Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: Local User Creation via net.exe with DarkGate and SafeMode
Alerts on net.exe adding a local user when the command line includes “DarkGate” and “SafeMode”.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh71Free2023-08-27Linux Process Discovery of Container Environment via ls -i on / Directory
Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow366Free2023-08-23Linux Docker Container Discovery via .dockerenv File Listing or Reads
Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow133Free2023-08-23Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools
Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.
Seth Hanford, Huntrule TeamLinuxprocess_creationLow222Free2023-08-23Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise
Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh102Free2023-08-23Windows File Creation of wermgr.exe in Uncommon Directory (Potential CVE-2023-36874)
Alerts on wermgr.exe creation in atypical Windows directories that may indicate filename spoofing.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh161Free2023-08-23Windows: Report.wer File Created in Uncommon WER ReportArchive Subfolders
Alerts on Report.wer creation under WER ReportArchive paths that don’t match common subfolder patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium142Free2023-08-23Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting
Flags Excel-related process command lines that disable Python function execution warnings via PythonFunctionWarnings=0.
"@Kostastsale, Huntrule Team"Windowsprocess_creationHigh451Free2023-08-22macOS: In-Memory Download and Compile via curl and osacompile in a Single Command
Alerts when macOS processes include both curl and osacompile, consistent with downloading and compiling payloads.
Sohan G (D4rkCiph3r), Red Canary (idea), Huntrule TeamMacosprocess_creationMedium273Free2023-08-22macOS: JAMF CLI (jamf) execution for account and MDM management
Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.
Jay Pandit, Huntrule TeamMacosprocess_creationLow231Free2023-08-22macOS Jamf MDM Suspicious Child Process Execution
Alerts when jamf on macOS spawns bash or sh, which may indicate misuse for command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium459Free2023-08-22macOS Root Account Enable Attempt via dsenableroot
Detects macOS attempts to enable the root account by running /dsenableroot.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium506Free2023-08-22macOS dseditgroup Used to Add User to admin Group
Flags dseditgroup command lines that edit and add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium315Free2023-08-22Linux Process Creation: ESXi User Account Added via esxcli system account add
Alerts when esxcli is used to run an ESXi system account add command, indicating user account creation.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium133Free2023-08-22Azure Entra ID Riskdetection: Anonymous IP Address sign-in risk events
Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.
Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh192Free2023-08-22