Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

49 rules

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
Alerts on AppLocker event IDs showing blocked execution of apps, scripts, DLLs, MSI, or packaged apps.
Pushkarev Dmitry, Huntrule TeamWindowsapplockerMedium371
Free2020-06-28
Windows processes accessing microphone and webcam via CapabilityAccessManager ConsentStore
Identifies Windows processes interacting with non-packaged app consent entries for microphone and webcam access.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowssecurityMedium121
Free2020-06-07
Windows: DXCap.exe Used with -c to Launch Arbitrary Binaries
Flags Windows executions of DXCap.EXE using -c, a pattern that can launch arbitrary binaries or packages.
Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium82
Free2019-10-26
Windows Registry: New Security Support Provider (SSP) added to LSA configuration
Alerts when a new SSP is added to LSA Security Packages in the Windows registry, excluding msiexec-driven changes.
iwillkeepwatch, Huntrule TeamWindowsregistry_eventHigh122
Free2019-01-18