Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,418 rules
Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments
Flags Ruby processes launched with Evil-WinRM parameters (-i, -u, -p), indicative of WinRM remote access attempts.
frack113, Huntrule TeamWindowsprocess_creationMedium3410Free2022-01-07PowerShell script exfiltration using Invoke-WebRequest with POST or PUT
PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.
frack113, Huntrule TeamWindowsps_scriptLow255Free2022-01-07PowerShell DNSExfiltrator command usage (DNSExfiltration)
Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.
frack113, Huntrule TeamWindowsps_scriptHigh191Free2022-01-07Windows PowerShell: Invoke-Command targeting -ComputerName via script block
Detects PowerShell Invoke-Command targeting remote hosts by matching script block text with -ComputerName.
frack113, Huntrule TeamWindowsps_scriptMedium192Free2022-01-07Windows PowerShell script enabling WinRM via Enable-PSRemoting
Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.
frack113, Huntrule TeamWindowsps_scriptMedium291Free2022-01-07Windows Suspicious Outbound SMTP Connections on Common Mail Ports
Alerts on outbound, initiated SMTP connections to ports 25/465/587/2525, excluding specific mail/Exchange processes.
frack113, Huntrule TeamWindowsnetwork_connectionMedium323Free2022-01-07Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass
Detects non-default Environment\windir registry changes commonly used to facilitate SilentCleanup UAC bypass.
frack113, Nextron Systems, Huntrule TeamWindowsregistry_setHigh3910Free2022-01-06Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender
Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical122Free2022-01-06Potential DLL Injection via AccCheckConsole.exe Command-Line Parameters on Windows
Alerts on AccCheckConsole.exe executions whose CLI parameters align with loading custom verification logic via a DLL.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium233Free2022-01-06Windows PowerShell Remote Session Creation via New-PSSession
Flags PowerShell usage of New-PSSession with a ComputerName in script block logging, indicating remote session creation.
frack113, Huntrule TeamWindowsps_scriptMedium282Free2022-01-06Windows Registry: Disable User Account Control by setting EnableLUA to 0
Alerts on Windows registry changes that disable UAC by writing EnableLUA as 0.
frack113, Huntrule TeamWindowsregistry_setMedium271Free2022-01-05Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)
Monitors registry value changes to the Event Viewer command handler path indicative of a UAC bypass attempt on Windows.
frack113, Huntrule TeamWindowsregistry_setHigh173Free2022-01-05Windows Registry: Detect DelegateExecute UAC bypass via TargetObject path
Alerts on registry set events targeting \open\command\DelegateExecute with empty Details, consistent with a UAC bypass attempt.
frack113, Huntrule TeamWindowsregistry_setHigh5010Free2022-01-05Windows Process Creation: Pypykatz Credential Dumping via Registry Parsing
Alerts when pypykatz is run with "live" and "registry" parameters to extract credential data from local SAM-related artifacts.
frack113, Huntrule TeamWindowsprocess_creationHigh461Free2022-01-05Windows WinRAR Compression of .dmp/.dump Files via Command Line
Flags WinRAR executions on Windows whose command lines reference .dmp/.dump/.hdmp extensions.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium407Free2022-01-04