https://huntrule.com/ daily 1.0 https://huntrule.com/rules hourly 0.9 https://huntrule.com/pricing monthly 0.7 https://huntrule.com/about monthly 0.3 https://huntrule.com/contact monthly 0.2 https://huntrule.com/rules/windows-powershell-script-artifacts-containing-common-offensive-string-markers-8d31a8ce 2026-07-30T04:32:47.970Z weekly 0.8 https://huntrule.com/rules/windows-powershell-active-directory-module-load-via-import-module-74176142 2026-07-30T04:32:29.503Z weekly 0.8 https://huntrule.com/rules/windows-powershell-classic-logs-suspicious-wsman-com-provider-use-without-powers-df9a0e0e 2026-07-30T04:32:27.898Z weekly 0.8 https://huntrule.com/rules/powershell-tampering-with-windows-defender-via-set-mppreference-allow-options-ec19ebab 2026-07-30T04:32:25.908Z weekly 0.8 https://huntrule.com/rules/powershell-classic-compress-archive-in-temp-staging-directories-71ff406e 2026-07-30T04:32:23.951Z weekly 0.8 https://huntrule.com/rules/windows-powershell-get-nettcpconnection-invocation-for-network-connection-discov-b366adb4 2026-07-30T04:32:22.213Z weekly 0.8 https://huntrule.com/rules/powershell-classic-modulecontents-based-remotefxvgpudisablement-exe-load-order-h-f65e22f9 2026-07-30T04:32:19.241Z weekly 0.8 https://huntrule.com/rules/windows-remote-powershell-session-start-via-wsmprovhost-exe-ps-classic-60167e5c 2026-07-30T04:32:17.396Z weekly 0.8 https://huntrule.com/rules/windows-powershell-command-start-with-powercat-invocation-c5b20776 2026-07-30T04:32:15.820Z weekly 0.8 https://huntrule.com/rules/windows-powershell-launch-triggered-via-executable-version-mismatch-c70e019b 2026-07-30T04:32:14.172Z weekly 0.8 https://huntrule.com/rules/powershell-classic-net-webclient-download-via-downloadfile-downloadstring-3236fcd0 2026-07-30T04:32:12.503Z weekly 0.8 https://huntrule.com/rules/powershell-downgrade-indicators-on-windows-via-engineversion-and-hostversion-6331d09b 2026-07-30T04:32:10.709Z weekly 0.8 https://huntrule.com/rules/windows-wmi-shadow-copy-deletion-via-powershell-get-wmiobject-win32-shadowcopy-87df9ee1 2026-07-30T04:32:09.172Z weekly 0.8 https://huntrule.com/rules/powershell-download-cradle-using-nslookup-and-txt-http-queries-on-windows-999bff6d 2026-07-30T04:32:07.484Z weekly 0.8 https://huntrule.com/rules/windows-psexec-named-pipe-creation-from-suspicious-image-locations-pipename-psex-41504465 2026-07-30T04:32:05.930Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-by-known-malware-pipe-names-fe3ac066 2026-07-30T04:32:04.264Z weekly 0.8 https://huntrule.com/rules/windows-wmi-event-consumer-scrcons-exe-created-named-pipe-493fb4ab 2026-07-30T04:32:02.743Z weekly 0.8 https://huntrule.com/rules/windows-detect-remcom-named-pipe-creation-via-remcom-d36f87ea 2026-07-30T04:32:01.067Z weekly 0.8 https://huntrule.com/rules/windows-detect-paexec-default-named-pipe-creation-via-sysmon-f6451de4 2026-07-30T04:31:59.139Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-csexec-default-csexecsvc-pipe-f318b911 2026-07-30T04:31:57.337Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-created-for-powershell-host-pshost-ac7102b4 2026-07-30T04:31:55.563Z weekly 0.8 https://huntrule.com/rules/windows-named-pipes-detect-alternate-powershell-host-pipe-creation-58cb02d5 2026-07-30T04:31:53.554Z weekly 0.8 https://huntrule.com/rules/windows-detect-koh-default-named-pipe-creation-by-pipe-name-0adc67e0 2026-07-30T04:31:44.920Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-indicating-credential-dumping-tools-961d0ba2 2026-07-30T04:31:43.277Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-with-pipe-and-pipe-srvsvc-pattern-efspotato-637f689e 2026-07-30T04:31:41.721Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-detect-default-diagtrackeop-poc-pipe-name-1f7025a6 2026-07-30T04:31:34.066Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-with-coercedpotato-pipe-name-pattern-4d0083b3 2026-07-30T04:31:32.617Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-matching-cobalt-strike-malleable-c2-pipename-pattern-85adeb13 2026-07-30T04:31:30.922Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-matching-cobalt-strike-malleable-c2-pipe-patterns-0e7163d4 2026-07-30T04:31:29.180Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-matching-cobalt-strike-default-pipe-prefixes-d5601f8c 2026-07-30T04:31:27.355Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-to-ad-fs-wid-sql-query-path-by-uncommon-process-1ea13e8c 2026-07-30T04:31:25.718Z weekly 0.8 https://huntrule.com/rules/windows-script-interpreter-initiates-outbound-network-connections-to-non-local-i-992a6cae 2026-07-30T04:31:22.433Z weekly 0.8 https://huntrule.com/rules/windows-wscript-cscript-script-interpreter-initiated-local-network-connection-08249dc0 2026-07-30T04:31:20.774Z weekly 0.8 https://huntrule.com/rules/windows-wordpad-exe-makes-outbound-network-connections-to-uncommon-ports-786cdae8 2026-07-30T04:31:18.999Z weekly 0.8 https://huntrule.com/rules/windows-winlogon-exe-initiating-outbound-connections-to-public-ips-7610a4ea 