Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,228 rules
RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)
Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh477Free2022-01-01RPC Firewall Alerts for Remote Scheduled Task Creation/Execution via SASec
Identifies remote scheduled task create/execute RPC calls via SASec using RPC Firewall EventLog RPCFW events.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh234Free2022-01-01RPC Firewall Logs: Remote Encryption Service RPC Call Detected for Lateral Movement
Alerts on RPC Firewall events indicating remote MS-EFSR encryption service RPC activity that may support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh122Free2022-01-01MS-RPCE RPC Firewall blocks MS-SRVS remote server service calls (Interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
Flags RPC firewall EventID 3 targeting the MS-SRVS interface UUID associated with remote server service abuse.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh60Free2022-01-01RPC Firewall Alerts for Remote Registry Recon via MS-RRP (EventID 3)
Alerts on RPC Firewall RRP calls for remote registry information collection on the monitored interface UUID.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh112Free2022-01-01Windows RPC Firewall Registry Modification Calls via MS-RRP OpNums
Alerts on RPC Firewall registry-interface RPC calls (EventID 3) with OpNums tied to remote registry modification.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh93Free2022-01-01RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs
Alerts on RPC Firewall RPC events indicating remote DCOM/WMI interface activity that can support lateral movement.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh3010Free2022-01-01RPC Firewall detects remote printing interface calls (MS-RPRN/MS-PAR) for lateral movement
Alerts on RPC Firewall EventID 3 events for MS-RPRN/MS-PAR remote printing RPC interface UUIDs.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh103Free2022-01-01RPC Firewall: Remote Scheduled Task Recon via ITaskSchedulerService (OpNum 1/3/4/10-15)
Flags RPC calls to ITaskSchedulerService that query scheduled task information using RPC firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh121Free2022-01-01Remote ITaskSchedulerService RPC Create/Execute Scheduled Tasks Used for Lateral Movement
Detects RPC Firewall alerts for remote ITaskSchedulerService calls that create or execute scheduled tasks.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh111Free2022-01-01Remote Event Log Recon via RPCFW EVEN/EVEN6 EventID 3 (RPC interface UUIDs)
Flags RPC Firewall EventID 3 remote calls querying Windows Event Log data over EVEN/EVEN6 interfaces.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh396Free2022-01-01RPC Firewall: Remote MS-EFSR encryption interface calls (EventID 3)
Alerts on RPC Firewall events targeting MS-EFSR interface UUIDs associated with remote encrypting file system abuse.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh151Free2022-01-01RPC Firewall Alerts for MS-DRSR DCSync Operations From Non-DC Hosts
Alerts on MS-DRSR RPC Firewall events where non-standard opcodes target the DRSR interface from non-DC hosts.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh288Free2022-01-01RPC Firewall AtScv Remote Schedule Task Information Recon
Identifies remote AtScv RPC calls that access scheduled task information via RPC Firewall telemetry.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh297Free2022-01-01Windows ATSvc Remote RPC Scheduled Task Creation or Execution (RPC Firewall)
Identifies remote ATSvc RPC calls for scheduled task creation/execution using RPC Firewall EventID 3 and OpNum 0/1.
Sagie Dulce, Dekel Paz, Huntrule TeamRpc_firewallapplicationHigh454Free2022-01-01