Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,389 rules
GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete
Flags GCP audit events indicating service account create, update, enable, undelete, or patch operations.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium2110Free2021-08-14Google Cloud: Service Account Disabled or Deleted via IAM Audit Events
Identifies GCP IAM audit events where service accounts are disabled or deleted via serviceAccounts.disable/delete.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium243Free2021-08-14GCP Audit: Storage Bucket Modified or Deleted via Storage API
Alert on GCP audit events indicating storage bucket insert, update, patch, or delete actions.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium488Free2021-08-14GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditLow183Free2021-08-14GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API
Alerts on GCP Compute PacketMirrorings API calls that may enable full network packet capture.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium192Free2021-08-13GCP Audit: Firewall Rule Insert, Update, Patch, or Delete
Flags GCP audit events where firewall rules are inserted, updated, patched, or deleted.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium464Free2021-08-13Windows whoami.exe Execution from Suspicious Parent Processes
Alerts on whoami.exe runs where the parent process is not a typical shell or monitoring agent.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium172Free2021-08-12Windows whoami.exe Renamed Execution via Mismatched OriginalFileName
Alerts when a renamed process still reports OriginalFileName as whoami.exe on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical230Free2021-08-12Windows SystemNightmare Exploitation Attempt via PrintNightmare Command Lines
Alerts on Windows process command lines matching SystemNightmare/PrintNightmare exploitation indicators that may enable LOCAL_SYSTEM shell access.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical213Free2021-08-11Exchange ProxyLogon activity: IIS POST SetObject Reset VirtualDirectory requests
Alerts on successful POSTs to ECP DDIService SetObject resetting a VirtualDirectory with a '$' username suffix.
frack113, Huntrule Team—webserverCritical111Free2021-08-10Windows Maldoc Process Injection via winword.exe CallTrace from LittleCorporal
Flags winword.exe process injection where the call trace matches LittleCorporal-generated Maldoc activity on Windows.
Christian Burkard (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh182Free2021-08-09PowerShell ShellIntel Commandlet Abuse via ScriptBlock Logging
Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.
Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule TeamWindowsps_scriptHigh231Free2021-08-09Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment
Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.
Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems), Huntrule TeamWindowsmsexchange-managementCritical294Free2021-08-09Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation
Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsmsexchange-managementCritical4410Free2021-08-09GCP Kubernetes Engine audit logs: Secrets created, updated, patched, or deleted
Alerts on GCP Kubernetes audit events showing Secrets being updated, patched, or deleted via Kubernetes API calls.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium277Free2021-08-09