Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,158 rules
macOS Security Software Discovery via grep of Known Security Software Names
Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium316Free2020-10-19macOS Process Creation: grep 'password' or laZagne Credential Extraction
Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh121Free2020-10-19macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational163Free2020-10-19macOS: Disable Security Tools via launchctl unload or spctl disable
Detects macOS attempts to impair security by unloading known security agent plists via launchctl or disabling Gatekeeper with spctl.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium111Free2020-10-19macOS Keychain Credential Dump via security find-certificate/export and dump-keychain
Alerts on /usr/bin/security usage indicative of Keychain export/dump activity on macOS.
Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems), Huntrule TeamMacosprocess_creationMedium132Free2020-10-19macOS process using touch to modify file timestamps and hide file changes
Flags on macOS touch indicating file timestamp attribute changes for stealthy file activity.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium253Free2020-10-19macOS Process Execution: dd and truncate used for binary padding
Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh71Free2020-10-19macOS Base64 Utility Decoding Command Activity
Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow143Free2020-10-19Linux System Network Connections Discovery via who, w, last, lsof, or netstat
Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow81Free2020-10-19Linux process discovery via grep/egrep searching for security software strings
Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow102Free2020-10-19Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed
Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.
Daniil Yugoslavskiy, oscd.community, CheraghiMilad, Huntrule TeamLinuxprocess_creationInformational90Free2020-10-19Linux Base64 Utility Decoding with -d/--decode in Process Creation
Identifies Linux base64 decoding activity using base64 with the -d/--decode flag.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamLinuxprocess_creationLow263Free2020-10-19Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r
Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.
Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated), Huntrule TeamWindowsprocess_creationLow113Free2020-10-18Windows Process Execution and DLL Injection via Tracker.exe
Alerts on Tracker.exe executions with /d and /c command-line switches, excluding matching MSBuild child process patterns.
Avneet Singh @v3t0_, oscd.community, Huntrule TeamWindowsprocess_creationMedium142Free2020-10-18Windows: msdeploy.exe Execution with sync and RunCommand Parameters
Flags msdeploy.exe executions that include sync verb plus RunCommand source and destination parameters.
Beyu Denis, oscd.community, Huntrule TeamWindowsprocess_creationMedium91Free2020-10-18