Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts
Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.
kelnage, Huntrule TeamKubernetesauditLow582Free2024-04-12Linux sshd Spawns Root Shell Script Commands Suggesting CVE-2024-3094 Exploitation
Alerts on sshd spawning bash/sh one-liners as root, a potential indicator of CVE-2024-3094 style exploitation.
Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke, Huntrule TeamLinuxprocess_creationHigh253Free2024-04-01Azure AD Audit: Trusted Root CA Added for Passwordless Certificate Authentication
Alerts on Azure AD changes that add a new trusted root CA for passwordless certificate-based authentication.
Harjot Shah Singh, '@cyb3rjy0t', Huntrule TeamAzureauditlogsMedium251Free2024-03-26Azure AD Audit Logs: Certificate-based authentication enabled via AuthenticationMethodsPolicy update
Flags Azure AD audit log events where the Authentication Methods policy is updated to enable certificate-based authentication.
Harjot Shah Singh, '@cyb3rjy0t', Huntrule TeamAzureauditlogsMedium346Free2024-03-26Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments
Detects PATCH operations against Kubernetes Deployments that may indicate sidecar-style container injection.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium322Free2024-03-26Kubernetes Service Account Created via Audit Log
Alerts on Kubernetes audit events showing new ServiceAccounts created.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow501Free2024-03-26Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)
Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow173Free2024-03-26Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt
Alerts on Kubernetes selfsubjectrulesreviews API calls that enumerate the caller’s RBAC permissions.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow152Free2024-03-26Kubernetes Privileged Pod Created via Pod Creation Requests
Flags Kubernetes pod creates where container capabilities are set to all, indicating possible privileged access setup.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow474Free2024-03-26Kubernetes Audit: Pod Creation in kube-system Namespace
Flags Kubernetes audit events creating pods in the kube-system namespace, a common place to camouflage malicious workloads.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium493Free2024-03-26Kubernetes Pod Created With hostPath Volume Mount
Alerts on Kubernetes pod creation requests that include a hostPath volume mount.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow256Free2024-03-26Kubernetes Pod exec via API creates exec subresource requests
Detects Pod container exec session creation in Kubernetes audit logs, which can enable remote command execution.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium182Free2024-03-26Kubernetes Audit: Deleted Events
Identifies Kubernetes audit log entries where the events resource is deleted via the delete verb.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationMedium4410Free2024-03-26Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow153Free2024-03-26Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows
Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.
Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule TeamWindowsregistry_setHigh322Free2024-03-22