2026-07-30T04:31:17.427Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-outbound-smtp-connections-on-ports-25-465-587-2525-9976fa64 2026-07-30T04:31:14.228Z weekly 0.8 https://huntrule.com/rules/microsoft-sync-center-mobsync-exe-network-connections-to-non-private-ips-9f2cc74d 2026-07-30T04:31:12.223Z weekly 0.8 https://huntrule.com/rules/uncommon-outbound-kerberos-tcp-88-connection-on-windows-e54979bd 2026-07-30T04:31:10.717Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-uncommon-destination-ports-8080-8888-6d8c3d20 2026-07-30T04:31:09.231Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-known-malware-callback-ports-4b89abaa 2026-07-30T04:31:07.566Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-from-processes-in-suspicious-or-uncommon-file-system-7b434893 2026-07-30T04:31:05.955Z weekly 0.8 https://huntrule.com/rules/windows-processes-in-suspicious-directories-initiating-connections-to-file-shari-e0f8ab85 2026-07-30T04:31:04.355Z weekly 0.8 https://huntrule.com/rules/windows-msbuild-exe-network-connection-to-web-ports-80-443-with-initiated-sessio-50e54b8d 2026-07-30T04:31:00.666Z weekly 0.8 https://huntrule.com/rules/windows-anydesk-incoming-remote-connection-non-initiated-network-sessions-d58ba5c6 2026-07-30T04:30:57.513Z weekly 0.8 https://huntrule.com/rules/windows-regsvr32-exe-initiated-network-connection-c7e91a02 2026-07-30T04:30:55.835Z weekly 0.8 https://huntrule.com/rules/windows-regasm-exe-initiating-network-connections-to-public-ips-0531e43a 2026-07-30T04:30:54.166Z weekly 0.8 https://huntrule.com/rules/windows-rdp-tcp-3389-initiated-connections-to-http-https-ports-80-443-b1e5da3b 2026-07-30T04:30:52.673Z weekly 0.8 https://huntrule.com/rules/windows-svchost-rdp-using-reverse-ssh-tunnel-to-loopback-tcp-3389-5f699bc5 2026-07-30T04:30:50.666Z weekly 0.8 https://huntrule.com/rules/windows-outbound-rdp-sessions-to-port-3389-initiated-by-non-standard-processes-ed74fe75 2026-07-30T04:30:49.087Z weekly 0.8 https://huntrule.com/rules/windows-office-apps-initiate-network-connections-to-uncommon-destination-ports-3b5ba899 2026-07-30T04:30:45.093Z weekly 0.8 https://huntrule.com/rules/windows-office-apps-initiating-network-connections-to-external-non-private-ips-75e33ce3 2026-07-30T04:30:43.268Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-initiated-by-notepad-exe-e81528db 2026-07-30T04:30:41.485Z weekly 0.8 https://huntrule.com/rules/imewdbld-exe-initiated-network-connections-on-windows-8d7e392e 2026-07-30T04:30:40.013Z weekly 0.8 https://huntrule.com/rules/windows-network-connection-via-finger-exe-2fdaf50b 2026-07-30T04:30:38.531Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-from-eqnedt32-exe-equation-editor-a66bc059 2026-07-30T04:30:37.136Z weekly 0.8 https://huntrule.com/rules/windows-process-initiated-network-connections-to-visual-studio-code-tunnel-domai-4b657234 2026-07-30T04:30:35.686Z weekly 0.8 https://huntrule.com/rules/windows-non-browser-process-connecting-to-api-telegram-org-c3dbbc9f 2026-07-30T04:30:34.061Z weekly 0.8 https://huntrule.com/rules/windows-process-initiates-network-connection-to-portmap-io-domain-07837ab9 2026-07-30T04:30:32.030Z weekly 0.8 https://huntrule.com/rules/windows-non-browser-process-communicating-with-notion-api-7e9cf7b6 2026-07-30T04:30:30.664Z weekly 0.8 https://huntrule.com/rules/windows-executable-connects-to-ngrok-tunneling-domains-1d08ac94 2026-07-30T04:30:28.946Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-initiated-to-ngrok-domains-18249279 2026-07-30T04:30:27.120Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-api-mega-co-nz-or-mega-nz-fdeebdf0 2026-07-30T04:30:25.558Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-localtonet-tunneling-subdomains-initiated-3ab65069 2026-07-30T04:30:23.972Z weekly 0.8 https://huntrule.com/rules/windows-non-browser-network-traffic-to-google-apis-7e9cf7b6 2026-07-30T04:30:22.358Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-external-ip-lookup-service-apis-edf3485d 2026-07-30T04:30:20.905Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-dropbox-api-network-connections-from-non-dropbox-executables-25eabf56 2026-07-30T04:30:19.485Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-devtunnels-ms-domains-9501f8e6 2026-07-30T04:30:17.863Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-dead-drop-resolver-domains-from-non-browser-execu-297ae038 2026-07-30T04:30:16.414Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-known-crypto-mining-pool-hostnames-fa5b1358 2026-07-30T04:30:14.641Z weekly 0.8 https://huntrule.com/rules/windows-process-network-connections-to-cloudflared-tunnel-domains-7cd1dcdc 2026-07-30T04:30:12.821Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-btunnel-domains-9e02c8ec 2026-07-30T04:30:10.808Z weekly 0.8 https://huntrule.com/rules/windows-non-browser-process-connecting-to-azurewebsites-net-5c80b618 2026-07-30T04:30:09.066Z weekly 0.8 