Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows DLL Sideloading: CCleanerReactivator.dll Loaded from CCleaner Directories
Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.
X__Junior, Huntrule TeamWindowsimage_loadMedium258Free2023-07-13Windows DLL Sideloading via CCleanerDU.dll ImageLoad from CCleaner Folder
Alerts when CCleanerDU.dll is loaded, but the loading image is not CCleaner executables in standard install paths.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadMedium182Free2023-07-13PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules
Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule TeamWindowsps_moduleLow90Free2023-07-13Windows Security 5140 File Share Access to MSHTML_C7 IP-Named Paths
Alerts on Windows file share access events targeting \MSHTML_C7\ shares with an IP-like naming pattern (EventID 5140).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityHigh142Free2023-07-13Windows Office Recent Folder Dropped URL File (file001.url) Creation
Alerts on creation of file001.url in Microsoft Office Recent under C:\Users\, indicating potential exploit staging.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsfile_eventMedium111Free2023-07-13Windows Process Creation From Fake Recycle.Bin Directories
Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh399Free2023-07-12Windows: wordpad.exe Initiated Network Connections on Uncommon Ports
Alerts when wordpad.exe initiates outbound connections on destination ports outside common C2-related ports.
X__Junior (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium181Free2023-07-12Windows Office Apps Initiating Network Connections to Non-Common Ports
Alerts on network connections initiated by Windows Office apps to destination ports not in the common port set.
X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium517Free2023-07-12Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders
Alerts on Windows file writes involving RECYCLERS.BIN\ or RECYCLER.BIN\ paths often used for staging.
X__Junior (Nextron Systems), Huntrule TeamWindowsfile_eventHigh448Free2023-07-12HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy Logs)
Alerts on proxy HTTP GET requests whose URI contains /MSHTML_C7/.
X__Junior, Huntrule Team—proxyHigh123Free2023-07-12Proxy GET Requests for Suspicious File and Redirect Paths Associated with CVE-2023-36884
Alerts on proxy HTTP GET requests for specific suspicious file-download URI patterns associated with CVE-2023-36884-style activity.
X__Junior, Huntrule Team—proxyMedium307Free2023-07-12Proxy GET Requests with IP-Embedded CVE-Related URL Parameters
Finds proxy GET URIs with risky extensions and a d=IPv4 parameter value in the query string.
X__Junior, Huntrule Team—proxyHigh531Free2023-07-12Proxy HTTP GET Pattern Matching /MSHTML_C7/ with IPv4 Query Parameters
Alerts on proxy HTTP GET requests to /MSHTML_C7/ with an IPv4-like query parameter pattern.
X__Junior, Huntrule Team—proxyCritical130Free2023-07-12Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations
Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh495Free2023-07-11Windows PowerShell Script Accessing Windows MailApp MailBox Data Path
Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.
frack113, Huntrule TeamWindowsps_scriptMedium70Free2023-07-08