Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags
Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule TeamWindowsprocess_creationHigh152Free2023-02-15Windows: CertOC.exe Loading a DLL from User-Writable Paths via -LoadDLL
Alerts on CertOC.exe using -LoadDLL with DLLs from temp/user-writable directories on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh100Free2023-02-15Windows PowerShell Console History File Deleted (PSReadLine)
Flags deletion of the PowerShell PSReadLine ConsoleHost_history.txt file, which can remove command history evidence.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium112Free2023-02-15Windows Event Log EVTX File Deletion in winevt\Logs
Flags deletion of Windows Event Log .evtx files under System32\winevt\Logs.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_deleteMedium353Free2023-02-15Windows Process Execution of Script Interpreters After Extraction from Compressed Files
Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.
"@kostastsale, Huntrule Team"Windowsprocess_creationMedium100Free2023-02-15Windows WMIC Remote Query Execution via /node
Identifies remote WMIC queries on Windows by matching WMIC execution with /node: in the command line.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium202Free2023-02-14Windows WMIC.exe Service Reconnaissance via Remote Service Queries
Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium395Free2023-02-14Windows WMIC.exe Product Class Reconnaissance via Security Product Queries
Detects wmic.exe being used to enumerate firewall, antivirus, and antispyware product classes.
Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium2010Free2023-02-14Windows WMIC Product Reconnaissance via Firewall/AV Enumeration
Alerts on wmic.exe executions with command lines consistent with Windows product enumeration for reconnaissance.
Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationMedium184Free2023-02-14Windows wmic.exe Hardware Model Reconnaissance Using csproduct
Flags wmic.exe executions that include "csproduct" to query hardware model/vendor details.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium409Free2023-02-14Windows execution of LocalPotato POC (LocalPotato.exe with specific PE/CLI traits)
Detects LocalPotato.exe process execution on Windows using image path, typical CLI parameters, and known imphash values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh131Free2023-02-14Windows Suspicious Execution of Regasm/Regsvcs With Uncommon Command-Line Extension
Flags Regasm.exe/Regsvcs.exe runs that include unusual extensions in the command line, which may indicate stealthy misuse.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium331Free2023-02-13Windows: Filter Driver Unload via fltMC.exe
Flags fltMC.exe executions that include "unload" to indicate potential filter driver unloading for defense impairment.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium203Free2023-02-13Potential CVE-2022-21587 Arbitrary File Upload Attempts via Oracle EBS Web Services
Alerts on POST requests with uueupload=TRUE targeting specific Oracle EBS OA_HTML services associated with CVE-2022-21587.
Isa Almannaei, Huntrule Team—webserverHigh183Free2023-02-13Velocity Application Errors Indicating Potential Server-Side Template Injection
Detects Velocity template rendering exceptions in application error logs that may indicate user-influenced SSTI attempts.
Moti Harmats, Huntrule TeamVelocityapplicationHigh132Free2023-02-11