https://huntrule.com/rules/windows-outbound-connections-initiated-by-dialer-exe-microsoft-phone-dialer-37e4024a 2026-07-30T04:30:06.745Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-initiated-by-cmstp-exe-efafe0bf 2026-07-30T04:30:05.196Z weekly 0.8 https://huntrule.com/rules/windows-certutil-exe-initiating-network-connections-to-common-service-ports-0dba975d 2026-07-30T04:30:03.611Z weekly 0.8 https://huntrule.com/rules/windows-uncommon-network-connections-to-ad-web-services-adws-from-non-standard-p-b3ad3c0f 2026-07-30T04:30:01.727Z weekly 0.8 https://huntrule.com/rules/windows-addinutil-exe-initiates-network-connection-5205613d 2026-07-30T04:30:00.068Z weekly 0.8 https://huntrule.com/rules/windows-wmi-dll-hijack-via-wbemcomn-dll-loaded-by-wmiprvse-exe-7707a579 2026-07-30T04:29:56.751Z weekly 0.8 https://huntrule.com/rules/windows-detect-wmic-loading-javascript-or-vbscript-libraries-via-image-load-even-06ce37c2 2026-07-30T04:29:54.959Z weekly 0.8 https://huntrule.com/rules/windows-wmi-persistence-via-command-line-event-consumers-wmiprvse-exe-loading-wb-05936ce2 2026-07-30T04:29:53.081Z weekly 0.8 https://huntrule.com/rules/windows-image-load-trusted-path-bypass-via-spoofed-system-directory-with-extra-s-0cbe38c0 2026-07-30T04:29:51.440Z weekly 0.8 https://huntrule.com/rules/windows-dll-image-load-dbgcore-dll-dbghelp-dll-from-user-or-public-paths-416bc4a2 2026-07-30T04:29:49.672Z weekly 0.8 https://huntrule.com/rules/windows-mmc-loading-script-engine-dlls-vbscript-jscript-a9c73e8b 2026-07-30T04:29:48.062Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-fake-dismcore-dll-loaded-by-dism-exe-a5ea83a7 2026-07-30T04:29:46.532Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-iscsicpl-exe-loading-malicious-dll-from-path-9ed5959a 2026-07-30T04:29:44.888Z weekly 0.8 https://huntrule.com/rules/windows-image-load-executes-unsigned-thor-scanner-binaries-ea5c131b 2026-07-30T04:29:43.126Z weekly 0.8 https://huntrule.com/rules/windows-utility-loads-untrusted-dll-via-image-load-telemetry-b5de0c9a 2026-07-30T04:29:41.460Z weekly 0.8 https://huntrule.com/rules/windows-scripting-and-lolbins-loading-net-clr-dlls-4508a70e 2026-07-30T04:29:39.791Z weekly 0.8 https://huntrule.com/rules/windows-system-process-loads-dll-from-suspicious-or-permissive-path-9e9a9002 2026-07-30T04:29:36.340Z weekly 0.8 https://huntrule.com/rules/windows-clickonce-loads-unsigned-module-from-appdata-local-apps-2-0-060d5ad4 2026-07-30T04:29:34.776Z weekly 0.8 https://huntrule.com/rules/windows-baaupdate-exe-suspicious-dll-loads-from-publicly-writable-paths-6e8fe0a8 2026-07-30T04:29:32.469Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-imageloaded-wwlib-dll-associated-with-winword-e2e01011 2026-07-30T04:29:30.850Z weekly 0.8 https://huntrule.com/rules/windows-mpclient-dll-side-loading-via-mpcmdrun-exe-or-nissrv-exe-from-non-defaul-418dc89a 2026-07-30T04:29:29.298Z weekly 0.8 https://huntrule.com/rules/windows-dll-side-loading-indicators-for-wazuh-platform-libraries-via-imageload-e-db77ce78 2026-07-30T04:29:27.692Z weekly 0.8 https://huntrule.com/rules/windows-image-load-monitoring-potential-waveedit-dll-dll-sideloading-71b31e99 2026-07-30T04:29:25.906Z weekly 0.8 https://huntrule.com/rules/windows-flag-vmwarexferlogs-exe-loading-glib-2-0-dll-from-non-default-path-9313dc13 2026-07-30T04:29:24.234Z weekly 0.8 https://huntrule.com/rules/vmmap-unsigned-dbghelp-dll-image-sideloading-attempt-on-windows-273a8dd8 2026-07-30T04:29:22.547Z weekly 0.8 https://huntrule.com/rules/vmmap-loads-signed-dbghelp-dll-from-c-debuggers-path-potential-dll-sideloading-98ffaed4 2026-07-30T04:29:20.825Z weekly 0.8 https://huntrule.com/rules/windows-vmguestlib-dll-sideloading-via-wmiapsrv-imageload-70e8e9b4 2026-07-30T04:29:19.185Z weekly 0.8 https://huntrule.com/rules/windows-imageload-of-vivaldi-elf-dll-suggesting-potential-dll-sideloading-2092cacb 2026-07-30T04:29:17.599Z weekly 0.8 https://huntrule.com/rules/windows-fax-service-dll-search-order-hijack-via-ualapi-dll-side-loading-828af599 2026-07-30T04:29:14.046Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-imageload-from-lenovo-and-toshiba-third-party-direct-f9df325d 2026-07-30T04:29:12.313Z weekly 0.8 https://huntrule.com/rules/windows-solidpdfcreator-dll-sideloading-via-imageload-events-a2edbce1 2026-07-30T04:29:10.553Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-smadhook32c-dll-or-smadhook64c-dll-image-load-24b6cf51 2026-07-30T04:29:09.008Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-shelldispatch-dll-image-load-844f8eb2 2026-07-30T04:29:07.225Z weekly 0.8 https://huntrule.com/rules/windows-dll-sidelo-ading-detect-image-loads-of-shellchromeapi-dll-ee4c5d06 2026-07-30T04:29:05.616Z weekly 0.8 https://huntrule.com/rules/windows-potential-roboform-dll-sideloading-via-image-load-of-roboform-dll-f64c9b2d 2026-07-30T04:29:03.935Z weekly 0.8 https://huntrule.com/rules/windows-rjvplatform-dll-dll-sideloading-by-systemresetplatform-exe-from-non-defa-0e0bc253 