Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Windows PowerShell Script File Creation: SysAidServer Webapp User/User.exe Indicators
Detects creation of specific SysAidServer Tomcat webapp files indicative of PowerShell script staging on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh334Free2023-11-09F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution
Alerts on webserver POST requests to the BIG-IP iControl REST bash execution endpoint (/mgmt/tm/util/bash).
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule TeamWebwebserverMedium217Free2023-11-08F5 BIG-IP iControl REST API Bash Endpoint Command Execution via Proxy POST
Alerts on POST requests to the BIG-IP iControl REST /mgmt/tm/util/bash endpoint that can execute shell commands.
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule TeamWebproxyMedium92Free2023-11-08F5 BIG-IP Webserver RCE exploitation attempts via POST to /mgmt/tm/util/bash
Alerts on POST requests to /mgmt/tm/util/bash containing tmui Control/form parameters consistent with CVE-2023-46747 exploitation attempts.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh439Free2023-11-08F5 BIG-IP Proxy: Detect POST requests exploiting CVE-2023-46747 via /mgmt/tm/util/bash
Alerts on POST requests containing /mgmt/tm/util/bash plus TMUI control/user-create form parameters indicative of CVE-2023-46747 exploitation.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—proxyHigh112Free2023-11-08Windows Registry: Disabling Antivirus Filter Driver on Dev Drive via FltmgrDevDriveAllowAntivirusFilter
Detects registry changes disabling antivirus minifilter inspection on a Dev Drive by setting the allow setting to 0x0.
"@kostastsale, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"Windowsregistry_setHigh333Free2023-11-05Windows Registry: AllowAnonymousCallback Enabled for Anonymous Remote Connection
Alerts on setting AllowAnonymousCallback to 0x00000001 in the CIMOM key, enabling anonymous remote connections.
X__Junior (Nextron Systems), Huntrule TeamWindowsregistry_setMedium102Free2023-11-03Windows image load and execution of unsigned Thor scanner (thor.exe/thor64.exe)
Alerts on thor.exe/thor64.exe image loads on Windows where the Authenticode signature is missing or not from Nextron Systems.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh459Free2023-10-29AWS S3 Bucket Versioning Disabled via PutBucketVersioning (CloudTrail)
Alerts on CloudTrail PutBucketVersioning requests that suspend S3 bucket versioning.
Sean Johnstone | Unit 42, Huntrule TeamAwscloudtrailMedium131Free2023-10-28Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries
Alerts when rundll32.exe spawns specific Windows binaries in patterns consistent with potential process hollowing.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsprocess_creationHigh3610Free2023-10-27Windows Process Creation Signals for Pikabot System Discovery
Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsprocess_creationHigh163Free2023-10-27Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service
Alerts on Windows process command lines consistent with installing VS Code tunnel (code-tunnel) as a service.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium103Free2023-10-25Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell
Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium111Free2023-10-25Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution
Flags cmd.exe-launched Visual Studio Code tunnel processes with expected tunnel and license-accept arguments on Windows.
Nasreddine Bencherchali (Nextron Systems), citron_ninja, Huntrule TeamWindowsprocess_creationMedium60Free2023-10-25Windows file creation of code_tunnel.json outside Code/VsCode executables
Alerts on creation of code_tunnel.json on Windows when it isn’t created by typical VS Code binaries.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh141Free2023-10-25