Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Suspicious Child Processes Spawned by Browsers on macOS
Alerts on browser-launched child processes on macOS where the child is a shell or scripting/utility binary, excluding known benign browser scripts.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium152Free2023-04-05Windows SMB Client: Failed External Connection Attempts Matching CVE-2023-23397 Indicators
Identifies Windows SMB client failures to connect to external SMB servers by correlating specific SMB connectivity event IDs with non-private remote addresses.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssmbclient-connectivityMedium393Free2023-04-05Windows Registry Changes for Outlook Task/Note Reminder Trigger
Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow251Free2023-04-05Windows: Rorschach execution indicator via critical command-line pattern
Windows process creation events with certain system utilities and a "11111111" command-line marker are flagged as ransomware execution activity.
X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical233Free2023-04-04macOS: Process execution of osacompile by applet/osascript child processes
Flags macOS applet or osascript processes launching command lines that contain osacompile.
Sohan G (D4rkCiph3r), Red Canary (Idea), Huntrule TeamMacosprocess_creationMedium135Free2023-04-03Okta Failed Login with Password-Like AlternateID Value
Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.
kelnage, Huntrule TeamOktaoktaHigh223Free2023-04-03Possible ICO C2 File Downloads via Proxy: Compromised 3CXDesktopApp
Flags proxy requests for 3CXDesktopApp icon storage URIs ending in .ico, indicating potential malicious payload downloads.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—proxyHigh268Free2023-03-31Windows DLL Image Load Identified by Hashes for Compromised 3CXDesktopApp Components
Flags DLL loads in Windows when loaded module hashes match known compromised 3CXDesktopApp-related files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadCritical2810Free2023-03-31Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise
Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—proxyHigh4110Free2023-03-29Windows: Flag 3CXDesktopApp updater fetching a known compromised update URL
Alerts on 3CXDesktopApp updater.exe launched with update arguments pointing to a known compromised HTTP update path.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh285Free2023-03-29Windows Process Creation: Suspicious Child Executables Spawned by 3CXDesktopApp.exe
Alerts on suspicious execution utilities spawned by 3CXDesktopApp.exe via Windows process creation events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh171Free2023-03-29Windows Process Creation: 3CXDesktopApp Execution from Known Compromised Hashes
Alerts when 3CXDesktopApp.exe executes on Windows with hash/version indicators matching known compromised binaries.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh101Free2023-03-29Windows 3CXDesktopApp.exe Beaconing to Suspicious 3CX-Related Domains (Netcon)
Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionHigh219Free2023-03-29Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise
Potential Compromised 3CXDesktopApp Beaconing Activity - DNS
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdns_queryHigh345Free2023-03-29Windows Defender Real-Time Protection Error or Restart (windefend Event 3002/3007)
Alerts on windefend events showing Defender Real-Time Protection feature errors (3002) or restarts (3007).
Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update), Huntrule TeamWindowswindefendMedium3810Free2023-03-28