Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,626 rules
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.
"@Kostastsale, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"Windowsprocess_creationHigh286Free2022-10-07Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.
Florian Roth (Nextron Systems), Huntrule TeamWindowssystemHigh81Free2022-10-07Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)
Flags execution of gmer.exe on Windows when matched by known process hashes.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh222Free2022-10-05Windows hh.exe Initiates HTTP(S) Network Connections
Flags hh.exe starting connections to ports 80/443, which may indicate access to remotely hosted content.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsnetwork_connectionMedium160Free2022-10-05PowerShell PSAsyncShell Reverse Shell Activity via Script Block Logging
Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsps_scriptHigh131Free2022-10-04Windows Driver Load of Known Vulnerable Drivers by File Name
Alerts when Windows loads a driver whose filename matches a list of known vulnerable drivers.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdriver_loadLow173Free2022-10-03Windows Malicious Driver Load Identified by Known Bad Driver File Names
Alerts when Windows loads a driver whose file name matches a curated list of known malicious/suspicious drivers.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsdriver_loadMedium162Free2022-10-03Windows Registry: Disable Privacy Settings Experience via DisablePrivacyExperience Policy
Flags Windows registry policy changes that disable the Privacy Settings Experience by setting DisablePrivacyExperience to 0x00000000.
frack113, Huntrule TeamWindowsregistry_setMedium211Free2022-10-02Windows: Process creation of UltraVNC VNCViewer (VNCViewer.exe)
Flags execution of UltraVNC VNCViewer.exe on Windows based on process creation metadata.
frack113, Huntrule TeamWindowsprocess_creationMedium344Free2022-10-02Windows Registry: Modify User Shell Folders Startup Values for Persistence
Alerts on Windows Registry changes to User Shell Folders startup-related values that may be used to establish persistence.
frack113, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsregistry_setHigh403Free2022-10-01Windows Process Creation: China Chopper Webshell Command Pattern via W3WP
Flags w3wp.exe-launched commands matching China Chopper webshell execution patterns in Windows process creation logs.
Florian Roth (Nextron Systems), MSTI (query), Huntrule TeamWindowsprocess_creationHigh331Free2022-10-01Windows Suspicious Use of shutdown.exe to Log Off a User
Flags Windows executions of shutdown.exe with /l to log a user off.
frack113, Huntrule TeamWindowsprocess_creationMedium133Free2022-10-01Windows PDQ Deploy Console Execution
Alerts on Windows execution of PDQ Deploy Console (PDQDeployConsole.exe) based on process metadata.
frack113, Huntrule TeamWindowsprocess_creationMedium281Free2022-10-01Windows RDP Registry Settings Modified to Zero
Alerts when RDP-related registry values are set to 0, potentially weakening remote access controls.
Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali, Huntrule TeamWindowsregistry_setMedium253Free2022-09-29Atlassian Bitbucket Command Injection Attempt via Archive API Parameters (Webserver)
Alerts on Bitbucket REST archive query parameters containing a %00--exec execution marker.
Nasreddine Bencherchali (Nextron Systems), Huntrule Team—webserverHigh102Free2022-09-29