2026-07-30T04:29:01.424Z weekly 0.8 https://huntrule.com/rules/windows-dll-side-loading-systemresetplatform-exe-loading-rjvplatform-dll-from-sy-259dda31 2026-07-30T04:28:54.286Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-imageloads-rcdll-dll-from-non-vs-windows-kits-paths-6e78b74f 2026-07-30T04:28:52.438Z weekly 0.8 https://huntrule.com/rules/windows-office-dll-sideloading-via-outllib-dll-image-load-outside-expected-offic-829a3bdf 2026-07-30T04:28:49.181Z weekly 0.8 https://huntrule.com/rules/windows-dll-loading-from-system-directories-using-specific-phantom-dll-names-6b98b92b 2026-07-30T04:28:47.710Z weekly 0.8 https://huntrule.com/rules/windows-potential-dll-sideloading-via-loading-msocrsvc-dll-cdb15e19 2026-07-30T04:28:45.966Z weekly 0.8 https://huntrule.com/rules/windows-potential-dll-sideloading-via-mpsvc-dll-loads-5ba243e5 2026-07-30T04:28:43.310Z weekly 0.8 https://huntrule.com/rules/windows-mftrace-exe-dll-sideloading-of-unsigned-mfdetours-dll-948a0953 2026-07-30T04:28:41.625Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-mfdetours-dll-loaded-from-current-directory-d2605a99 2026-07-30T04:28:40.084Z weekly 0.8 https://huntrule.com/rules/windows-dll-hijacking-libvlc-dll-sideloading-via-non-default-image-load-bf9808c4 2026-07-30T04:28:38.348Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-dll-side-loading-keyscramblerie-dll-loaded-by-keyscrambler-ex-d2451be2 2026-07-30T04:28:36.550Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-suspicion-via-image-load-of-jsschhlp-dll-68654bf0 2026-07-30T04:28:34.444Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-iviewers-dll-image-loads-4c21b805 2026-07-30T04:28:30.926Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-gup-exe-loading-libcurl-dll-from-uncommon-path-e49b5745 2026-07-30T04:28:29.312Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-goopdate-dll-imageload-b6188d2f 2026-07-30T04:28:27.734Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-indicators-via-imageloaded-of-system-dll-names-4fc0deee 2026-07-30T04:28:25.546Z weekly 0.8 https://huntrule.com/rules/windows-dll-side-loading-edputil-dll-loaded-from-non-system-paths-e4903324 2026-07-30T04:28:23.623Z weekly 0.8 https://huntrule.com/rules/windows-imageload-potential-eacore-dll-sideloading-via-ea-desktop-edd3ddc3 2026-07-30T04:28:21.982Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-suspicion-via-image-load-of-dbgmodel-dll-fef394cd 2026-07-30T04:28:20.161Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-dll-sideloading-via-dbghelp-dll-image-loads-6414b5cd 2026-07-30T04:28:18.402Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-dbgcore-dll-loaded-from-unusual-paths-9ca2bf31 2026-07-30T04:28:15.669Z weekly 0.8 https://huntrule.com/rules/windows-cpl-image-loads-from-non-system-paths-2b140a5c 2026-07-30T04:28:14.103Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-coregen-exe-0fa66f66 2026-07-30T04:28:12.600Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-attempts-via-comctl32-dll-in-local-directories-6360757a 2026-07-30T04:28:11.064Z weekly 0.8 https://huntrule.com/rules/windows-dll-side-loading-via-classicexplorer32-dll-loaded-from-non-classic-shell-caa02837 2026-07-30T04:28:09.458Z weekly 0.8 https://huntrule.com/rules/windows-chrome-frame-helper-dll-sideloading-via-imageload-of-chrome-frame-helper-72ca7c75 2026-07-30T04:28:07.877Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-attempts-ccleanerreactivator-dll-loaded-by-ccleanerreact-3735d5ac 2026-07-30T04:28:06.073Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-ccleanerdu-dll-loaded-outside-ccleaner-binaries-1fbc0671 2026-07-30T04:28:04.348Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-avkkid-dll-image-loads-952ed57c 2026-07-30T04:28:02.628Z weekly 0.8 https://huntrule.com/rules/windows-dll-search-order-hijacking-via-arubanetsvc-exe-dll-loads-90ae0469 2026-07-30T04:28:01.013Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-appverifui-dll-loaded-from-non-standard-paths-ee6cea48 2026-07-30T04:27:59.298Z weekly 0.8 https://huntrule.com/rules/windows-image-load-alerts-for-dll-sideloading-from-security-product-directories-552b6b65 2026-07-30T04:27:57.670Z weekly 0.8 https://huntrule.com/rules/windows-imageload-abusable-dlls-from-suspicious-paths-potential-sideloading-799a5f48 2026-07-30T04:27:56.112Z weekly 0.8 https://huntrule.com/rules/windows-imageload-potential-7za-dll-sideloading-via-untrusted-image-paths-4f6edb78 2026-07-30T04:27:54.686Z weekly 0.8 https://huntrule.com/rules/wmi-activescripteventconsumer-activity-indications-via-scrcons-exe-loading-scrip-b439f47d 2026-07-30T04:27:52.981Z weekly 0.8 https://huntrule.com/rules/windows-office-applications-loading-vbe-dlls-vba-runtime-indicators-e6ce8457 2026-07-30T04:27:49.801Z weekly 0.8 https://huntrule.com/rules/powershell-core-dll-loaded-by-office-applications-on-windows-bb2ba6fb 2026-07-30T04:27:47.927Z weekly 0.8 