Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: Weekly Scheduled Task Creation for "shutdown /l /f" via schtasks.exe
Flags schtasks.exe creating a weekly scheduled task that runs "shutdown /l /f" on Windows.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium151Free2024-03-22Windows: Word LNK via cmd.exe Start Menu shortcut leading to .doc execution
Flags cmd.exe command lines that invoke a Word Start Menu .lnk to launch a .doc.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium212Free2024-03-22Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh211Free2024-03-20Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow182Free2024-03-19Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName
Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh193Free2024-03-11Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow412Free2024-03-11Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files
Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh525Free2024-03-11macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow204Free2024-03-11TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow4310Free2024-03-11OpenCanary VNC Connection Attempt Observed
Alerts when OpenCanary records a VNC service connection attempt on an instrumented node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh429Free2024-03-08OpenCanary TFTP Service Receives a Request
Alerts on OpenCanary logs showing a recorded request to the TFTP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh507Free2024-03-08OpenCanary Telnet Login Attempt Recorded in Application Logs
Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh292Free2024-03-08OpenCanary application logs: SSH new connection attempt on monitored node
Alerts when OpenCanary records a new SSH connection attempt to a monitored node.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh261Free2024-03-08OpenCanary Application Logs: SSH Login Attempt on Monitoring Node
Alerts on recorded SSH login attempts from OpenCanary application logs (logtype 4002).
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh323Free2024-03-08OpenCanary SNMP OID Requests Observed on Node
Alerts when OpenCanary records an SNMP OID request to its SNMP service.
Security Onion Solutions, Huntrule TeamOpencanaryapplicationHigh202Free2024-03-08