requests that include a hostPath volume mount.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow186Free2024-03-26Kubernetes Pod exec via API creates exec subresource requests
Detects Pod container exec session creation in Kubernetes audit logs, which can enable remote command execution.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium172Free2024-03-26Kubernetes Audit: Deleted Events
Identifies Kubernetes audit log entries where the events resource is deleted via the delete verb.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium3710Free2024-03-26Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow113Free2024-03-26Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows
Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.
Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule TeamWindowsregistry_setHigh262Free2024-03-22Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe
Flags schtasks.exe creating a weekly scheduled task that runs "shutdown /l /f" on Windows.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium81Free2024-03-22Windows: Word LNK via cmd.exe Start Menu shortcut leading to .doc execution
Flags cmd.exe command lines that invoke a Word Start Menu .lnk to launch a .doc.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium142Free2024-03-22Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh151Free2024-03-20Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow142Free2024-03-19Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh133Free2024-03-11Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow332Free2024-03-11