Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
3,606 rules
WordPress wp2shell PoC User-Agent HTTP Requests
Alerts on web requests with User-Agent exactly equal to "wp2shell", matching wp2shell PoC behavior.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—webserverHigh10210Free2026-07-19WordPress wp2shell Plugin Webshell Access via wp-content/plugins URL Path
Alert on HTTP requests targeting the wp2shell WordPress plugin path used for webshell execution/persistence.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—webserverCritical203Free2026-07-19WordPress REST Batch Endpoint (wp2shell) POST Exploitation Activity
Alert on POST requests containing rest_route=/batch/v1 that return HTTP 207, consistent with wp2shell-style REST batch probing/exploitation.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team—webserverMedium222Free2026-07-19AWS Bedrock Guardrail Updated via UpdateGuardrail API
Alerts on CloudTrail-reported Amazon Bedrock guardrail updates, which may signal attempts to weaken safety controls.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamAwscloudtrailMedium151Free2026-07-10AWS Bedrock Guardrail Deletion via CloudTrail DeleteGuardrail API
Alerts on CloudTrail DeleteGuardrail events indicating an AWS Bedrock guardrail was removed.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamAwscloudtrailMedium173Free2026-07-10Windows Process: SystemSettingsAdminFlows.exe Used to Disable Windows Defender
Alerts when SystemSettingsAdminFlows.exe is launched with command-line arguments consistent with disabling Windows Defender.
Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh211Free2026-07-01Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)
Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowswmiMedium113Free2026-07-01Linux Process Execution from /dev/shm Shared Memory Directory
Alerts on Linux processes executing binaries from /dev/shm, a common in-memory staging location.
Stan Beukers, Huntrule TeamLinuxprocess_creationHigh163Free2026-06-20Antivirus Remote Access Tool Signature Matches Known RAT Names
Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.
Arnim Rupp (Nextron Systems), Huntrule Team—antivirusCritical112Free2026-06-15Antivirus signatures matching APT malware naming patterns
Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.
Arnim Rupp (Nextron Systems), Huntrule Team—antivirusCritical164Free2026-06-15Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)
Alerts when curl is run on Windows with --ntlm and empty -u : credentials, a pattern that may leak the current user's NTLMv2 response.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsprocess_creationHigh3110Free2026-06-04Windows: Detect LSASS crashes caused by netlogon.dll stack buffer overrun (STATUS_STACK_BUFFER_OVERRUN)
Alerts on lsass.exe crashes blamed on netlogon.dll with STATUS_STACK_BUFFER_OVERRUN (0xc0000409) in Windows Application Error (EventID 1000).
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamWindowsapplicationHigh122Free2026-06-02Windows Execution of tanstack_runner.js via bun.exe
Flags bun.exe launching a script via "run tanstack_runner.js" on Windows.
Leonardo Gasparini, Huntrule TeamWindowsprocess_creationHigh131Free2026-05-12Linux process execution indicators for TanStack preinstall supply-chain payloads
Flags Linux processes running a Bun-based TanStack runner (and related Python pyz payload execution) indicative of supply-chain compromise.
Leonardo Gasparini, Huntrule TeamLinuxprocess_creationHigh162Free2026-05-12Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js
Alerts on Windows creation of router/tanstack runner and router_runtime files used in a TanStack supply-chain attack pattern.
Leonardo Gasparini, Huntrule TeamWindowsfile_eventMedium152Free2026-05-12