Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Linux Service File Touch with Timestamp Argument
Alerts when touch is executed with a timestamp flag on a .service file, indicating potential stealthy service manipulation.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamLinuxprocess_creationMedium192Free2023-01-11Windows Process Creation: PowerShell Import-Module from Temp/AppData/Public Paths
Alerts on PowerShell Import-Module calls that load modules from Temp, AppData, or Public directories on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium446Free2023-01-10Azure Sign-In: Successful single-factor atRisk logins from non-registered devices
Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.
Harjot Singh, '@cyb3rjy0t', Huntrule TeamAzuresigninlogsHigh150Free2023-01-10PowerShell script alias obfuscation via -Value (-join(...))
Flags PowerShell script blocks that set aliases using -Value with a (-join(...)) character-joining obfuscation pattern.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptLow427Free2023-01-09Juniper BGP Logs: Missing MD5 Digest in Route Authentication
Flags Juniper BGP log messages indicating a missing MD5 digest, highlighting potential exposure from unauthenticated routing sessions.
Tim Brown, Huntrule TeamJuniperbgpLow171Free2023-01-09Huawei BGP Authentication Failures Indicating Failed Session Attempts
Flags Huawei BGP authentication failure log events that may indicate credential attempts or routing manipulation.
Tim Brown, Huntrule TeamHuaweibgpLow296Free2023-01-09Cisco LDP MD5 Authentication Failure Events
Flags Cisco LDP TCP MD5 authentication failure events that may indicate brute-force attempts to affect MPLS label signaling.
Tim Brown, Huntrule TeamCiscoldpLow142Free2023-01-09Cisco BGP Authentication Failure Events Indicating Potential Credential Attacks
Flags Cisco BGP authentication failure events associated with TCP/179 traffic that may indicate credential abuse.
Tim Brown, Huntrule TeamCiscobgpLow318Free2023-01-09Windows PowerShell: Detect Set-Alias/New-Alias Usage in Script Block Logging
Alerts on PowerShell scripts that create aliases via Set-Alias/New-Alias, a common obfuscation technique, using ScriptBlockText logging.
frack113, Huntrule TeamWindowsps_scriptLow525Free2023-01-08Windows Suspicious Double-Extension Execution via Parent Command Line
Alerts on Windows processes launched by parents whose image/command line includes disguised double-extension tokens.
frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh259Free2023-01-06AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole
Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.
Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule TeamAwscloudtrailLow152Free2023-01-06Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns
Detects suspicious PowerShell process command lines using hidden/no-profile, execution-policy bypass, and encoded/Base64 or IEX WebClient download patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium163Free2023-01-05Windows PowerShell: ScriptBlock using security descriptor (Win32_Trustee/Win32_Ace) and LSA data strings
Alerts on PowerShell ScriptBlock text that manipulates security descriptors and LSA-related identifiers, indicating possible persistence behavior.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptHigh442Free2023-01-05Windows Registry AMSI COM Server Hijacking via InProcServer32 CLSID Modification
Alerts on registry changes that alter an AMSI COM CLSID InProcServer32 entry to break AMSI loading.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setHigh538Free2023-01-04Windows PowerShell Keylogger Function Reference in Script Block Logging
Alerts on PowerShell script blocks containing keyboard IsKeyDown references associated with potential keystroke capture.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptMedium191Free2023-01-04