Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,687 rules
Windows Process Creation: svchost.exe Spawns mshta.exe (LethalHTA)
Alerts on Windows instances where svchost.exe spawns mshta.exe, indicating potential LethalHTA execution.
Markus Neis, Huntrule TeamWindowsprocess_creationHigh213Free2018-06-07Suspicious Telegram API proxy access without Telegram User-Agent
Alerts on api.telegram.org requests where the User-Agent lacks common Telegram bot identifiers.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyMedium162Free2018-06-05Suspicious DNS queries to api.telegram.org for Telegram Bot API traffic
Flags DNS queries to api.telegram.org that may indicate Telegram Bot API usage by bots or malware.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsMedium217Free2018-06-05Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
Alerts on NTFS ADS creation where the stream hash includes a non-null IMPHASH marker, consistent with hidden executables.
Florian Roth (Nextron Systems), @0xrawsec, Huntrule TeamWindowscreate_stream_hashMedium181Free2018-06-03Suspicious DNS Queries Containing Base64-Padding Pattern (==.)
Alerts on DNS queries containing the base64 delimiter pattern '==.' consistent with encoded data in DNS.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsMedium312Free2018-05-10Cobalt Strike-style DNS Beaconing Queries (DNS)
Flags DNS queries with Cobalt Strike-style stage subdomain patterns used for covert beaconing.
Florian Roth (Nextron Systems), Huntrule TeamNetworkdnsCritical291Free2018-05-10Windows Registry Persistence via Image File Execution Options GlobalFlag and SilentProcessExit
Flags registry changes to IFEO GlobalFlag and SilentProcessExit keys that can enable stealthy persistence or process redirection.
Karneades, Jonhnathan Ribeiro, Florian Roth, Huntrule TeamWindowsregistry_setHigh134Free2018-04-11Windows Process Creation: Access to Domain Group Policy in SYSVOL
Flags Windows processes that reference SYSVOL \policies paths in their command line.
Markus Neis, Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationMedium253Free2018-04-09Windows File Events: Known Offensive PowerShell Script File Creation
Alerts on creation of known offensive PowerShell/PowerShell module filenames on Windows.
Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein, Huntrule TeamWindowsfile_eventHigh402Free2018-04-07Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32
Alerts when mshta/PowerShell and similar script hosts spawn tasks, download/transfer, or utility tools on Windows.
Florian Roth (Nextron Systems), Tim Shelton, Huntrule TeamWindowsprocess_creationHigh288Free2018-04-06Windows: Suspicious Process Spawning from Microsoft Office Applications
Alerts when Office apps spawn common execution tools or scripts from typical attacker staging paths on Windows.
Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io, Huntrule TeamWindowsprocess_creationHigh272Free2018-04-06Windows Proxy Activity Using Microsoft-WebDAV-MiniRedir GET User-Agent
Alerts on proxy HTTP GET requests using the Microsoft-WebDAV-MiniRedir/ User-Agent prefix associated with file download behavior.
Florian Roth (Nextron Systems), Huntrule TeamWebproxyHigh100Free2018-04-06Windows Ping Hex IP Usage via Command Line
Flags ping.exe executions that pass a hex-encoded IPv4 address (0x????????) in the command line on Windows.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh241Free2018-03-23Windows System Service Control Manager Event 7045 Scheduled Scan and UpdatMachine
Alerts on Windows service installation events for persistence-related scheduled services named SC Scheduled Scan or UpdatMachine.
Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowssystemCritical291Free2018-03-23Windows Security: Detect Scheduled Task Creation for OilRig-Related Persistence
Alerts on Windows scheduled task creation events (4698) for task names "SC Scheduled Scan" and "UpdatMachine".
Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community, Huntrule TeamWindowssecurityCritical306Free2018-03-23