Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Image Load of Specific System DLLs Not Normally Present in System Directories
Alerts on image load events for specific system-path DLLs with unexpected “phantom” DLL names on Windows.
Nasreddine Bencherchali (Nextron Systems), SBousseaden, Huntrule TeamWindowsimage_loadHigh201Free2022-12-09Windows Registry: LSASS Full Dump via WER LocalDumps DumpType=2
Flags registry changes enabling LSASS full memory dumps by setting WER LocalDumps DumpType to 0x2.
"@pbssubhash, Huntrule Team"Windowsregistry_setHigh292Free2022-12-08Windows: LSASS Dump (.dmp) Files in CrashDumps Folder
Alerts when an lsass.exe dump (.dmp) appears in the Windows CrashDumps directory under systemprofile.
"@pbssubhash, Huntrule Team"Windowsfile_eventHigh479Free2022-12-08Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)
Alerts on Application Error (Event ID 1000) entries where lsass.exe crashes, using Windows Application event telemetry.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsapplicationHigh2510Free2022-12-07Windows windefend alerts on suspicious Windows Defender configuration changes (Disable* and SpyNet reporting)
Alerts on windefend Event 5007 when Defender configuration changes set features like anti-spyware, scanning, or SpyNet reporting to disabled values.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowswindefendHigh356Free2022-12-06Windows Windefend: Defender Restored File from Quarantine (EventID 1009)
Alerts on Windows Defender Windefend events indicating an item was restored from quarantine (Event ID 1009).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowswindefendHigh161Free2022-12-06Windows Defender SubmitSamplesConsent Disabled (Real-Time Protection)
Flags Windows Defender configuration changes disabling automatic sample submission (SubmitSamplesConsent=0x0).
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowswindefendLow359Free2022-12-06Windows Process Creation: Command Line Contains Emoji Characters
Alerts on Windows process executions whose command line includes emoji/symbol characters from a predefined list.
"@Kostastsale, TheDFIRReport, Huntrule Team"Windowsprocess_creationHigh4010Free2022-12-05Windows Process Command Line Contains Emoji Characters
Alerts when a Windows process command line includes emoji characters, which can be used to obscure activity or bypass naive detections.
"@Kostastsale, TheDFIRReport, Huntrule Team"Windowsprocess_creationHigh181Free2022-12-05Windows Process Creation: Command Line Contains Specific Emoji Characters
Alerts when a Windows process command line includes specific emoji Unicode characters that may be used for evasion or obfuscation.
"@Kostastsale, TheDFIRReport, Huntrule Team"Windowsprocess_creationHigh255Free2022-12-05Windows Process Creation Command-Line Contains Emoji Characters
Alerts on Windows executions whose command line includes emoji Unicode characters.
"@Kostastsale, TheDFIRReport, Huntrule Team"Windowsprocess_creationHigh359Free2022-12-05Windows: Elevated PowerShell or CMD Spawned from Uncommon Parent Location
Alerts on elevated PowerShell/CMD executions whose parent process comes from uncommon Windows locations, indicating likely privilege escalation.
frack113, Tim Shelton (update fp), Huntrule TeamWindowsprocess_creationMedium242Free2022-12-05Windows Process Creation: Renamed Mavinject32/64.EXE Execution
Alerts on renamed executions of mavinject32.exe/mavinject64.exe based on OriginalFileName and image path.
frack113, Florian Roth, Huntrule TeamWindowsprocess_creationHigh279Free2022-12-05Windows Scheduled Task Execution of Uncommon Binaries (LOLBin Suspicion)
Alerts when a Windows Scheduled Task runs a process from a set of uncommon/suspicious binary paths.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowstaskschedulerMedium213Free2022-12-05Windows Scheduled Task Process Run from Suspicious File Locations
Alerts on Windows Task Scheduler process creation when the executed program runs from temp, downloads, desktop, or public-writable paths.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowstaskschedulerMedium436Free2022-12-05