Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows DLL Sideloading via comctl32.dll in .local directories
Alerts on comctl32.dll loaded from System32 .local folders, consistent with Windows DLL sideloading.
Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash), Huntrule TeamWindowsimage_loadHigh5010Free2022-12-16Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32
Detects System32 *.exe.local entries that reference comctl32.dll, consistent with DLL sideloading behavior.
Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash), Huntrule TeamWindowsfile_eventHigh231Free2022-12-16Windows DLL Sideloading Indicator: JsSchHlp Loads JSESPR.dll from Untrusted Path
Alerts on unexpected loads of \JSESPR.dll, indicating possible DLL sideloading outside the Justsystem JsSchHlp directory.
frack113, Huntrule TeamWindowsimage_loadMedium193Free2022-12-14Windows DLL Sideloading: ClassicExplorer32.dll Loaded from Unexpected Path
Alerts when ClassicExplorer32.dll is loaded from unexpected locations, suggesting possible DLL sideloading behavior.
frack113, Huntrule TeamWindowsimage_loadMedium112Free2022-12-13AWS SES Identity Deleted via CloudTrail DeleteIdentity Event
Flags CloudTrail events showing an SES identity was deleted using the DeleteIdentity API.
Janantha Marasinghe, Huntrule TeamAwscloudtrailMedium336Free2022-12-13Potential CVE-2021-26084 Confluence OGNL RCE Exploitation Attempt via POST
Flags successful POST requests consistent with OGNL injection attempts targeting Confluence page variable endpoints tied to CVE-2021-26084.
Sittikorn S, Nuttakorn T, Huntrule Team—webserverHigh111Free2022-12-13Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text
Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.
frack113, Huntrule TeamWindowsregistry_setHigh323Free2022-12-11Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables
Identifies uncommon setres.exe children matching '\choice' while excluding System32/SysWOW64 choice.exe.
"@gott_cyber, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"Windowsprocess_creationHigh212Free2022-12-11Windows: Detect rcedit editing PE version/resource metadata via --set-*
Alerts on rcedit command-line usage that sets PE metadata fields to alter executable file properties.
Micah Babinski, Huntrule TeamWindowsprocess_creationMedium153Free2022-12-11Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe
Alerts on mklink creating a symlink between osk.exe and cmd.exe, enabling potential login-screen privilege escalation.
frack113, Huntrule TeamWindowsprocess_creationHigh4810Free2022-12-11Apache Solr CVE-2021-27905 Exploitation Attempt via Web Requests
Alerts when webserver logs show GET requests to Solr endpoints containing CVE-2021-27905-style debug/dump or fetchindex parameters with HTTP 200.
"@gott_cyber, Huntrule Team"—webserverMedium91Free2022-12-11Windows PowerShell nslookup DNS TXT Download Cradle
Identifies PowerShell launching an nslookup-based cradle that queries TXT records with HTTP-related nslookup parameters.
Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam, Huntrule TeamWindowsps_classic_startMedium367Free2022-12-10Windows ETW Logging Disabled via SCM Registry TracingDisabled Key
Detects SCM ETW logging being disabled by setting the TracingDisabled registry DWORD for services.exe.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow162Free2022-12-09Windows Registry Change Disables ETW for rpcrt4.dll via ExtErrorInformation
Flags Windows registry updates that disable ETW logging for rpcrt4.dll through ExtErrorInformation.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsregistry_setLow335Free2022-12-09Windows Process Creation: conhost.exe with High IntegrityLevel and -ForceV1
Flags conhost.exe started with -ForceV1 from a High integrity process on Windows.
frack113, Huntrule TeamWindowsprocess_creationInformational153Free2022-12-09