Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows File Creation of dllhost.exe in Public Documents Used by COLDSTEEL RAT Variants
Flags creation of C:\users\public\Documents\dllhost.exe on Windows, matching an indicator seen in some COLDSTEEL RAT variants.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh101Free2023-04-30Windows Winlogon Outbound Network Connections to Public IPs
Flags outbound connections initiated by winlogon.exe to non-local public destination IPs on Windows.
Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule TeamWindowsnetwork_connectionMedium141Free2023-04-28Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)
Identifies PowerShell ScriptBlock content that includes Rubeus-specific Kerberos and ticket manipulation flags.
Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems), Huntrule TeamWindowsps_scriptHigh386Free2023-04-27Windows Security: Security-Enabled Global Group Deletion (Event ID 4730/634)
Alerts on Windows Security audit events indicating a security-enabled global group was deleted.
Alexandr Yampolskyi, SOC Prime, Huntrule TeamWindowssecurityLow271Free2023-04-26Windows Security Log: Member Removed from Security-Enabled Global Group
Flags Windows Security Log events showing a member was removed from a security-enabled global group.
Alexandr Yampolskyi, SOC Prime, Huntrule TeamWindowssecurityLow172Free2023-04-26Windows Security: Member Added to Security-Enabled Global Group
Alerts when Windows logs show a user was added to a security-enabled global group via Event ID 4728 or 632.
Alexandr Yampolskyi, SOC Prime, Huntrule TeamWindowssecurityLow344Free2023-04-26Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)
Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh271Free2023-04-25Suspicious Windows Network Connections to External IP Lookup Service APIs
Alerts on non-browser outbound connections from Windows hosts to public IP lookup API domains.
Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium496Free2023-04-24Linux Process Creating xterm Reverse Shell Display Tunneling
Alerts on xterm processes started with -display and display endpoint ":1" consistent with a reverse shell tunnel.
"@d4ns4n_, Huntrule Team"Linuxprocess_creationMedium2910Free2023-04-24Linux Python Reverse Shell via pty and socket Module Execution
Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.
"@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"Linuxprocess_creationHigh298Free2023-04-24Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line
Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium123Free2023-04-21Windows Application: MSMQ Corrupted Packet (Event ID 2027, Level 2)
Alerts on MSMQ Event ID 2027 (level 2) indicating corrupted packets received by the service.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsapplicationHigh212Free2023-04-21Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File
Alerts when schtasks.exe creates a scheduled task using -XML but the referenced file does not end with .xml.
Swachchhanda Shrawan Poudel, Elastic (idea), Huntrule TeamWindowsprocess_creationMedium302Free2023-04-20Windows: Suspicious child processes spawned by pc-app.exe (PaperCut MF/NG potential exploitation)
Alert on pc-app.exe spawning common command or scripting utilities on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea), Huntrule TeamWindowsprocess_creationHigh326Free2023-04-20Windows: Detect suspicious PowerShell/Lsass tool execution launched by ManageEngine (ServiceDesk)
Alerts on suspicious child PowerShell/LSASS/tool activity launched by ManageEngine ServiceDesk (Java parent) on Windows.
Nasreddine Bencherchali (Nextron Systems), MSTIC (idea), Huntrule TeamWindowsprocess_creationCritical160Free2023-04-20