Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments
Flags SOAPHound execution on Windows by detecting command-line arguments used for Active Directory data collection.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh389Free2024-01-26Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries
Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.
"@kostastsale, Huntrule Team"Windowsnetwork_connectionMedium111Free2024-01-26Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes
Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.
Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh242Free2024-01-26Windows: Detect MODE.COM Changing Code Page Settings
Detects MODE.COM executions that include code page selection parameters.
Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationLow110Free2024-01-19Windows Code Page Change via mode.com Selecting Russian Code Pages
Alerts when mode.com is used to set console code pages to Russian values (1251 or 866).
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamWindowsprocess_creationMedium262Free2024-01-17Proxy HTTP GET to /api/Core/Command Init/Restart indicative of possible C2
Flags proxy HTTP GET requests to C2-like command initialization/restart endpoints based on URI suffixes.
X__Junior (Nextron Systems), Huntrule Team—proxyMedium389Free2024-01-15Windows process creation matching specific Peach Sandstorm command-line indicator
Alerts on Windows process creations whose command line contains a specific suspicious substring.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh191Free2024-01-15GCP Google Workspace: Application ContextAwareAccess Setting Changed
Alerts on Google Workspace application setting changes affecting ContextAwareAccess access levels.
Bryan Lim, Huntrule TeamGcpgoogle_workspace.adminMedium162Free2024-01-12GCP Audit: Break-glass Keyword on Kubernetes Pod Create Overrides Binary Authorization
Flags GKE pod creation events where break-glass bypasses Binary Authorization image policy.
Bryan Lim, Huntrule TeamGcpgcp.auditMedium272Free2024-01-12GCP Audit Logs: Access Context Manager Access Policy Deletion
Flags GCP Access Context Manager audit events where granted access policy delete permissions occur.
Bryan Lim, Huntrule TeamGcpgcp.auditMedium418Free2024-01-12Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Flags Windows processes that look like renamed PingCastle executables using PE original file names and PingCastle scanner/healthcheck arguments.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh319Free2024-01-11Windows PingCastle Execution From Suspicious Parent Processes
Alerts on PingCastle (PingCastle.exe) being run with full scan/healthcheck arguments from potentially suspicious parent process locations.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh221Free2024-01-11Windows Process Creation: PingCastle Execution with Full Healthcheck Scanners
Alerts on Windows execution of PingCastle with full healthcheck and AD/security scanner command-line options.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationMedium192Free2024-01-11Windows .cpl Image Loads from Uncommon Paths Indicating Control Panel Abuse
Alerts on Windows loading of .cpl control panel items from uncommon paths instead of standard system directories.
Anish Bogati, Huntrule TeamWindowsimage_loadHigh344Free2024-01-09Windows WFP 5157: Connection Blocked for EDR Agent Binaries
Flags WFP blocked connections (EventID 5157) when an EDR/security agent binary is the blocked application.
"@gott_cyber, Huntrule Team"WindowssecurityHigh293Free2024-01-08