Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,341 rules
Windows Pcap Driver Installation via EID 4697 ServiceFileName
Flags Windows driver install events (Security 4697) where the service file name matches known Pcap-related driver keywords.
Cian Heasley, Huntrule TeamWindowssecurityMedium151Free2020-06-10Windows file indicators for Octopus Scanner malware artifacts
Alerts on Windows file activity for Octopus Scanner-related filenames (Cache134.dat, ExplorerSync.db) in AppData.
NVISO, Huntrule TeamWindowsfile_eventHigh301Free2020-06-09Windows Registry Markers for FlowCloud Malware Configuration and Keylogger Components
Detects registry activity referencing specific HARDWARE marker GUID keys and the Setup\PrintResponsor path on Windows.
NVISO, Huntrule TeamWindowsregistry_eventCritical123Free2020-06-09Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access
Alerts on Windows consent-store registry entries showing webcam/microphone access tied to Temp or public user paths.
Den Iuzvyk, Huntrule TeamWindowsregistry_eventHigh132Free2020-06-07Windows processes accessing microphone and webcam via CapabilityAccessManager ConsentStore
Identifies Windows processes interacting with non-packaged app consent entries for microphone and webcam access.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowssecurityMedium201Free2020-06-07Sysmon Registry: .NET ETWEnabled Disabled via COMPlus ETW Flags
Alerts on Sysmon registry sets that set .NET ETWEnabled/COMPlus ETW flags to 0, impairing ETW-based telemetry.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowsregistry_setHigh283Free2020-06-05Windows Registry ETW Logging Disabled for .NET via Security Event 4657
Alerts when .NET ETW logging is disabled via registry changes (ETWEnabled or COMPlus ETW settings) using Event ID 4657.
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule TeamWindowssecurityHigh192Free2020-06-05Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines
Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh61Free2020-06-04Windows Process Masquerading: msdtc.exe and gpsvc.exe launched from Non-System Paths
Alerts on msdtc.exe or gpsvc.exe launched from paths outside Windows System32/SysWOW64.
Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1), Huntrule TeamWindowsprocess_creationHigh1810Free2020-06-03Windows Registry Set of ms-msdt MSProtocol URI (CVE-2022-30190)
Alerts on Windows registry writes under HKCR\ms-msdt\ that may indicate MSDT protocol abuse.
Sittikorn S, Huntrule TeamWindowsregistry_setMedium141Free2020-05-31Windows: Renamed Sysinternals DebugView Process Execution
Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh194Free2020-05-28Windows: New Executables Named After System Processes in Non-System Paths
Alerts on creation of executables named like common system processes in unexpected Windows directories.
Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium121Free2020-05-26ComRAT Proxy HTTP Requesting index.php with h Parameter
Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.
Florian Roth (Nextron Systems), Huntrule Team—proxyHigh72Free2020-05-26Confluence CVE-2019-3398 Web Exploitation via Path Traversal Upload POST Request
Alert on Confluence POST /upload.action requests with query-based path traversal filename patterns consistent with CVE-2019-3398.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical354Free2020-05-26Windows process command lines matching May 2020 Turla ComRAT command patterns
Triggers on Windows command lines matching a set of Turla-related indicators documented by ESET (May 2020).
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical442Free2020-05-26