Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow332Free2024-03-11Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files
Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh395Free2024-03-11macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow164Free2024-03-11TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow3610Free2024-03-11OpenCanary VNC Connection Attempt Observed
Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh299Free2024-03-08OpenCanary TFTP Service Receives a Request
Alerts on OpenCanary logs showing a recorded request to the TFTP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh437Free2024-03-08OpenCanary Telnet Login Attempt Recorded in Application Logs
Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh162Free2024-03-08OpenCanary application logs: SSH new connection attempt on monitored node
Alerts when OpenCanary records a new SSH connection attempt to a monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh101Free2024-03-08OpenCanary Application Logs: SSH Login Attempt on Monitoring Node
Alerts on recorded SSH login attempts from OpenCanary application logs (logtype 4002).
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh123Free2024-03-08OpenCanary SNMP OID Requests Observed on Node
Alerts when OpenCanary records an SNMP OID request to its SNMP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh132Free2024-03-08OpenCanary SMB service records file open requests
Triggers when OpenCanary logs an SMB file open request to its monitored host.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh259Free2024-03-08OpenCanary SIP Request on Honeypot Node
Alerts on OpenCanary logs showing SIP request activity on a configured SIP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh131Free2024-03-08OpenCanary Redis Action Command Attempt
Alerts when OpenCanary reports an attempted action command against its Redis service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh428Free2024-03-08OpenCanary NTP Monlist Request Observed
Alerts when an OpenCanary node’s NTP service logs an NTP monlist request.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh133Free2024-03-08OpenCanary MySQL Service: Login Attempt Recorded
Flags OpenCanary events indicating a MySQL service login attempt on the monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh81Free2024-03-08