Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

49 rules

Windows: Xwizard.exe Execution from Non-Default Directory
Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.
Christian Burkard (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh455
Free2021-09-20
Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe
Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.
NVISO, Huntrule TeamWindowsimage_loadHigh72
Free2020-05-04
Windows process creation: svchost.exe launched by sllauncher.exe for DLL side-loading
Flags AppData\Roaming-launched svchost.exe instances spawned by sllauncher.exe with -k, matching DLL side-loading execution behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical113
Free2018-09-03
Windows Process Creation: Suspicious Execution of PlugX DLL Side-Loading Utilities from Uncommon Paths
Alerts on execution of PlugX-related helper binaries from atypical paths, excluding common legitimate directories.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh151
Free2017-06-12