Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

2 rules

Suspicious Shell Spawned by ActiveMQ Java Process
This rule detects a Linux shell being spawned as a child of an Apache ActiveMQ Java process, the exploitation pattern of CVE-2023-46604 remote code execution. Attackers trigger the deserialization flaw to run shell commands and fetch second-stage payloads. A Java broker process launching an interactive shell is a clear post-exploitation signal.
HuntRule TeamLinuxprocess_creationHigh10
Premium2026-09-13
Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)
This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.
HuntRule TeamWindowsprocess_creationHigh60
Premium2026-09-06