Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: Suspicious Git Clone Command With Vulnerability Keywords
Flags Windows git clone commands that include exploit/vulnerability-style keywords in the process command line.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium519Free2023-01-03Linux process execution matches known hacktools by image name
Alerts on Linux process executions of known hacktool, scanner, web enumeration, and exploit utility binaries by image name.
Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]), Huntrule TeamLinuxprocess_creationHigh403Free2023-01-03Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords
Alerts on Linux "git clone" commands that include exploit/vulnerability-related keywords or CVE/PoC-style terms.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium454Free2023-01-03Linux Package Installation via apt/yum/rpm/dpkg with Networking Tools Keywords
Alerts when apt/yum/rpm/dpkg install commands include reconnaissance or proxy tool keywords.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium608Free2023-01-03Windows Registry EventLog Service File Location Tampering
Flags registry modifications that change the EventLog service’s configured log file location on Windows.
D3F7A5105, Huntrule TeamWindowsregistry_setHigh241Free2023-01-02Windows Ruby Inline Code Execution via Ruby.exe -e Flag
Flags Windows executions of ruby.exe that include the inline code flag (-e) for direct command-line Ruby code.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium203Free2023-01-02Windows Process Creation: Python Executed with the -c Inline Code Flag
Flags Windows executions of python.exe with -c inline code, excluding common installer/baseline and VS Code contexts.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium171Free2023-01-02Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools
Alerts on Windows process launches whose command line includes well-known malicious PowerShell commandlet names.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh122Free2023-01-02Windows: Inline PHP execution via php.exe -r flag
Flags Windows process executions of php.exe with the inline "-r" code execution flag.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium173Free2023-01-02Windows Process Creation: Perl Inline Code Execution via -e/-E
Flags command-line usage of perl.exe with inline execution (-e) on Windows process creation events.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium235Free2023-01-02Windows: Monitor .evtx File Creation Outside Standard Event Log Directories
Flags creation of .evtx files outside typical Windows event log directories to support event log evasion or export.
D3F7A5105, Huntrule TeamWindowsfile_eventMedium3810Free2023-01-02Windows Process Creation: Uncommon Child Processes Spawned by DefaultPack.EXE
Alerts when DefaultPack.exe spawns an uncommon child process, indicating potential proxy execution on Windows.
frack113, Huntrule TeamWindowsprocess_creationMedium556Free2022-12-31Windows Image Load: coregen.exe Potential DLL Sideloading
Identifies potential DLL sideloading when coregen.exe loads DLLs outside expected system and Silverlight locations.
frack113, Huntrule TeamWindowsimage_loadMedium528Free2022-12-31Windows SharpLDAPmonitor HackTool Execution via Image Name and Credential/DC Flags
Flags SharpLDAPmonitor execution on Windows with LDAP-related command-line parameters.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium123Free2022-12-30Linux auditd: Access to hidden files or hidden directories (/. paths)
Alerts when Linux auditd shows PATH values referencing hidden files or hidden directories (excluding common dev/cache paths).
David Burkett, @signalblur, Huntrule TeamLinuxauditdLow178Free2022-12-30