Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium202Free2023-09-04Linux Process Creation: ESXi esxcli VM kill via vm process kill flags
Triggers when esxcli is executed with VM process kill arguments, indicating a potential ESXi VM termination.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium122Free2023-09-04Linux Process Execution of esxcli VM Listing Commands
Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium123Free2023-09-04Linux Process Creation: ESXi esxcli system discovery via system namespace
Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium305Free2023-09-04Linux Process: ESXi syslog configuration changed via esxcli system syslog config set
Detects esxcli commands that set ESXi syslog configuration based on command-line terms.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium111Free2023-09-04Linux ESXi esxcli Storage Information Discovery via esxcli storage commands
Flags Linux process executions of esxcli with storage discovery subcommands like get/list.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium371Free2023-09-04Linux Process Creating esxcli System Permission Set Admin for an Account
Alerts when esxcli is run to set Admin permissions via the system/permission set flags.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh153Free2023-09-04Linux Process Execution of esxcli Network Commands for ESXi Network Discovery
Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium291Free2023-09-04Windows File Deletion: Remove Zone.Identifier Alternate Data Stream
Alerts on Windows deletions of the Zone.Identifier ADS, which attackers may remove to evade zone-based security controls.
frack113, Huntrule TeamWindowsfile_deleteLow210Free2023-09-04Azure Entra sign-in risk: Unfamiliar sign-in properties
Alerts on Azure risk events where sign-in properties are marked unfamiliar compared to a user’s historical patterns.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh122Free2023-09-03Azure SAML Token Issuer Anomaly via riskdetection
Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh163Free2023-09-03Azure Entra suspicious browser risk events across multiple tenants and countries
Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh2810Free2023-09-03Azure Entra ID risk event: successful password spray detection
Flags Azure Entra ID risk events indicating a successful password spray attempt.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh245Free2023-09-03Azure Entra ID sign-in risk: new country (riskEventType newCountry)
Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh497Free2023-09-03Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses
Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh203Free2023-09-03