Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,402 rules
Okta: Detect security.threat.detected events in threat insight
Flags Okta System Log security.threat.detected events indicating a detected potential security threat.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium515Free2021-09-12Okta Policy Rule Updated or Deleted
Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium142Free2021-09-12Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow231Free2021-09-12Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
Flags Okta System Log events when a Network Zone is deactivated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium533Free2021-09-12Okta Sign-On Policy Updated or Rule Deleted
Flags Okta sign-on policy updates and sign-on rule deletions in application policies.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium202Free2021-09-12Okta Application Lifecycle Update or Deletion Events
Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium212Free2021-09-12Okta: Detect API token revocation events
Flags Okta API token revocations using system.api_token.revoke System Log events.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium173Free2021-09-12Okta System API Token Creation Events
Flags Okta API token creation events to support investigation of potential persistence.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium393Free2021-09-12Okta Admin Role Granted to User or Group
Flags Okta privilege grant events that assign Administrator permissions to a user or group.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium252Free2021-09-12Linux steghide steganography: Extract hidden files from JPG/PNG
Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.
Pawel Mazur, Huntrule TeamLinuxauditdLow351Free2021-09-11Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef
Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.
Pawel Mazur, Huntrule TeamLinuxauditdLow377Free2021-09-11Linux Commands Clearing or Removing /var/log/syslog
Flags Linux activity that clears, deletes, or redirects /var/log/syslog, a likely attempt to impair logging.
Max Altgelt (Nextron Systems), Huntrule TeamLinux—High133Free2021-09-10Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)
Flags web requests targeting ADSelfService Plus REST API paths linked to CVE-2021-40539 authentication bypass.
Sittikorn S, Nuttakorn Tungpoonsup, Huntrule Team—webserverCritical110Free2021-09-10Windows Winword.exe Creates INetCache .cab and .inf Files During CVE-2021-40444 Exploitation
Flags winword.exe writing CABs in INetCache or INF files in Temp consistent with CVE-2021-40444 exploitation.
Florian Roth (Nextron Systems), Sittikorn S, Huntrule TeamWindowsfile_eventHigh231Free2021-09-10Linux auditd: Unzip files extracted from JPG/PNG images
Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.
Pawel Mazur, Huntrule TeamLinuxauditdLow182Free2021-09-09