Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,326 rules
Windows Process Creation: Detect dctask64.exe with Endpoint Central Execution/Injection Flags
Alerts on Windows execution of ManageEngine Endpoint Central dctask64.exe with specific hash and suspicious command-line indicators.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh152Free2020-01-28Windows MSTSC Shadowing CommandLine Using shadow:
Flags Windows processes launching MSTSC with noconsentprompt and shadow: parameters consistent with RDP session shadowing.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh161Free2020-01-24AWS CloudTrail: Root User Credential Usage (UserIdentity.type=Root)
Alerts on CloudTrail activity performed by AWS account root credentials.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium193Free2020-01-21AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled
Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.
vitaliy0x1, Huntrule TeamAwscloudtrailHigh122Free2020-01-21AWS CloudTrail Trail Stop/Update/Delete Activity
Detects CloudTrail stop, update, or delete actions that can impair logging and audit visibility.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium2510Free2020-01-21Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Alerts on Windows Audit-CVE EventID 1 entries from Microsoft-Windows-Audit-CVE provider indicating CveEventWrite activity.
Florian Roth (Nextron Systems), Zach Mathis, Huntrule TeamWindowsapplicationCritical432Free2020-01-15Windows Process Command Lines Using System32/SysWow64 Tasks Folder
Alerts on process command lines referencing the writable System32/SysWow64 Tasks folders with common file staging/copy primitives.
Sreeman, Huntrule TeamWindowsprocess_creationHigh103Free2020-01-13Windows Process: curl Download with HTTP Output Redirect and Command Chaining
Flags Windows commands where curl downloads over HTTP with -o and then executes via command chaining with '&'.
Sreeman, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh60Free2020-01-13Windows: Koadic Command Prompt Invocation with /q /c chcp
Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.
wagga, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh521Free2020-01-12Windows Process Access to svchost.exe with High-Rights GrantedAccess
Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.
Tim Burrell, Huntrule TeamWindowsprocess_accessHigh267Free2020-01-02Citrix NetScaler CVE-2019-19781 Attempted Exploitation via Web Requests
Flags suspicious NetScaler HTTP URIs containing traversal-style /vpns/ portal script or config file references.
Arnim Rupp, Florian Roth, Huntrule Team—webserverCritical246Free2020-01-02Windows Registry Access to WCESERVICE Start Key
Detects registry activity targeting the WCE service Start configuration in Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsregistry_eventCritical302Free2019-12-31Windows Process Execution of Windows Credential Editor (WCE) Executables
Flags execution of Windows Credential Editor (WCE.exe/WCE64.exe) using image name endings and known imphash values.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical295Free2019-12-31Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments
Flags svchost.exe process starts lacking command-line values, excluding rpcnet/rpcnetp parent cases.
David Burkett, @signalblur, Huntrule TeamWindowsprocess_creationHigh141Free2019-12-28Windows CreateMiniDump.exe HackTool Execution via Process Creation
Detects the execution of CreateMiniDump.exe using image name and a specific IMPHASH.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2019-12-22