Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Azure Risk Detection: Attempted Primary Refresh Token (PRT) Access
Identifies Azure risk events indicating an attempted PRT access that can enable lateral movement or credential theft.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh242Free2023-09-07Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP
Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh91Free2023-09-07Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate
Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh152Free2023-09-07Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow120Free2023-09-07Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1
Flags registry changes that set SCHANNEL TLS 1.0/1.1 Enabled to 1 on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium243Free2023-09-05Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.
Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea), Huntrule TeamWindowsregistry_setHigh301Free2023-09-05Suspicious CommandLine Parameters for Electron Apps on Windows
Alerts on Electron app execution with command-line flags consistent with subprocess and renderer/utility launching behavior.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium143Free2023-09-05Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS
Flags Windows command lines that set IE ZoneMap ProtocolDefaults for HTTP to the My Computer (zone 0) trust level.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh268Free2023-09-05Windows: Detect VMMap loading a signed dbghelp.dll from C:\Debuggers\
Alerts on vmmap.exe/vmmap64.exe loading a signed dbghelp.dll from C:\Debuggers, consistent with potential DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium133Free2023-09-05Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application
Alert on deletion of the Zone.Identifier ADS by an uncommon process on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium81Free2023-09-04Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium112Free2023-09-04Linux Process Creation: ESXi esxcli VM kill via vm process kill flags
Triggers when esxcli is executed with VM process kill arguments, indicating a potential ESXi VM termination.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium112Free2023-09-04Linux Process Execution of esxcli VM Listing Commands
Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium93Free2023-09-04Linux Process Creation: ESXi esxcli system discovery via system namespace
Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium275Free2023-09-04Linux Process: ESXi syslog configuration changed via esxcli system syslog config set
Detects esxcli commands that set ESXi syslog configuration based on command-line terms.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium81Free2023-09-04