Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,188 rules
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Flags Zeek DCE/RPC calls with operation names starting "efs" that may indicate suspicious EFS RPC usage.
"@neu5ron, @Antonlovesdnb, Mike Remen, Huntrule Team"Zeekdce_rpcMedium101Free2021-08-17Windows Procdump Process Execution
Alerts on execution of Sysinternals Procdump (32/64 variants) based on process creation image path.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium462Free2021-08-16Google Cloud VPN Tunnel Insert or Delete via Audit Logs
Alerts on Google Cloud audit events showing VPN tunnel insertion or deletion.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium121Free2021-08-16Azure Activity Logs: Alert Suppression Rule Write Operations
Flags when an Azure alert suppression rule is created via the security alerts suppression write operation.
Austin Songer, Huntrule TeamAzureactivitylogsMedium387Free2021-08-16Azure Key Vault secret modified or deleted activity
Flags Azure Key Vault secret write, update, delete, purge, and restore operations in Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium466Free2021-08-16Azure Key Vault Modified or Deleted via Activity Log Operations
Alerts on Azure Activity Log Key Vault management operations: write, delete, deploy actions, or access policy changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium132Free2021-08-16Azure Key Vault Key Modified or Deleted via Activity Log Operations
Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium113Free2021-08-16Azure Application Security Group Modified or Deleted via Activity Log Write/Delete
Flags Azure Activity Log events showing Application Security Group write (modify) or delete operations.
Austin Songer, Huntrule TeamAzureactivitylogsMedium163Free2021-08-16Azure Application Gateway Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that modify or delete Application Gateway resources.
Austin Songer, Huntrule TeamAzureactivitylogsMedium262Free2021-08-16AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.
Austin Songer, Huntrule TeamAwscloudtrailLow356Free2021-08-16Antivirus alerts on known hacktool and attack tool signatures
Alerts on Antivirus detections matching hacktool signature prefixes or offensive tool names for investigation.
Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team—antivirusHigh133Free2021-08-16Windows: SQLCmd used to dump database metadata and backups
Alerts on Windows executions of sqlcmd.exe with local server targeting and database enumeration/backup query fragments.
frack113, Huntrule TeamWindowsprocess_creationHigh453Free2021-08-16Webserver GET requests containing XSS-related payload strings
Finds likely XSS injection attempts in webserver GET requests by matching script, tag, and JS payload strings while excluding 404s.
Saw Win Naung, Nasreddine Bencherchali, Huntrule TeamWebwebserverHigh358Free2021-08-15Zeek DNS queries matching Tor proxy and hidden service domains
Alerts on Zeek DNS queries for Tor proxy and onion domain indicators tied to possible anonymized activity.
Saw Winn Naung , Azure-Sentinel, Huntrule TeamZeekdnsMedium142Free2021-08-15Google Cloud Audit: DNS Managed Zone Modified or Deleted
Flags Google Cloud DNS Managed Zone delete, update, and patch events from audit logs.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium3910Free2021-08-15