Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Okta user.session.start via anonymising proxy service
Identifies Okta user session starts where the session is marked as using an anonymizing proxy.
kelnage, Huntrule TeamOktaoktaHigh484Free2023-09-07Okta: End-user Reported Suspicious Activity Account Event Detection
Flags Okta end-user self-submitted reports of potentially suspicious activity on their account.
kelnage, Huntrule TeamOktaoktaHigh518Free2023-09-07Okta Admin Console: New admin console activity via policy.evaluate_sign_on heuristics
Alerts when Okta policy evaluation shows POSITIVE debug heuristics for activity targeting the Okta Admin Console.
kelnage, Huntrule TeamOktaoktaHigh261Free2023-09-07Okta System Log: New Identity Provider Created via system.idp.lifecycle.create
Alerts on Okta events indicating a new identity provider was created.
kelnage, Huntrule TeamOktaoktaMedium193Free2023-09-07Azure (Entra ID) Risk Detection: Threat Intelligence-Driven Unusual User Activity
Flags Azure AD risk investigation events tied to threat-intelligence sign-in indicators using riskdetection telemetry.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh227Free2023-09-07Azure Risk Detection: Attempted Primary Refresh Token (PRT) Access
Identifies Azure risk events indicating an attempted PRT access that can enable lateral movement or credential theft.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh272Free2023-09-07Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP
Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh181Free2023-09-07Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate
Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh182Free2023-09-07Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventLow150Free2023-09-07Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1
Flags registry changes that set SCHANNEL TLS 1.0/1.1 Enabled to 1 on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setMedium283Free2023-09-05Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS
Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.
Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea), Huntrule TeamWindowsregistry_setHigh341Free2023-09-05Suspicious CommandLine Parameters for Electron Apps on Windows
Alerts on Electron app execution with command-line flags consistent with subprocess and renderer/utility launching behavior.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium203Free2023-09-05Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS
Flags Windows command lines that set IE ZoneMap ProtocolDefaults for HTTP to the My Computer (zone 0) trust level.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh278Free2023-09-05Windows: Detect VMMap loading a signed dbghelp.dll from C:\Debuggers\
Alerts on vmmap.exe/vmmap64.exe loading a signed dbghelp.dll from C:\Debuggers, consistent with potential DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium173Free2023-09-05Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application
Alert on deletion of the Zone.Identifier ADS by an uncommon process on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium131Free2023-09-04