Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Registry Events: Scheduled Task Creation via TaskCache Tree Key
Flags registry activity creating TaskCache Tree entries tied to TeamCity settings UI during exploitation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_eventHigh172Free2023-10-24Windows Process Creation Command-Line Indicator Matching 'uTYNkfKxHiZrx3KJ'
Triggers on Windows process creation events with command line containing 'uTYNkfKxHiZrx3KJ'.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh173Free2023-10-24Windows DLL Side-Loading via ProgramData Image Load Indicators (clip.exe and wsmprovhost.exe)
Flags ProgramData clip.exe or wsmprovhost.exe launching with suspicious DLL loads from ProgramData.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh133Free2023-10-24Windows File Creation Indicators Linked to Diamond Sleet Artifacts
Flags Windows file creations under \ProgramData matching specific payload component filename indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh81Free2023-10-24Windows DNS queries containing Diamond Sleet–related domains
Alerts on Windows DNS queries for QueryName values containing specific Diamond Sleet–related domains.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns_queryHigh152Free2023-10-24Windows Process Execution of findstr.EXE for Security Tool Keyword Filtering
Alerts on Windows findstr.exe executions that filter output using security software and antivirus-related keywords.
Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule TeamWindowsprocess_creationMedium212Free2023-10-20Web exploitation attempts for CVE-2023-43261 causing info disclosure in Milesight routers
Alerts on successful GET requests for /lang/log/httpd.log in Milesight router web access logs, consistent with CVE-2023-43261 disclosure attempts.
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team—webserverHigh457Free2023-10-20Potential Information Disclosure via CVE-2023-43261 in Milesight Router Proxy Logs
Alerts on HTTP GET 200 responses for UR router log paths in proxy requests associated with CVE-2023-43261.
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team—proxyHigh163Free2023-10-20Cisco IOS XE Web UI Exploitation Indicators for CVE-2023-20198 via Syslog Login and Config Events
Matches Cisco IOS XE Web UI and web login success logs consistent with CVE-2023-20198 exploitation using specified admin/TAC usernames.
Lars B. P. Frydenskov (Trifork Security), Huntrule TeamCiscosyslogHigh2010Free2023-10-20Windows Task Manager Creating lsass.dmp in Temp
Alerts when Task Manager creates a Temp lsass .DMP file consistent with LSASS memory dumping.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsfile_eventHigh438Free2023-10-19Windows PowerShell EnableScripts Policy Enabled via Registry DWORD
Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).
Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule TeamWindowsregistry_setLow222Free2023-10-18Windows Process Execution: curl.exe Downloading Files From an IP URL
Flags curl.exe commands that download via an IP-based URL using output/remote-name flags.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium423Free2023-10-18Windows CertOC.exe Downloads File From IP-Based URL Using -GetCACAPS
Flags CertOC.exe executions using an IP-based URL in the command line with -GetCACAPS.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3610Free2023-10-18Windows DLL Sideloading via ImageLoad of mscoRee/colorui/mapistub/HID payload DLLs
Alerts on Windows processes loading DLLs from targeted ProgramShared/ProgramData paths consistent with DLL sideloading.
Thurein Oo, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh311Free2023-10-18Windows rundll32.exe calling DllRegisterServer from a non-standard DLL path
Detects rundll32.exe calling DllRegisterServer from command lines associated with non-standard DLL locations.
Andreas Braathen (mnemonic.io), Huntrule TeamWindowsprocess_creationMedium80Free2023-10-17