Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,344 rules
Windows Sysmon Operational Channel Reference Deleted via Security Event
Detects Security log events showing Sysmon Operational channel being disabled via channel reference deletion-like changes.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowssecurityHigh171Free2020-07-14Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs
Flags proxy HTTP POSTs using an Empire-like user agent to specific admin/login PHP endpoints.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh365Free2020-07-13Windows Dllhost.exe Network Connections to Non-Local IP Addresses
Flags Dllhost.exe initiating outbound connections to non-local destination IPs, excluding local/private and specified benign IP ranges.
bartblaze, Huntrule TeamWindowsnetwork_connectionMedium110Free2020-07-13Windows Process Creation: regsvr32 Invoked to Load .ocx from AppData Roaming
Flags regsvr32 /s /i loading an .ocx from AppData\Roaming on Windows, a stealthy code-loading technique.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical191Free2020-07-10Citrix ADC/ADS Exploitation Attempts Targeting RAPI and PCIDSS Paths (CVE-2020-8193/8195)
Flags Citrix ADC/NetScaler HTTP requests whose URI queries match exploitation-related patterns for CVE-2020-8193 and CVE-2020-8195.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical133Free2020-07-10Windows PowerShell Command Lines Containing [char]0x or (WCHAR)0x Obfuscation Syntax
Identifies PowerShell execution command lines using suspicious [char]0x or (WCHAR)0x encoding patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh202Free2020-07-09Windows Registry Run Key Modification for ntkd Persistence
Flags Windows registry activity hitting the Run key path segment "\Run\ntkd" used for automatic startup persistence.
Aidan Bracher, Huntrule TeamWindowsregistry_eventCritical191Free2020-07-07Microsoft 365 Impossible Travel Sign-ins Reported as Successful
Alerts on successful Microsoft 365 “Impossible travel activity” events in SecurityComplianceCenter telemetry.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementMedium284Free2020-07-06Web Exploitation Attempt Pattern for CVE-2020-5902 on F5 BIG-IP (URI Traversal)
Alerts on web requests with query patterns consistent with CVE-2020-5902 exploitation attempts targeting F5 BIG-IP.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical112Free2020-07-05Windows Process Execution of DIT Snapshot Viewer (ditsnap.exe)
Alerts on execution of the DIT snapshot viewer tool ditsnap.exe on Windows.
Furkan Caliskan (@caliskanfurkan_), Huntrule TeamWindowsprocess_creationHigh337Free2020-07-04Windows Process Execution: Copy From System Directories to Other Locations
Detects cmd.exe, PowerShell, and copy utilities copying files from System32/SysWOW64/WinSxS to other locations on disk.
Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium183Free2020-07-03Windows desktopimgdownldr Suspicious URL and Registry Modification via Command Line
Flags desktopimgdownldr command lines indicating potential external file download or personalization registry deletion.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh508Free2020-07-03Windows curl.exe Suspicious Download to Local File Paths
Flags curl.exe executions on Windows that appear to download to local files in suspicious directories with risky file extensions.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh132Free2020-07-03Windows Desktop Image Downloader Targeting Lock Screen Images with Suspicious File Types
Alerts on desktopimgdownldr-style lock screen image target writes to non-system paths with suspicious filename characteristics.
Florian Roth (Nextron Systems), Huntrule TeamWindowsfile_eventHigh283Free2020-07-03Apache Guacamole Linux: Two-User Session Presence Anomaly
Flags Guacamole sessions on Linux when telemetry indicates two users are present, suggesting anomalous or suspicious session activity.
Florian Roth (Nextron Systems), Huntrule TeamLinuxguacamoleHigh316Free2020-07-03