Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository
Flags Bitbucket audit events indicating secret scanning rules were deleted at the project or repository level.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow173Free2024-02-25Bitbucket Audit: Secret Scanning Exempt Repository Added
Flags Bitbucket audit events where a repository is added as exempt from secret scanning.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditHigh254Free2024-02-25Bitbucket audit: Project secret scanning allowlist rule added
Alerts when Bitbucket records a project secret scanning allowlist rule being added via the audit log.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow457Free2024-02-25Bitbucket Audit Service: Audit Log Configuration Updated
Flags Bitbucket audit log configuration change events that may indicate attempts to impair logging.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium4810Free2024-02-25Bitbucket Audit: Global SSH Settings Changed
Alerts on Bitbucket global SSH settings changes from audit logs under the Global administration category.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium395Free2024-02-25Bitbucket Global Secret Scanning Rule Deleted (Audit Logs)
Alerts on Bitbucket audit events indicating a global secret scanning rule was deleted.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium242Free2024-02-25Bitbucket Audit: Global Permission Add/Remove/Request Events
Alerts on Bitbucket audit events indicating global permission changes being requested, granted, or removed.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditMedium466Free2024-02-25Bitbucket Audit: Full Data Export Triggered
Alerts when Bitbucket audit logging records a full data export being triggered.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditHigh181Free2024-02-25Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths
Flags wget.exe on Windows downloading from an IP over HTTP and saving to common staging/user directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh132Free2024-02-23Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember
Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh101Free2024-02-23Windows SimpleService Execution via Remote Access Tool Wrapper Paths
Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium252Free2024-02-23Suspicious File Downloads via PowerShell.EXE from File Sharing Domains on Windows
Flags PowerShell downloading content from known file-sharing/paste domains using DownloadString/DownloadFile or web request syntax.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh171Free2024-02-23Windows Process Execution from ScreenConnect.ClientService.exe
Alerts on Windows process creation spawned by ScreenConnect.ClientService.exe, indicating potential remote command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium90Free2024-02-23Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation
Alerts on Windows file activity writing known SlashAndGrab-related ScreenConnect artifact paths and executables.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh233Free2024-02-23Windows: ScreenConnect local user database XML modified
Flags Windows file modifications by ScreenConnect.Service.exe to a Temp/ScreenConnect XML user database file.
Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress, Huntrule TeamWindowsfile_eventMedium248Free2024-02-21