Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

2 rules

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)
This rule detects use of touch with an explicit date argument to backdate a PHP file inside the Ivanti Cloud Service Appliance LANDesk broker webroot, the timestomping behavior used by the Houken intrusion set to blend planted webshells with legitimate appliance files. Adversaries leverage timestamp manipulation to frustrate forensic triage, making this a strong signal of an attacker actively concealing webshell drops on the appliance.
HuntRule TeamLinuxprocess_creationMedium140
Premium2026-08-29
PowerShell timestomping via file timestamp property and setter usage (Windows)
Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.
frack113, Huntrule TeamWindowsps_scriptMedium192
Free2021-08-03