https://huntrule.com/rules/outlook-process-loads-outlvba-dll-microsoft-vba-add-in-on-windows-9a0b8719 2026-07-30T04:27:46.468Z weekly 0.8 https://huntrule.com/rules/windows-excel-loads-xll-add-in-from-uncommon-path-af4c4609 2026-07-30T04:27:44.969Z weekly 0.8 https://huntrule.com/rules/windows-office-apps-loading-gac-net-dlls-via-image-load-events-90217a70 2026-07-30T04:27:43.329Z weekly 0.8 https://huntrule.com/rules/windows-clr-dll-loaded-by-microsoft-office-applications-d13c43f0 2026-07-30T04:27:41.680Z weekly 0.8 https://huntrule.com/rules/windows-office-apps-load-net-dlls-from-c-windows-assembly-ff0f2b05 2026-07-30T04:27:40.115Z weekly 0.8 https://huntrule.com/rules/unsigned-image-loaded-into-lsass-exe-windows-857c8db3 2026-07-30T04:27:38.482Z weekly 0.8 https://huntrule.com/rules/windows-dcom-internetexplorer-application-dll-hijack-via-iertutil-dll-image-load-f354eba5 2026-07-30T04:27:37.024Z weekly 0.8 https://huntrule.com/rules/windows-dll-load-sharpevtmute-evtmutehook-dll-imphash-49329257 2026-07-30T04:27:33.594Z weekly 0.8 https://huntrule.com/rules/windows-image-load-of-vsstrace-dll-by-uncommon-executables-48bfd177 2026-07-30T04:27:32.060Z weekly 0.8 https://huntrule.com/rules/windows-image-load-of-vssapi-dll-by-uncommon-executables-37774c23 2026-07-30T04:27:30.487Z weekly 0.8 https://huntrule.com/rules/windows-imageload-unsigned-node-native-add-on-loaded-e5f5c693 2026-07-30T04:27:26.712Z weekly 0.8 https://huntrule.com/rules/windows-image-load-of-tttracer-dlls-for-time-travel-debugging-utility-e76c8240 2026-07-30T04:27:25.144Z weekly 0.8 https://huntrule.com/rules/windows-non-powershell-process-loads-powershell-system-management-automation-dll-092bc4b9 2026-07-30T04:27:23.388Z weekly 0.8 https://huntrule.com/rules/windows-msdt-exe-loading-sdiageng-dll-via-imageload-telemetry-ec8c4047 2026-07-30T04:27:21.679Z weekly 0.8 https://huntrule.com/rules/windows-dll-load-of-rstrtmgr-dll-by-uncommon-process-3669afd2 2026-07-30T04:27:20.094Z weekly 0.8 https://huntrule.com/rules/suspicious-image-load-of-rstrtmgr-dll-by-windows-process-b48492dc 2026-07-30T04:27:18.323Z weekly 0.8 https://huntrule.com/rules/windows-image-load-of-temp-module-containing-pcre-net-package-path-84b0a8f3 2026-07-30T04:27:16.637Z weekly 0.8 https://huntrule.com/rules/windows-process-loads-unsigned-dbghelp-dll-or-dbgcore-dll-bdc64095 2026-07-30T04:27:15.180Z weekly 0.8 https://huntrule.com/rules/windows-alert-on-credui-dll-imageload-from-uncommon-process-9ae01559 2026-07-30T04:27:13.490Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-loads-renamed-comsvcs-dll-for-process-memory-dump-8cde342c 2026-07-30T04:27:11.948Z weekly 0.8 https://huntrule.com/rules/windows-image-load-microsoftaccounttokenprovider-dll-linked-to-azure-browser-sso-50f852e6 2026-07-30T04:27:10.143Z weekly 0.8 https://huntrule.com/rules/windows-amsi-dll-loaded-by-living-off-the-land-processes-extexport-exe-odbcconf--6ec86d9e 2026-07-30T04:27:02.626Z weekly 0.8 https://huntrule.com/rules/windows-cmstp-loads-dll-ocx-from-suspicious-paths-75e508f7 2026-07-30T04:27:00.791Z weekly 0.8 https://huntrule.com/rules/windows-clfs-sys-image-loaded-from-potentially-suspicious-user-or-temp-paths-fb4e2211 2026-07-30T04:26:59.092Z weekly 0.8 https://huntrule.com/rules/windows-alert-on-new-sed-file-creation-consistent-with-self-extraction-directive-ab90dab8 2026-07-30T04:26:55.596Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-c-windows-system32-wpbbin-exe-for-uefi-persistence-indi-e94b9ddc 2026-07-30T04:26:52.497Z weekly 0.8 https://huntrule.com/rules/windows-network-file-drop-wbemcomn-dll-in-system32-wbem-for-wmi-dll-hijack-614a7e17 2026-07-30T04:26:50.906Z weekly 0.8 https://huntrule.com/rules/windows-wmiexec-default-output-file-creation-via-file-events-8d5aca11 2026-07-30T04:26:49.243Z weekly 0.8 https://huntrule.com/rules/windows-wmi-persistence-via-scrcons-exe-script-event-consumer-file-writes-33f41cdd 2026-07-30T04:26:47.372Z weekly 0.8 https://huntrule.com/rules/windows-file-events-suspicious-winrm-vbscript-use-of-wsmpty-xsl-or-wsmtxt-xsl-ou-d353dac0 2026-07-30T04:26:45.791Z weekly 0.8 https://huntrule.com/rules/windows-winrar-rar-creating-files-in-startup-folder-paths-74a2b37d 2026-07-30T04:26:44.035Z weekly 0.8 https://huntrule.com/rules/windows-werfault-exe-wer-dll-created-in-uncommon-directory-28a452f3 2026-07-30T04:26:37.152Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-suspicious-webshell-script-extensions-in-web-root-39f1f9f2 2026-07-30T04:26:35.615Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-code-tunnel-json-indicating-non-vscode-vs-code-tunnelin-d102b8f5 2026-07-30T04:26:34.013Z weekly 0.8 https://huntrule.com/rules/windows-node-exe-creates-files-in-vscode-server-history-via-vs-code-server-tunne-56e05d41 2026-07-30T04:26:32.168Z weekly 0.8 https://huntrule.com/rules/windows-browser-processes-creating-vhd-vhdx-files-8468111a 2026-07-30T04:26:30.676Z weekly 0.8 