Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Windows Utility Loads Unsigned DLL (ImageLoad)
Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsimage_loadMedium133Free2024-02-28Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe
Alert on ScreenConnect.Service.exe spawning cmd.exe or csc.exe, consistent with potential web shell execution on Windows.
Jason Rathbun (Blackpoint Cyber), Huntrule TeamWindowsprocess_creationHigh81Free2024-02-26Windows DNS Queries to update.onelaunch.com by OneLaunch.exe
Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.
Josh Nickels, Huntrule TeamWindowsdns_queryLow132Free2024-02-26AWS CloudTrail GetSigninToken Requests with Suspected Console User-Agent
Flags CloudTrail GetSigninToken sign-in token requests with non-matching console user-agent patterns.
Chester Le Bron (@123Le_Bron), Huntrule TeamAwscloudtrailMedium3710Free2024-02-26Bitbucket Audit: User Permission Details Export Attempts
Flags Bitbucket user details export attempts in audit logs, including start, success, and failure.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium153Free2024-02-25Bitbucket Audit: SSH User Login Failures
Alerts on Bitbucket audit records showing SSH-based user login failures in authentication events.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium275Free2024-02-25Bitbucket audit: User login failed authentication events
Flags Bitbucket audit events for user login failures in the authentication category.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium141Free2024-02-25Bitbucket Audit: User Permissions Export Attempt Detection
Alerts on Bitbucket audit events indicating user permissions export activity (started, exported, or failed).
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium152Free2024-02-25Bitbucket Audit: Unauthorized Full Data Export Triggered (Data Pipeline)
Flags Bitbucket audit events indicating an unauthorized user attempted a full data export.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditCritical3610Free2024-02-25Bitbucket Audit: Unauthorized Access to a Resource
Flags Bitbucket audit events reporting unauthorized access attempts to a resource.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditCritical142Free2024-02-25Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository
Flags Bitbucket audit events indicating secret scanning rules were deleted at the project or repository level.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow173Free2024-02-25Bitbucket Audit: Secret Scanning Exempt Repository Added
Flags Bitbucket audit events where a repository is added as exempt from secret scanning.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditHigh214Free2024-02-25Bitbucket audit: Project secret scanning allowlist rule added
Alerts when Bitbucket records a project secret scanning allowlist rule being added via the audit log.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow427Free2024-02-25Bitbucket Audit Service: Audit Log Configuration Updated
Flags Bitbucket audit log configuration change events that may indicate attempts to impair logging.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium3610Free2024-02-25Bitbucket Audit: Global SSH Settings Changed
Alerts on Bitbucket global SSH settings changes from audit logs under the Global administration category.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium345Free2024-02-25