Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
768 rules
Windows Backup File Deletion Triggered by CLI or Script Hosts
Alerts when cmd.exe, PowerShell, wt.exe, rundll32.exe, or regsvr32.exe delete files with backup-oriented filename extensions.
frack113, Huntrule TeamWindowsfile_deleteMedium121Free2022-01-02Windows PowerShell ScriptBlock checks for service registry ACL inspection
Flags PowerShell scripts that use Get-ACL to inspect service Registry keys under HKLM\SYSTEM\CurrentControlSet\Services.
frack113, Huntrule TeamWindowsps_scriptMedium161Free2021-12-30Windows PowerShell script sets COR_PROFILER environment variables for .NET CLR profiling
Alerts on PowerShell script blocks that set CLR profiler environment variables (COR_ENABLE_PROFILING/COR_PROFILER/COR_PROFILER_PATH).
frack113, Huntrule TeamWindowsps_scriptMedium152Free2021-12-30PowerShell ScriptBlock Requests Kerberos Tickets via IdentityModel Token Assembly
Alerts on PowerShell ScriptBlock text that builds Kerberos ticket requests using KerberosRequestorSecurityToken and .GetRequest().
frack113, Huntrule TeamWindowsps_scriptHigh132Free2021-12-28PowerShell Script Blocks Register Malicious XLL via Office COM Automation on Windows
Detects PowerShell Script Block content that uses COM automation to call .RegisterXLL for an Office XLL add-in.
frack113, Huntrule TeamWindowsps_scriptHigh414Free2021-12-28Windows PowerShell Local User Account Manipulation via Script Block Logging
Alerts when PowerShell script blocks invoke local user management cmdlets that can be used to maintain persistence.
frack113, Huntrule TeamWindowsps_scriptMedium299Free2021-12-28PowerShell AD Account Creation Library Usage via AccountManagement Namespace on Windows
Alert on PowerShell Script Block content referencing System.DirectoryServices.AccountManagement, indicating potential AD principal manipulation.
frack113, Huntrule TeamWindowsps_scriptMedium311Free2021-12-28PowerShell Scheduled Task Creation via ScriptBlock Logging
Identifies PowerShell script blocks that create and register scheduled tasks using TaskScheduler cmdlets or CIM WMI method calls.
frack113, Huntrule TeamWindowsps_scriptMedium92Free2021-12-28Windows PowerShell Screen Capture via CopyFromScreen
Flags PowerShell scripts containing .CopyFromScreen, indicative of desktop screen capture activity.
frack113, Huntrule TeamWindowsps_scriptMedium101Free2021-12-28Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line
Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2021-12-27Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential
Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.
frack113, Huntrule TeamWindowsps_scriptLow151Free2021-12-27Windows PowerShell Copies a DLL into System32 or SysWOW64
Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptHigh123Free2021-12-27Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo
Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.
frack113, Huntrule TeamWindowsps_scriptLow332Free2021-12-26Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember
Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.
frack113, Huntrule TeamWindowsps_scriptMedium131Free2021-12-26Java keytool Spawns System Shells or Scripting Utilities on Windows
Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.
Andreas Hunkeler (@Karneades), Huntrule TeamWindowsprocess_creationHigh70Free2021-12-22