https://huntrule.com/rules/uac-bypass-using-windows-media-player-osksupport-dll-via-dllhost-exe-file-events-68578b43 2026-07-30T04:26:29.034Z weekly 0.8 https://huntrule.com/rules/file-event-detect-uac-bypass-attempt-via-winsat-exe-path-parsing-in-temp-155dbf56 2026-07-30T04:26:26.747Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-attempt-via-ntfs-reparse-point-targeting-temp-dll-path-7fff6773 2026-07-30T04:26:24.685Z weekly 0.8 https://huntrule.com/rules/windows-file-write-to-temp-pkgmgr-exe-via-msconfig-token-modification-uac-bypass-41bb431f 2026-07-30T04:26:22.918Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-attempt-via-ieinstal-exe-writing-consent-exe-to-temp-bdd8157d 2026-07-30T04:26:21.061Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-idiagnosticprofileuac-dllhost-exe-writing-dll-in-system32-48ea844d 2026-07-30T04:26:19.313Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-event-viewer-recentviews-file-writes-63e4f530 2026-07-30T04:26:17.777Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-net-code-profiler-and-mmc-exe-dll-write-to-temp-pe386-dll-93a19907 2026-07-30T04:26:16.149Z weekly 0.8 https://huntrule.com/rules/windows-uac-bypass-via-consent-exe-and-comctl32-dll-file-target-path-62ed5b55 2026-07-30T04:26:14.617Z weekly 0.8 https://huntrule.com/rules/windows-file-events-mstsc-exe-writing-to-startup-folder-via-tsclient-share-52753ea4 2026-07-30T04:26:12.826Z weekly 0.8 https://huntrule.com/rules/windows-taskmgr-exe-creating-lsass-dmp-in-temp-directory-69ca12af 2026-07-30T04:26:10.816Z weekly 0.8 https://huntrule.com/rules/windows-flag-exe-local-dll-sideload-attempts-targeting-system32-comctl32-dll-07a99744 2026-07-30T04:26:09.349Z weekly 0.8 https://huntrule.com/rules/windows-psexec-key-file-creation-via-c-windows-psexec-key-304afd73 2026-07-30T04:26:07.729Z weekly 0.8 https://huntrule.com/rules/windows-psexec-service-file-creation-via-psexesvc-exe-259e5a6a 2026-07-30T04:26:06.069Z weekly 0.8 https://huntrule.com/rules/windows-process-monitor-driver-sys-created-by-non-procmon-executables-a05baa88 2026-07-30T04:26:04.465Z weekly 0.8 https://huntrule.com/rules/windows-process-explorer-driver-sys-created-by-non-process-explorer-binaries-de46c52b 2026-07-30T04:26:02.808Z weekly 0.8 https://huntrule.com/rules/windows-livekd-driver-file-created-by-non-livekd-executable-059c5af9 2026-07-30T04:26:00.821Z weekly 0.8 https://huntrule.com/rules/windows-livekd-driver-file-creation-via-livekd-exe-or-livek64-exe-16fe46bb 2026-07-30T04:25:58.965Z weekly 0.8 https://huntrule.com/rules/windows-livekd-kernel-memory-dump-file-created-livekd-dmp-814ddeca 2026-07-30T04:25:57.351Z weekly 0.8 https://huntrule.com/rules/windows-file-writes-by-adexplorer-creating-complete-ad-snapshot-dat-files-0a1255c5 2026-07-30T04:25:55.945Z weekly 0.8 https://huntrule.com/rules/windows-winsxs-exe-creation-by-non-system-processes-34746e8c 2026-07-30T04:25:54.361Z weekly 0.8 https://huntrule.com/rules/windows-terminal-settings-json-modified-by-an-uncommon-command-line-process-9b64de98 2026-07-30T04:25:52.554Z weekly 0.8 https://huntrule.com/rules/windows-file-events-suspicious-wdac-policy-file-creation-in-codeintegrity-path-1d2de8a6 2026-07-30T04:25:50.599Z weekly 0.8 https://huntrule.com/rules/windows-file-events-vs-code-powershell-profile-script-creation-or-modification-3a9fa2ec 2026-07-30T04:25:49.050Z weekly 0.8 https://huntrule.com/rules/windows-teamviewer-remote-session-log-file-creation-vprint-db-and-tvnetwork-log-162ab1e4 2026-07-30T04:25:46.991Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-file-writes-to-system32-tasks-from-suspicious-paths-80e1f67a 2026-07-30T04:25:45.430Z weekly 0.8 https://huntrule.com/rules/windows-file-writes-indicating-interactive-powershell-history-as-system-5b40a734 2026-07-30T04:25:43.950Z weekly 0.8 https://huntrule.com/rules/windows-startup-folder-file-creation-with-suspicious-script-executable-extension-28208707 2026-07-30T04:25:42.096Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-dll-exe-sys-creation-in-spool-drivers-color-folder-ce7066a6 2026-07-30T04:25:40.521Z weekly 0.8 https://huntrule.com/rules/windows-file-event-detect-unicode-right-to-left-override-extension-spoofing-979baf41 2026-07-30T04:25:38.851Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-creation-in-fake-recycle-bin-folder-paths-cd8b36ac 2026-07-30T04:25:37.034Z weekly 0.8 https://huntrule.com/rules/windows-public-folder-file-creation-with-suspicious-script-or-binary-extensions-b447f7de 2026-07-30T04:25:35.386Z weekly 0.8 https://huntrule.com/rules/windows-alert-on-procexp152-sys-driver-created-in-appdata-local-temp-3da70954 2026-07-30T04:25:33.596Z weekly 0.8 https://huntrule.com/rules/windows-file-events-powershell-profile-script-creation-or-modification-b5b78988 2026-07-30T04:25:31.501Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-suspicious-lnk-double-extension-filenames-3215aa19 2026-07-30T04:25:29.251Z weekly 0.8 