Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Azure risk detection: anomalousToken risk events
Flags Azure Entra ID risk events indicating anomalous token lifetime or use from unfamiliar locations.
Mark Morowczynski '@markmorow', Huntrule TeamAzureriskdetectionHigh112Free2023-08-07Windows Browser-Injected rundll32 Execution Indicative of GuLoader Activity
Flags rundll32.exe being launched from a browser process, matching GuLoader-style injected browser execution behavior on Windows.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh366Free2023-08-07Windows Portable Gpg.exe Execution from Uncommon Paths
Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium455Free2023-08-06Windows RemCom Service File Creation via RemComSvc.exe Filename
Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium409Free2023-08-04Windows CSExec Service File Creation (csexecsvc.exe)
Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium92Free2023-08-04Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries
Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium103Free2023-08-03Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading
Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium365Free2023-08-03Windows DLL Sideloading via mfdetours.dll using mftrace.exe
Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium60Free2023-08-03Windows ImageLoad DLL Sideloading: EACore.dll
Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh102Free2023-08-03Windows DLL sideloading via AVKkid.dll image loads
Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium121Free2023-08-03Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments
Alerts when the Linux amazon-ssm-agent is run with full SSM registration flags (-register, -code, -id, -region).
Muhammad Faisal, Huntrule TeamLinuxprocess_creationMedium113Free2023-08-03Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution
Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsregistry_setHigh81Free2023-08-02Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.
Muhammad Faisal, Huntrule TeamWindowsprocess_creationMedium143Free2023-08-02Windows Process Creation: csc.exe Used for Dynamic .NET Compilation
Flags Windows runs of csc.exe with /noconfig /fullpaths and an @-file, consistent with dynamic .NET compilation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-08-02Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path
Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh124Free2023-08-01