Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Potential SpEL Injection Attempts Triggering Spring ExpressionException (Application Logs)
Alerts on Spring ExpressionException errors that may indicate potential SpEL injection attempts.
Moti Harmats, Huntrule TeamSpringapplicationHigh493Free2023-02-11Node.js Application Errors Involving child_process Indicative of RCE Attempts
Flags Node.js ERROR logs mentioning node:child_process, which may signal command execution and possible RCE risk.
Moti Harmats, Huntrule TeamNodejsapplicationHigh131Free2023-02-11JVM Application Logs Indicating Potential XXE via XML Parser Exceptions
Alerts on JVM XML parsing exception messages in application error logs that may indicate attempted XXE exploitation.
Moti Harmats, Huntrule TeamJvmapplicationHigh124Free2023-02-11JVM Process Execution Exceptions in Application Logs
Flags JVM error logs showing failed process execution (ProcessBuilder/ProcessImpl) that may reflect attempted command execution.
Moti Harmats, Huntrule TeamJvmapplicationHigh249Free2023-02-11Potential OGNL Expression Injection Exploitation in JVM Application Logs
Detects ERROR-level JVM application log entries containing OGNL parsing/syntax exception indicators that may suggest OGNL injection attempts.
Moti Harmats, Huntrule TeamJvmapplicationHigh222Free2023-02-11JVM Application Errors Indicating Local File Read Path Traversal Attempts
JVM app error logs with FileNotFoundException plus /../../.. patterns can indicate attempted local file path traversal.
Moti Harmats, Huntrule TeamJvmapplicationHigh391Free2023-02-11JVM Application Error Logs Indicating Potential JNDI Injection Exploitation
Alerts when JVM application error logs include JNDI/LDAP and Log4j JndiManager keyword indicators.
Moti Harmats, Huntrule TeamJvmapplicationHigh133Free2023-02-11Windows: Suspicious Executable Created in Temp by OneNote (onenote.exe/onenotem.exe/onenoteim.exe)
Alerts when OneNote creates files in Temp\OneNote with script/executable extensions on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh191Free2023-02-09Windows Registry: Outlook EnableUnsafeClientMailRules Set to 1
Alerts when Outlook’s EnableUnsafeClientMailRules registry value is enabled (DWORD 0x1), reducing mailbox macro/script protections.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh122Free2023-02-08Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript
Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh325Free2023-02-08Windows: Outlook loads outlvba.dll (VBA for Outlook add-in) via image loading
Alerts on outlvba.dll being loaded by outlook.exe, indicating VBA add-in execution within Outlook.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium162Free2023-02-08Windows: .pub File Creation in Temp or Public Directories
Alerts on creation of .pub files in Temp/Public-like directories on Windows where staging is likely.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium459Free2023-02-08Windows: Suspicious Outlook VbaProject.OTM Macro File Created
High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventHigh246Free2023-02-08Windows File Events: VBS gatherNetworkInfo results file creation
Flags Windows file writes under System32\config consistent with gatherNetworkInfo.vbs network reconnaissance output.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsfile_eventMedium279Free2023-02-08Windows Process Creation: Renamed AutoHotkey Executable via PE Metadata
Detects renamed AutoHotkey executables by correlating process creation events with PE metadata indicators.
Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationMedium202Free2023-02-07