https://huntrule.com/rules/windows-file-events-suspicious-legitimate-apps-dropping-script-files-7d604714 2026-07-30T04:25:27.516Z weekly 0.8 https://huntrule.com/rules/windows-file-events-writing-by-executables-to-uncommon-locations-1cf465a1 2026-07-30T04:25:25.741Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-executable-dropping-by-known-apps-and-lolbins-f0540f7e 2026-07-30T04:25:24.026Z weekly 0.8 https://huntrule.com/rules/windows-executable-process-dropping-archive-files-zip-rar-7z-cab-appx-654fcc6d 2026-07-30T04:25:22.529Z weekly 0.8 https://huntrule.com/rules/windows-file-events-flag-unicode-homoglyphs-in-targetfilename-4f1707b1 2026-07-30T04:25:20.840Z weekly 0.8 https://huntrule.com/rules/windows-hidden-directory-creation-via-ntfs-index-allocation-stream-in-file-event-a8f866e1 2026-07-30T04:25:19.183Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-suspicious-get-variable-exe-under-windowsapps-0c3fac91 2026-07-30T04:25:17.688Z weekly 0.8 https://huntrule.com/rules/windows-file-write-via-command-line-tools-to-sharepoint-layouts-web-assets-1f0489be 2026-07-30T04:25:15.616Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-write-to-apache-tomcat-webapps-root-as-jsp-from-dotnet-j-89c42960 2026-07-30T04:25:13.931Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-executable-file-creation-via-malicious-filenames-and-extensio-74babdd6 2026-07-30T04:25:12.251Z weekly 0.8 https://huntrule.com/rules/windows-msexchangemailboxreplication-writes-asp-aspx-files-7280c9f3 2026-07-30T04:25:10.332Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-dpapi-backup-key-and-certificate-export-files-7892ec59 2026-07-30T04:25:08.837Z weekly 0.8 https://huntrule.com/rules/windows-file-events-suspicious-double-extension-filenames-b4926b47 2026-07-30T04:25:07.306Z weekly 0.8 https://huntrule.com/rules/windows-creation-of-diagcab-files-3d0ed417 2026-07-30T04:24:59.920Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-desktopimgdownldr-writes-lock-screen-images-to-unusual-paths-fc4f4817 2026-07-30T04:24:57.548Z weekly 0.8 https://huntrule.com/rules/windows-copied-suspicious-exe-dll-files-into-default-gpo-storage-path-5f87308a 2026-07-30T04:24:55.414Z weekly 0.8 https://huntrule.com/rules/windows-files-created-by-microsoft-sync-center-mobsync-exe-409f8a98 2026-07-30T04:24:53.811Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-colorcpl-exe-file-creation-targeting-system32-spool-drivers-p-e15b518d 2026-07-30T04:24:52.270Z weekly 0.8 https://huntrule.com/rules/windows-startup-folder-file-write-for-persistence-t1547-001-2aa0a6b4 2026-07-30T04:24:50.522Z weekly 0.8 https://huntrule.com/rules/windows-file-events-executables-writing-files-with-suspicious-extensions-b8fd0e93 2026-07-30T04:24:48.925Z weekly 0.8 https://huntrule.com/rules/windows-scripting-binaries-writing-files-to-suspicious-directories-1277f594 2026-07-30T04:24:46.708Z weekly 0.8 https://huntrule.com/rules/windows-detect-sed-directive-file-creation-in-suspicious-directories-760e75d8 2026-07-30T04:24:45.029Z weekly 0.8 https://huntrule.com/rules/windows-file-events-potential-local-sam-database-export-artifact-4e87b8e2 2026-07-30T04:24:43.181Z weekly 0.8 https://huntrule.com/rules/windows-file-events-detect-explorer-expanded-lnk-persistence-in-startup-folder-w-a6976974 2026-07-30T04:24:41.588Z weekly 0.8 https://huntrule.com/rules/screenconnect-rmm-temporary-file-creation-in-windows-user-documents-connectwisec-0afecb6e 2026-07-30T04:24:39.723Z weekly 0.8 https://huntrule.com/rules/screenconnect-temporary-installation-artefact-creation-windows-file-events-fec96f39 2026-07-30T04:24:38.181Z weekly 0.8 https://huntrule.com/rules/windows-remcomsvc-exe-service-file-creation-7eff1a7f 2026-07-30T04:24:36.770Z weekly 0.8 https://huntrule.com/rules/windows-regedit-exe-creating-a-pdf-file-145095eb 2026-07-30T04:24:35.391Z weekly 0.8 https://huntrule.com/rules/windows-file-drops-matching-winnti-like-dll-and-batch-filenames-130c9e58 2026-07-30T04:24:34.013Z weekly 0.8 https://huntrule.com/rules/windows-rdp-file-creation-triggered-by-uncommon-application-fccfb43e 2026-07-30T04:24:32.514Z weekly 0.8 https://huntrule.com/rules/windows-rclone-configuration-file-creation-in-user-profile-34986307 2026-07-30T04:24:30.883Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-psscriptpolicytest-random-generated-by-uncommon-process-1027d292 2026-07-30T04:24:29.324Z weekly 0.8 https://huntrule.com/rules/windows-powershell-creating-startup-shortcut-lnk-files-for-persistence-92fa78e7 2026-07-30T04:24:27.347Z weekly 0.8 https://huntrule.com/rules/windows-powershell-module-file-creation-by-non-powershell-process-e3845023 2026-07-30T04:24:25.871Z weekly 0.8 https://huntrule.com/rules/windows-powershell-new-module-file-created-in-modules-directories-e36941d0 2026-07-30T04:24:22.616Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-known-offensive-powershell-script-dropper-filenames-f331aa1f 2026-07-30T04:24:20.969Z weekly 0.8 