Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows: ssh.exe Used as Proxy/Local Command Launcher via ProxyCommand and LocalCommand
Detects Windows executions of ssh.exe that use ProxyCommand and PermitLocalCommand/LocalCommand to launch proxied or local commands.
frack113, Nasreddine Bencherchali, Huntrule TeamWindowsprocess_creationMedium329Free2022-12-29Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features
Alerts on PowerShell Enable-WindowsOptionalFeature used with -Online to enable listed optional features.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium525Free2022-12-29Windows: Detect unregmp2.exe used to proxy-launch wmpnscfg.exe with /HideWMP
Flags Windows executions of unregmp2.exe with /HideWMP, indicating proxy-style launching behavior.
frack113, Huntrule TeamWindowsprocess_creationMedium414Free2022-12-29Windows: Detect runexehelper.exe used to proxy-launch other programs
Flags process executions where runexehelper.exe is the parent, suggesting proxy-based launching of other programs.
frack113, Huntrule TeamWindowsprocess_creationMedium182Free2022-12-29macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery
Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium151Free2022-12-28Linux Process Execution via Vim/Vi/Rvim/Vimdiff Shell and Script Escapes
Detects suspicious Vim/vi/vimdiff/rvim invocations that include Ex commands to run shell/proxy actions.
Nasreddine Bencherchali (Nextron Systems), Luc Génaux, Huntrule TeamLinuxprocess_creationHigh396Free2022-12-28Linux find Command Used to Discover SUID/SGID and World-Writable Files
Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium539Free2022-12-28Linux Privilege Capability Discovery via getcap
Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationLow212Free2022-12-28Linux process execution via apt/apt-get Pre-Invoke shell command
Detects apt/apt-get executions using APT::Update::Pre-Invoke to trigger shell-like command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium151Free2022-12-28Windows RDP Session Hijacking via tscon.exe from System Integrity
Flags tscon.exe executions on Windows running at System integrity, indicating potential RDP session hijacking.
"@juju4, Huntrule Team"Windowsprocess_creationMedium225Free2022-12-27Windows PowerShell Token Obfuscation via Process Command Line
Identifies Windows PowerShell command lines using token obfuscation patterns, common in Invoke-Obfuscation.
frack113, Huntrule TeamWindowsprocess_creationHigh3310Free2022-12-27SharpImpersonation Tool Execution on Windows
Flags execution of SharpImpersonation.exe on Windows when command-line parameters indicate token impersonation activity.
Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh163Free2022-12-27Windows: Execution of Htran/NATBypass HackTool Binaries or Tran/Slave CLI Flags
Detects Windows executions of htran.exe or lcx.exe and command lines containing -tran or -slave flags.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh191Free2022-12-27Database SQL keyword matching suspicious queries (DROP/TRUNCATE/DUMP/SELECT *)
Alerts on SQL queries containing DROP, TRUNCATE, DUMP, or SELECT * indicative of potentially malicious database activity.
"@juju4, Huntrule Team"—databaseMedium102Free2022-12-27Windows PowerShell script token obfuscation via backtick and dynamic expression patterns
Find PowerShell script blocks that show token obfuscation patterns resembling Invoke-Obfuscation behavior.
frack113, Huntrule TeamWindowsps_scriptMedium110Free2022-12-27