Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,386 rules
PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)
Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.
frack113, Huntrule TeamWindowsps_scriptMedium685Free2021-07-30Windows Named Pipe Creation: Cobalt Strike Malleable Profile PipeName Patterns
Alerts on Sysmon named pipe creation with PipeName patterns commonly used by Cobalt Strike malleable C2.
Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems), Huntrule TeamWindowspipe_createdHigh281Free2021-07-30Windows Named Pipe Creation Matching Cobalt Strike Malleable C2 Profile Patterns
Alerts on Windows named pipe creation with PipeName patterns consistent with Cobalt Strike Malleable C2 behavior.
Florian Roth (Nextron Systems), Huntrule TeamWindowspipe_createdCritical294Free2021-07-30Windows WinDivert Driver Load via Image or Known IMPHASHes
Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.
Florian Roth (Nextron Systems), Huntrule TeamWindowsdriver_loadHigh203Free2021-07-30PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows
Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh349Free2021-07-29Windows Process Creation: Automated Document and Directory Discovery via dir and findstr
Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.
frack113, Huntrule TeamWindowsprocess_creationMedium304Free2021-07-28PowerShell Script Block Collection of Documents via Recursive Get-ChildItem
Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.
frack113, Huntrule TeamWindowsps_scriptMedium373Free2021-07-28Windows: WinZip executed with password flag and archive parameters indicative of data staging
Flags Windows executions of WinZip/WinZip64 using a password flag and archive parameters that can support data staging.
frack113, Huntrule TeamWindowsprocess_creationMedium258Free2021-07-27Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
frack113, Huntrule TeamWindowsprocess_creationLow181Free2021-07-27Windows: 7-Zip password-protected archive creation for potential data exfiltration
Flags 7-Zip archive creation on Windows with a password flag and archive-action parameters.
frack113, Huntrule TeamWindowsprocess_creationMedium366Free2021-07-27Windows nltest.exe Recon via Server Query and Domain Trust Enumeration
Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.
Craig Young, oscd.community, Georg Lauenstein, Huntrule TeamWindowsprocess_creationMedium213Free2021-07-24Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation
Alerts on Windows execution of common SMB/NTLM relay and “Potato” privilege escalation hacktool indicators via process creation fields.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical171Free2021-07-24Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches
Flags execution of Windows impacket compiled binaries based on distinctive tool names in the process Image.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh509Free2021-07-24Azure Activity Logs: Kubernetes Pod Deletion via Connected Clusters API
Flags Azure Activity Log events indicating Kubernetes pods were deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium233Free2021-07-24Azure Kubernetes Events Deleted via Activity Logs
Identifies Azure Activity Log entries where Kubernetes event records are deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium5410Free2021-07-24