Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8,866 rules
Windows Error Reporting: MsMpEng.exe Crash with mpengine.dll
Alerts on WER EventID 1001 crashes where MsMpEng.exe and mpengine.dll appear in the event data.
Florian Roth (Nextron Systems), Huntrule TeamWindowsapplicationHigh231Free2017-05-09Windows Application Error: MsMpEng.exe Crash Involving mpengine.dll
Alerts on Windows Application Error EventID 1000 indicating a crash involving MsMpEng.exe and mpengine.dll.
Florian Roth (Nextron Systems), Huntrule TeamWindowsapplicationHigh303Free2017-05-09Windows DNS ServerLevelPluginDll Registry Installation
Detects registry changes setting DNS ServerLevelPluginDll, which can enable malicious DNS plugin DLL loading after restart.
Florian Roth (Nextron Systems), Huntrule TeamWindowsregistry_setHigh575Free2017-05-08Windows: Detect dnscmd.exe setting ServerLevelPluginDll to install DNS plugin DLL
Flags dnscmd.exe DNS configuration that sets ServerLevelPluginDll, indicating potential malicious DNS server code injection.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh293Free2017-05-08Windows DNS Server error when loading ServerLevelPlugin DLL fails
Flags Windows DNS Server errors where the ServerLevelPluginDLL plugin DLL fails to load.
Florian Roth (Nextron Systems), Huntrule TeamWindowsdns-serverHigh621Free2017-05-08Windows Rundll32 DLL Load via control.exe spawning
Alerts on control.exe spawning rundll32.exe to load Shell32.dll via DLL invocation patterns.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh303Free2017-04-15Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145
Alerts when firewall traffic involves the two specified IPs associated with presumed C2 communication.
Florian Roth (Nextron Systems), Huntrule Team—firewallHigh526Free2017-04-15Windows Security: AD user/computer backdoor via msDS-AllowedToDelegateTo and delegation attributes
Alerts on AD delegation-related attribute changes that may create credentialless account control paths.
"@neu5ron, Huntrule Team"WindowssecurityHigh388Free2017-04-13PowerShell Credential Prompt via PromptForCredential
Flags PowerShell scripts that reference "PromptForCredential", indicating credential prompt behavior in Script Block Logging.
John Lambert (idea), Florian Roth (Nextron Systems), Huntrule TeamWindowsps_scriptHigh579Free2017-04-09Linux Command-Line Indicators of Equation Group Tooling
Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.
Florian Roth (Nextron Systems), Huntrule TeamLinux—High252Free2017-04-09Windows CScript and csvde Command-Line Execution Patterns Suggesting Cloud Hopper Activity
Detects cscript VBScript shell execution and csvde writing log files into C:\windows\web\.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh313Free2017-04-07Windows Service Install (Event ID 7045) for srservice, ipvpn, hkmsvc
Alerts on Windows service creation events (7045) for srservice, ipvpn, and hkmsvc service names.
Florian Roth (Nextron Systems), Huntrule TeamWindowssystemHigh301Free2017-03-31Windows Service Creation: ServiceName javamtsup (Event ID 4697)
Flags Windows Security Event 4697 when a service named "javamtsup" is installed, indicating potential persistence.
Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update), Huntrule TeamWindowssecurityCritical262Free2017-03-27Linux Log File Alerts for Suspicious Messages
Generates alerts when Linux log text contains suspicious keywords indicating possible network, service, or logging disruption.
Florian Roth (Nextron Systems), Huntrule TeamLinux—Medium221Free2017-03-25PowerShell downgrade indicators via EngineVersion=2. and HostVersion !=2. (Windows)
Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.
Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements), Huntrule TeamWindowsps_classic_startMedium548Free2017-03-22