Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,326 rules
Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options
Alerts on SharpHound/Bloodhound-like processes launching with discovery-focused command-line parameters.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh244Free2019-12-20Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Detects Windows Security Event 4799 where checkadmin.exe targets “Administr*” accounts, consistent with admin account enumeration.
Florian Roth (Nextron Systems), frack113, Huntrule TeamWindowssecurityHigh436Free2019-12-20Ursnif dropper download URLs matching PHP l= parameter ending in CAB
Flags proxy responses where a request URI contains /.php?l= and ends with .cab, returning HTTP 200.
Thomas Patzke, Huntrule Team—proxyHigh3410Free2019-12-19Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern
Flags proxy requests with Base64-like URI characters plus '/images/' and '.avi' patterns consistent with Ursnif C2.
Thomas Patzke, Huntrule Team—proxyCritical61Free2019-12-19Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior
Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.
Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh433Free2019-12-16Windows Process Creation: IIS appcmd Native Module Installation via Command Line
Alerts on appcmd.exe commands installing IIS native-code modules using a -name: parameter, excluding iissetup-launched setups.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium92Free2019-12-11Proxy access to raw paste endpoints on paste.ee and Pastebin-style services
Alerts on proxy requests for raw paste service URLs that can be used to stage or fetch malicious payloads.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh171Free2019-12-05Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)
Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.
Thomas Patzke, Huntrule TeamWindowssecurityLow133Free2019-12-04Windows Security: Detect Domain Trust Creation (Event ID 4706)
Alerts on Windows Event ID 4706 indicating a new trust was created to a domain.
Thomas Patzke, Huntrule TeamWindowssecurityMedium399Free2019-12-03Windows Security: Failed Code Integrity Checks (Event 5038/6281)
Alerts on Windows Security code integrity failures (Event 5038/6281) that may indicate modified or corrupted binaries.
Thomas Patzke, Huntrule TeamWindowssecurityInformational322Free2019-12-03Windows Security Event 6416 for USB Mass Storage Device Plug-In or DiskDrive Recognition
Flags Windows Event ID 6416 entries where a DiskDrive/USB Mass Storage Device is detected as connected.
Keith Wright, Huntrule TeamWindowssecurityLow106Free2019-11-20Windows CVE-2019-1388 UAC Consent to Internet Explorer Execution as LOCAL_SYSTEM
Flags UAC consent.exe launching iexplore.exe running as SYSTEM, consistent with CVE-2019-1388 exploitation.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical307Free2019-11-20Windows ProcDump Execution via Renamed Binary
Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh110Free2019-11-18Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI
Alerts on web requests with a Guacamole-related URI query pattern associated with a Pulse Secure CVE-2019-11510 exploitation attempt.
Florian Roth (Nextron Systems), Huntrule Team—webserverCritical159Free2019-11-18Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs
Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.
"@SBousseaden, Florian Roth, Huntrule Team"WindowssecurityHigh151Free2019-11-15