Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
407 rules
Kubernetes Privileged Pod Created via Pod Creation Requests
Flags Kubernetes pod creates where container capabilities are set to all, indicating possible privileged access setup.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow384Free2024-03-26Kubernetes Pod Created With hostPath Volume Mount
Alerts on Kubernetes pod creation requests that include a hostPath volume mount.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow226Free2024-03-26Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
Leo Tsaousis (@laripping), Huntrule TeamKubernetesapplicationLow113Free2024-03-26Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow142Free2024-03-19Windows TeamViewer Remote Session Process Command Line Start
Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.
Josh Nickels, Qi Nan, Huntrule TeamWindowsprocess_creationLow332Free2024-03-11macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow194Free2024-03-11TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow4010Free2024-03-11Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType
Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.
"@SerkinValery, Huntrule Team"WindowssystemLow91Free2024-03-07Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)
Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.
"@SerkinValery, Huntrule Team"WindowssystemLow364Free2024-03-07GitHub Audit: Secret Scanning Push Protection Bypass Event Detected
Triggers on GitHub audit events indicating a secret scanning push protection bypass attempt.
Muhammad Faisal (@faisalusuf), Huntrule TeamGithubauditLow255Free2024-03-07Windows Shell Context Menu Registry Command Tampering
Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow80Free2024-03-06Windows DNS Queries to update.onelaunch.com by OneLaunch.exe
Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.
Josh Nickels, Huntrule TeamWindowsdns_queryLow132Free2024-02-26Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository
Flags Bitbucket audit events indicating secret scanning rules were deleted at the project or repository level.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow173Free2024-02-25Bitbucket audit: Project secret scanning allowlist rule added
Alerts when Bitbucket records a project secret scanning allowlist rule being added via the audit log.
Muhammad Faisal (@faisalusuf), Huntrule TeamBitbucketauditLow427Free2024-02-25Windows sc.exe Service Query for termservice Enumeration
Alerts on sc.exe service querying that references termservice on Windows.
Swachchhanda Shrawan Poudel, Huntrule TeamWindowsprocess_creationLow321Free2024-02-12