Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation Signals for Pikabot System Discovery
Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsprocess_creationHigh243Free2023-10-27Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service
Alerts on Windows process command lines consistent with installing VS Code tunnel (code-tunnel) as a service.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium153Free2023-10-25Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell
Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium131Free2023-10-25Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution
Flags cmd.exe-launched Visual Studio Code tunnel processes with expected tunnel and license-accept arguments on Windows.
Nasreddine Bencherchali (Nextron Systems), citron_ninja, Huntrule TeamWindowsprocess_creationMedium160Free2023-10-25Windows file creation of code_tunnel.json outside Code/VsCode executables
Alerts on creation of code_tunnel.json on Windows when it isn’t created by typical VS Code binaries.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh191Free2023-10-25Windows File Creation by VS Code Tunnel node.exe in .vscode-server History
Alerts on node.exe creating files under .vscode-server User History when the process runs from a VS Code server tunnel path.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium252Free2023-10-25Windows DNS Queries to Visual Studio Code Tunnel Domains
Alerts on Windows DNS queries to .tunnels.api.visualstudio.com, matching Visual Studio Code tunnel endpoints.
citron_ninja, Huntrule TeamWindowsdns_queryMedium219Free2023-10-25Windows DNS Queries to Devtunnels .devtunnels.ms Domains
Alerts on Windows DNS queries for .devtunnels.ms domains, which may indicate DevTunnels-based C2 or persistence.
citron_ninja, Huntrule TeamWindowsdns_queryMedium152Free2023-10-25Okta New User Created via user.lifecycle.create Event
Flags Okta events indicating new user account creation via user.lifecycle.create.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamOktaoktaInformational210Free2023-10-25Okta admin function access via proxy (requestUri contains admin and isProxy enabled)
Flags Okta requests targeting admin URIs when the event indicates the traffic is proxied.
Muhammad Faisal @faisalusuf, Huntrule TeamOktaoktaMedium505Free2023-10-25Windows: Detect creation of code_tunnel.json indicating VS Code tunneling utility use
Alerts on Windows file creation of code_tunnel.json, indicating VS Code tunneling may be active.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium60Free2023-10-25Okta: Access to /reports/password-health endpoint outside expected Admin Console use
Flags requests to Okta Password Health report endpoints (/reports/password-health/*) for threat hunting.
Muhammad Faisal (@faisalusuf), Huntrule TeamOktaoktaLow80Free2023-10-25Okta: Detect new or activated user accounts named svc_network_backup
Alerts on Okta account creation or activation events for target display names containing svc_network_backup.
Muhammad Faisal (@faisalusuf), Huntrule TeamOktaoktaMedium387Free2023-10-25Windows File Creation: inetmgr.exe in \Windows\ADFS\bg\ Path
Alerts on creation of \Windows\ADFS\bg\inetmgr.exe in Windows file events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh426Free2023-10-24Windows Security Event 4698 Scheduled Task Creation for TeamCity UI
Flags Windows scheduled task creation events where the task name is TeamCity Settings UI and content contains a specific marker.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityCritical311Free2023-10-24