Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
Windows Process Creation: npm install for Shai-Hulud 2.0 Malicious Package Names and Versions
Alert on Windows node.exe running npm install with command-line package/version strings known from the Shai-Hulud 2.0 npm campaign.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh101Free2025-11-28Linux Process Creation: npm install of Shai-Hulud 2.0 malicious packages by name and version
Alerts on Linux npm install commands referencing known Shai-Hulud 2.0 malicious package versions.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh162Free2025-11-28Windows Schtasks Execution with Renamed schtasks.exe Binary
Alerts on scheduled task management commands that use a renamed schtasks.exe binary on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh459Free2025-11-27Windows Process Access: WerFaultSecure accessing MsMpEng with dbgcore.dll/dbghelp.dll call traces
Alerts on WerFaultSecure.exe accessing MsMpEng.exe with dbgcore/dbghelp DLLs in the call trace.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh431Free2025-11-27Windows suspicious access to LSASS.exe with dbgcore.dll/dbghelp.dll call trace from uncommon paths
Alerts on suspicious LSASS access from unusual locations when dbgcore.dll or dbghelp.dll appears in the call trace.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_accessHigh173Free2025-11-27Windows Image Load: dbgcore.dll/dbghelp.dll Loaded from Uncommon User and System Paths
Alerts when dbgcore.dll or dbghelp.dll is loaded from user or other uncommon directories on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadHigh122Free2025-11-27AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector
Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.
suktech24, Huntrule TeamAwscloudtrailHigh2010Free2025-11-27WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)
Alerts on WerFaultSecure.exe loading dbgcore.dll or dbghelp.dll, a behavior tied to EDR impairment and potential monitoring evasion.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsimage_loadMedium100Free2025-11-27Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combination
Alerts on Windows command lines containing Grixba-like mode/input/scan parameter combinations during reconnaissance.
yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh113Free2025-11-26Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
Flags node.exe or bun.exe spawning trufflehog/gitleaks to perform secret or credential scanning.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh442Free2025-11-25Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe
Alerts when ArcSOC.exe launches cmd/cscript/mshta/powershell/wscript and similar interpreters, indicating potential remote code execution.
Micah Babinski, Huntrule TeamWindowsprocess_creationHigh90Free2025-11-25ArcSOC.exe Creates Suspicious Script/Executable Files on Windows
Alerts when ArcSOC.exe creates files with script/executable extensions such as .exe, .ps1, .aspx, or .bat.
Micah Babinski, Huntrule TeamWindowsfile_eventHigh133Free2025-11-25Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)
Flags Linux cases where node or bun processes launch trufflehog or gitleaks to search for secrets.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh82Free2025-11-25Windows Process Creation: Bun executes bun_environment.js via node.exe
Flags node.exe spawning bun.exe with a command line containing bun_environment.js and a GitHub runner release download.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh428Free2025-11-25Windows Process Creation: Shai-Hulud String Indicators in Command Line
Alerts on Windows process executions whose command line includes Shai-Hulud indicator strings.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh142Free2025-11-25