Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Linux Process Execution of BarracudaMailService and Resize Utility Binaries
Alerts on Linux process creation for executables ending with three specific names linked to SEASPY deployment.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationCritical151Free2023-06-16Linux Process Creation: wget Download Tar From Untrusted Direct IP with No-Check-Certificate
Flags wget commands that download .tar files from direct IP URLs while bypassing TLS certificate validation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh245Free2023-06-16Linux Process: Wget Downloads .zip/.rar from temp.sh URL
Identifies Linux wget commands that download .zip or .rar archives from temp.sh.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh172Free2023-06-16Linux openssl s_client Connections to External IPs for SSL Certificate Exfiltration
Detects openssl s_client connecting to an IP:port on 443/8080 from Linux process command lines.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh143Free2023-06-16Linux File Indicators Matching Suspected Barracuda ESG Exploitation Artifacts
Flags Linux file creation/access events whose filenames end with known Barracuda ESG exploitation artifact indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh344Free2023-06-16Linux Email Exfiltration Staging File Pattern Matching (/mail/tmp/**.tar.gz)
Flags Linux file events creating /mail/tmp staging archives named like abc123.tar.gz.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh181Free2023-06-16Windows Virtual Smart Card Created Using TpmVscMgr.EXE
Flags execution of Tpmvscmgr.exe with a create command, indicating creation of a new virtual smart card.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium223Free2023-06-15Windows: Detect lodctr.exe Rebuild (-r) Performance Counter Values
Flags lodctr.exe executions with -r, indicating attempts to rebuild performance counter registry values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium251Free2023-06-15Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence
Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh130Free2023-06-14Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence
Flags VMwareToolBoxCmd.exe use of 'script' and 'set' parameters consistent with VM state–based persistence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium120Free2023-06-14Windows DLL Sideloading: waveedit.dll Loaded by Nero WaveEditor
Alerts when waveedit.dll is loaded from an unexpected path, suggesting possible DLL sideloading on Windows.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh205Free2023-06-14Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER
Alerts on GET requests to GeoServer OWS with CQL_FILTER containing SQLi-style payload markers and functions.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh123Free2023-06-14Windows Registry: ClickOnce Trust PromptingLevel Set to Enabled for Multiple Locations
Alerts on Enabled ClickOnce trust prompting registry changes for Internet and related locations.
"@SerkinValery, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"Windowsregistry_setMedium141Free2023-06-12Suspicious Child Process Spawned by ClickOnce Application (Windows)
Alerts when a ClickOnce app under AppData\Local\Apps\2.0\ spawns common script/tool executables.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium100Free2023-06-12Windows ClickOnce Execution: dfsvc.exe Child Process Launch
Flags ClickOnce-style child processes spawned by dfsvc.exe from the AppData\Local\Apps\2.0\ directory on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium70Free2023-06-12