Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
6,105 rules
Windows Registry: Windows Defender Exclusions Key Modified via ObjectName Match
Alerts on registry value changes under the Windows Defender Exclusions key in Windows Security event 4657.
"@BarryShooshooga, Huntrule Team"WindowssecurityMedium162Free2019-10-26Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification
Alerts on registry modifications to Wow6432Node NT CurrentVersion autorun-related keys tied to persistence behavior.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium121Free2019-10-25Windows Registry: Wow6432Node Classes Autorun/ASEP Key Modification via ShellEx/CLSID Paths
Alerts on registry writes to Wow6432Node Classes ASEP-related ShellEx/CLSID key paths commonly used for persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium319Free2019-10-25Windows Registry: Wow6432Node CurrentVersion Autorun Key Modification
Flags registry writes to Wow6432Node\...\CurrentVersion autostart and Explorer persistence locations, excluding common benign installer activity.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium92Free2019-10-25Windows Registry WinSock2 Autostart Extensibility Point Modification
Flags registry modifications to WinSock2 Parameters catalog entries consistent with persistence via ASEP.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium385Free2019-10-25Windows Registry Autostart Script Keys Modification via System Scripts Policies
Detects Registry writes to System Scripts policy ASEP subkeys for Startup/Shutdown/Logon/Logoff on Windows.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium81Free2019-10-25Windows Registry Session Manager ASEP Modification via Auto-Start Extensibility Points
Flags registry modifications to Session Manager autostart extensibility points under CurrentControlSet\Control\Session Manager.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium133Free2019-10-25Windows Registry Modification of Internet Explorer Autostart Extension Keys (ASEP)
Flags Windows registry changes to Internet Explorer ASEP extension/toolbar keys associated with persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium112Free2019-10-25Windows Registry: Modification of Windows NT CurrentVersion Autostart Extensibility Points
Alerts on Windows registry changes to Winlogon/ASEP-related keys under Windows NT CurrentVersion that may enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium265Free2019-10-25Windows Registry CurrentVersion Autostart/Run Key Modification Monitoring
Alerts on registry writes to Windows CurrentVersion autostart and Run/RunOnce persistence keys, excluding known benign patterns.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium52Free2019-10-25Windows Registry CurrentControlSet Control Autorun/ASEP Key Modification
Alerts on Registry changes to Windows ASEP-related keys under CurrentControlSet\Control that can enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium256Free2019-10-25Windows Registry Autorun/ASEP Key Modification for Persistence
Alerts on registry modifications to common Windows autorun and persistence extensibility keys indicative of auto-start behavior.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name), Huntrule TeamWindowsregistry_setMedium266Free2019-10-25Windows Registry Classes Autorun Key Modification for Persistence
Alerts on registry changes under Windows Classes shell extension/ASEP paths that may enable persistence.
Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), Huntrule TeamWindowsregistry_setMedium82Free2019-10-25Windows Registry: AppCertDlls NewName/TargetObject Creation for DLL Load Persistence
Alerts on Windows registry changes involving AppCertDlls paths that can enable malicious DLL loading for persistence.
Ilyas Ochkov, oscd.community, Huntrule TeamWindowsregistry_eventMedium73Free2019-10-25Windows Registry: Add-on DelegateExecute persistence via Narrator Feedback-Hub AppX key
Flags registry value deletions on a Narrator Feedback-Hub AppX DelegateExecute path used for persistence.
Dmitriy Lifanov, oscd.community, Huntrule TeamWindowsregistry_eventHigh41Free2019-10-25