Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
8 rules
Antivirus Remote Access Tool Signature Matches Known RAT Names
Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.
Arnim Rupp (Nextron Systems), Huntrule Team—antivirusCritical162Free2026-06-15Windows MeshAgent Remote Access Tool Command Line Execution Indicators
Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamWindowsprocess_creationMedium120Free2025-05-19macOS Process Creation: MeshAgent renamed execution via --meshServiceName
Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.
Norbert Jaśniewicz (AlphaSOC), Huntrule TeamMacosprocess_creationHigh214Free2025-05-19Windows SimpleService Execution via Remote Access Tool Wrapper Paths
Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowsprocess_creationMedium172Free2024-02-23Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)
Flags Windows service installation or updates for remote access tool services using Service Control Manager events.
Connor Martin, Nasreddine Bencherchali, Huntrule TeamWindowssystemMedium448Free2022-12-23Windows Security Event 4697 Service Install of Remote Access Tools
Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.
Connor Martin, Nasreddine Bencherchali (Nextron Systems), Huntrule TeamWindowssecurityMedium123Free2022-12-23Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling
Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.
frack113, Huntrule TeamWindowsprocess_creationMedium371Free2022-02-13Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools
Flags Windows process launches identified as LogMeIn LMIGuardianSvc by Description/Product/Company attributes.
frack113, Huntrule TeamWindowsprocess_creationMedium355Free2022-02-11