Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows nltest.exe Execution for Network Information Discovery
Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.
Arun Chauhan, Huntrule TeamWindowsprocess_creationLow180Free2023-02-03Windows cmdkey.exe Adds Generic Credentials via -g Flag
Flags -g/-u/-p with cmdkey.exe indicate generic credential insertion, which can enable follow-on access.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium504Free2023-02-03Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.
"@kostastsale, Huntrule Team"Windowsprocess_creationHigh130Free2023-02-02Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation
Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium487Free2023-01-31Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation
Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium163Free2023-01-31macOS OSACompile Run-Only Script Execution
Flags osacompile commands on macOS using run-only (-x) with inline script (-e) execution.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh541Free2023-01-31macOS Office Apps Spawning Shell or Scripting Processes
Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh369Free2023-01-31macOS JXA In-Memory Execution via osascript JavaScript eval and NSData URL loading
Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh193Free2023-01-31macOS osascript Clipboard Access via AppleScript Commands
Alerts on osascript commands that reference the system clipboard, which may indicate collection or automation misuse on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium282Free2023-01-31Linux process copying passwd or shadow from /tmp
Alerts on Linux cp commands that copy /tmp-based passwd or shadow files.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationHigh391Free2023-01-31Windows PowerShell Base64-Encoded WMI Class Invocation
Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.
Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh112Free2023-01-30GitHub Audit Log: New Organization Member Added or Invited
Alerts on GitHub org audit events where a member is added or invited to a new or existing organization.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditInformational141Free2023-01-29GitHub Audit: High-Risk Security Controls Disabled
Alerts when GitHub audit logs show advanced security, OAuth restrictions, or 2FA requirements disabled for orgs or repos.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditHigh203Free2023-01-29Windows Registry: Monitor PendingFileRenameOperations changes from suspicious images
Alerts on registry tampering of PendingFileRenameOperations by processes running from suspicious image paths.
frack113, Huntrule TeamWindowsregistry_setMedium111Free2023-01-27GitHub Audit Log: Self-Hosted Runner Configuration Changes
Alerts on GitHub audit log events indicating self-hosted runner registration and runner group configuration changes.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditLow162Free2023-01-27