Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,607 rules
Okta Failed Login with Password-Like AlternateID Value
Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.
kelnage, Huntrule TeamOktaoktaHigh133Free2023-04-03Possible ICO C2 File Downloads via Proxy: Compromised 3CXDesktopApp
Flags proxy requests for 3CXDesktopApp icon storage URIs ending in .ico, indicating potential malicious payload downloads.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—proxyHigh268Free2023-03-31Windows DLL Image Load Identified by Hashes for Compromised 3CXDesktopApp Components
Flags DLL loads in Windows when loaded module hashes match known compromised 3CXDesktopApp-related files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadCritical2510Free2023-03-31Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise
Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—proxyHigh3810Free2023-03-29Windows: Flag 3CXDesktopApp updater fetching a known compromised update URL
Alerts on 3CXDesktopApp updater.exe launched with update arguments pointing to a known compromised HTTP update path.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh245Free2023-03-29Windows Process Creation: Suspicious Child Executables Spawned by 3CXDesktopApp.exe
Alerts on suspicious execution utilities spawned by 3CXDesktopApp.exe via Windows process creation events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh161Free2023-03-29Windows Process Creation: 3CXDesktopApp Execution from Known Compromised Hashes
Alerts when 3CXDesktopApp.exe executes on Windows with hash/version indicators matching known compromised binaries.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh91Free2023-03-29Windows 3CXDesktopApp.exe Beaconing to Suspicious 3CX-Related Domains (Netcon)
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh189Free2023-03-29Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise
Potential Compromised 3CXDesktopApp Beaconing Activity - DNS
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns_queryHigh235Free2023-03-29Windows Defender Real-Time Protection Error or Restart (windefend Event 3002/3007)
Alerts on windefend events showing Defender Real-Time Protection feature errors (3002) or restarts (3007).
Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update), Huntrule TeamWindowswindefendMedium3410Free2023-03-28Windows Process Creation: Sysinternals PsSuspend Targeting msmpeng.exe
Alerts on execution of Sysinternals PsSuspend with command line referencing msmpeng.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh468Free2023-03-23Windows Sysinternals PsSuspend Process Execution
Alerts on execution of Sysinternals PsSuspend on Windows via process creation events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium60Free2023-03-23Windows DLL sideloading: iviewers.dll loaded from non-Windows Kits paths
Alerts on unexpected loads of iviewers.dll outside Windows Kits paths, consistent with DLL sideloading attempts.
X__Junior (Nextron Systems), Huntrule TeamWindowsimage_loadHigh133Free2023-03-21Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)
Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.
Harjot Singh, '@cyb3rjy0t', Huntrule TeamAzuresigninlogsHigh172Free2023-03-20macOS sysadminctl Used to Add User to Admin Group
Alerts when sysadminctl is used with -addUser and -admin to add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium113Free2023-03-19