Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Code Integrity: Revoked Kernel Driver Loaded (Event 3021/3022)
Alerts when Windows Code Integrity reports a revoked kernel driver/module loaded (including debugger-allowed cases) via Event IDs 3021/3022.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh209Free2023-06-06Windows Code Integrity: Blocked Driver Load Due to Revoked Certificate (Event ID 3023)
Flags Code Integrity Operational events where Windows blocks loading a revoked (untrusted) driver certificate.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh197Free2023-06-06Windows Code Integrity blocked disallowed file for protected processes (Event ID 3104)
Alerts on Windows Code Integrity Event ID 3104 when a disallowed file is blocked for protected processes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowscodeintegrity-operationalHigh163Free2023-06-06Windows Process Creation: Renamed AutoIt2/AutoIt3 Execution via AutoIt3ExecuteScript
Alerts on suspicious renamed AutoIt2/AutoIt3 execution based on command-line parameters plus known hashes and original file names.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh221Free2023-06-04Webserver GET Requests to MOVEit Human2.aspx Paths Indicative of CVE-2023-34362 Web Shell Attempts
Alerts on GET requests to human2.aspx/_human2.aspx paths associated with MOVEit CVE-2023-34362 exploitation attempts.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh499Free2023-06-03Linux wget downloads to /tmp using explicit output options
Alerts on wget commands writing output to /tmp using -O or --output-document.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium201Free2023-06-02Linux Script Execution from /tmp via Shell -c
Alerts when a Linux shell runs a command with -c that references a script under /tmp/.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium150Free2023-06-02Linux: Shell Execution from /tmp by Parent Process
Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationHigh150Free2023-06-02Suspicious Linux Process Execution From /tmp Directory
Flags execution of binaries located under /tmp on Linux, excluding a known Nextcloud path.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium256Free2023-06-02Linux nohup Execution from /tmp
Flags Linux process executions using nohup with command lines referencing /tmp.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationHigh162Free2023-06-02Linux grep file discovery targeting GobRAT-specific filenames
Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationHigh304Free2023-06-02Linux OS Architecture Discovery Using grep
Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationLow388Free2023-06-02Linux Process Creation: crontab -l Enumeration
Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationLow281Free2023-06-02Linux Wget Writing Files Under /tmp or /var/tmp
Alerts when wget creates files under /tmp or /var/tmp on Linux.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxfile_eventMedium122Free2023-06-02Linux Shell Script Creation in /etc/profile.d/ for Persistence
Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxfile_eventLow183Free2023-06-02