Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Security: Suspicious Scheduled Task Update via Event ID 4702 Keywords
Alerts when a scheduled task is updated (EventID 4702) and the new task content includes suspicious execution keywords or temp/user paths.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityHigh181Free2022-12-05Windows Security Audit: Scheduled Task Deleted or Disabled (Important Task Names)
Alerts on deletion or disabling of important Windows scheduled tasks based on Security audit events 4699 and 4701.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityHigh485Free2022-12-05Windows Security: Suspicious Scheduled Task Creation via Event 4698
Alerts on Windows scheduled task creation (EventID 4698) when TaskContent contains suspicious directories or command patterns.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityHigh153Free2022-12-05Windows Process Creation: SysmonEOP.exe HackTool Execution (CVE-2022-41120 PoC)
Alert on Windows process execution of \SysmonEOP.exe with specific IMPhashes associated with the SysmonEOP PoC.
Florian Roth (Nextron Systems), Huntrule TeamWindowsprocess_creationCritical328Free2022-12-04Windows Process Execution of wsudo with System or TrustedInstaller
Alerts on wsudo.exe runs from wsudo-bridge.exe requesting execution as System or TrustedInstaller.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh355Free2022-12-02Windows DLL Sideloading: WmiApSrv Loads VMGuestLib.dll
Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadMedium357Free2022-12-01Windows DLL Sideloading via Loading ShellChromeAPI.dll
Alerts when Windows processes attempt to load ShellChromeAPI.dll, a DLL typically not present on systems.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsimage_loadHigh162Free2022-12-01Windows: Creation of Non-Existent System DLLs in System32 Paths
Alerts when targeted non-existent system DLL filenames are created in Windows system directories, indicating potential DLL hijacking setup.
Nasreddine Bencherchali (Nextron Systems), fornotes, Huntrule TeamWindowsfile_eventMedium301Free2022-12-01Windows: Gpg4win (GnuPG) Encrypt/Decrypt Command Using Suspicious File Paths
Flags Gpg4win/GnuPG file crypto commands using -passphrase with activity in temporary/public or suspicious Windows directories.
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh172Free2022-11-30Windows PowerTool Process Execution
Flags Windows process creation events where PowerTool.exe/PowerTool64.exe is launched.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh4910Free2022-11-29Windows Service Installation: TacticalRMM Agent Service (SCM Event 7045)
Flags Windows service installations that include tacticalrmm.exe and the TacticalRMM Agent Service using SCM Event ID 7045.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium141Free2022-11-28Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)
Flags Windows Event ID 7045 service installations that reference MeshAgent.exe or “Mesh Agent”.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssystemMedium382Free2022-11-28Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent
Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.
Janantha Marasinghe, Huntrule TeamAzuresigninlogsHigh211Free2022-11-27Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line
Flags Windows processes whose command lines reference Event Viewer RecentViews and use redirection, consistent with UAC bypass techniques.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh192Free2022-11-22Windows Registry NGenAssemblyUsageLog Key Tampering via .NET Usage Log Configuration
Alerts on registry modifications to the .NETFramework NGenAssemblyUsageLog key that can disrupt .NET Usage Log creation.
frack113, Huntrule TeamWindowsregistry_setHigh216Free2022-11-18