https://huntrule.com/rules/windows-powershell-pwsh-dropping-ps1-files-via-powershell-exe-576426ad 2026-07-30T04:24:19.472Z weekly 0.8 https://huntrule.com/rules/windows-powershell-creating-executable-or-script-files-matching-binary-dropper-p-7047d730 2026-07-30T04:24:17.910Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-executable-archive-file-created-in-c-perflogs-bbb7e38c 2026-07-30T04:24:16.269Z weekly 0.8 https://huntrule.com/rules/windows-creation-of-pcre-net-package-temp-files-via-appdata-local-temp-path-6e90ae7a 2026-07-30T04:24:14.713Z weekly 0.8 https://huntrule.com/rules/windows-office-startup-folder-file-creation-with-uncommon-extension-a10a2c40 2026-07-30T04:24:13.254Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-by-microsoft-office-with-executable-or-script-extensions-c7a74c80 2026-07-30T04:24:11.539Z weekly 0.8 https://huntrule.com/rules/windows-office-document-drop-into-startup-folders-for-persistence-0e20c89d 2026-07-30T04:24:09.863Z weekly 0.8 https://huntrule.com/rules/windows-publisher-attachment-file-created-in-suspicious-directory-3d2a2d59 2026-07-30T04:24:08.207Z weekly 0.8 https://huntrule.com/rules/windows-alert-on-creation-of-outlook-vbaproject-otm-macro-file-117d3d3a 2026-07-30T04:24:06.806Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-attachment-file-created-in-outlook-temporary-directories-fabb0e80 2026-07-30T04:24:05.147Z weekly 0.8 https://huntrule.com/rules/windows-outlook-form-creation-to-local-forms-path-persistence-risk-c3edc6a5 2026-07-30T04:24:01.938Z weekly 0.8 https://huntrule.com/rules/windows-outlook-vbaproject-otm-macro-file-creation-8c31f563 2026-07-30T04:24:00.278Z weekly 0.8 https://huntrule.com/rules/windows-detect-onenote-temp-file-creation-with-suspicious-executable-extensions-fcc6d700 2026-07-30T04:23:58.608Z weekly 0.8 https://huntrule.com/rules/windows-one-onepkg-file-created-in-suspicious-locations-7fd164ba 2026-07-30T04:23:56.857Z weekly 0.8 https://huntrule.com/rules/windows-office-macro-file-creation-triggered-by-script-execution-binaries-b1c50487 2026-07-30T04:23:55.163Z weekly 0.8 https://huntrule.com/rules/windows-office-macro-file-creation-via-browser-or-email-client-0e29e3a7 2026-07-30T04:23:53.517Z weekly 0.8 https://huntrule.com/rules/windows-office-macro-file-creation-docm-xlsm-pptm-by-microsoft-office-executable-91174a41 2026-07-30T04:23:51.907Z weekly 0.8 https://huntrule.com/rules/windows-file-events-office-startup-add-in-files-wll-xll-xlam-for-persistence-8e1cb247 2026-07-30T04:23:50.082Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-with-ntds-dit-exfiltration-filename-patterns-3a8da4e0 2026-07-30T04:23:48.488Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-ntds-dit-by-uncommon-or-suspicious-processes-11b1ed55 2026-07-30T04:23:43.259Z weekly 0.8 https://huntrule.com/rules/windows-file-events-ntds-dit-created-0b8baa3f 2026-07-30T04:23:39.621Z weekly 0.8 https://huntrule.com/rules/windows-new-notepad-plugin-dll-creation-outside-gup-exe-54127bd4 2026-07-30T04:23:38.031Z weekly 0.8 https://huntrule.com/rules/windows-scr-screen-saver-file-created-outside-system-directories-c048f047 2026-07-30T04:23:36.526Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-script-executable-file-creation-in-non-standard-appdata-paths-d7b50671 2026-07-30T04:23:35.065Z weekly 0.8 https://huntrule.com/rules/windows-unusual-file-creation-by-mysqld-exe-with-script-executable-extensions-c61daa90 2026-07-30T04:23:31.267Z weekly 0.8 https://huntrule.com/rules/windows-msdt-exe-creating-files-in-suspicious-directories-318557a5 2026-07-30T04:23:29.336Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-octopus-scanner-malware-cache134-dat-or-explorersync-db-805c55d9 2026-07-30T04:23:27.591Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-java-exe-in-appdata-roaming-oracle-bin-and-vbs-under-retri-0bcfabcb 2026-07-30T04:23:25.999Z weekly 0.8 https://huntrule.com/rules/windows-werfault-creates-dump-files-referencing-lsass-process-memory-c3e76af5 2026-07-30T04:23:24.151Z weekly 0.8 https://huntrule.com/rules/windows-lsass-crash-dump-dmp-present-in-crashdumps-directory-6902955a 2026-07-30T04:23:22.540Z weekly 0.8 https://huntrule.com/rules/windows-lsass-memory-dump-file-creation-a5a2d357 2026-07-30T04:23:20.611Z weekly 0.8 https://huntrule.com/rules/windows-vbs-gathernetworkinfo-output-files-written-to-system32-config-f92a6f1e 2026-07-30T04:23:18.554Z weekly 0.8 https://huntrule.com/rules/windows-recent-items-shows-iso-img-vhd-image-mount-shortcut-lnk-usage-4358e5a5 2026-07-30T04:23:16.874Z weekly 0.8 https://huntrule.com/rules/windows-iso-file-creation-in-user-temporary-folders-2f9356ae 2026-07-30T04:23:15.117Z weekly 0.8 https://huntrule.com/rules/windows-malicious-dll-dropped-to-onedrive-teams-appdata-path-containing-iphlpapi-1908fcc1 2026-07-30T04:23:12.728Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-teamviewer-desktop-exe-during-installation-9711de76 2026-07-30T04:23:10.987Z weekly 0.8 https://huntrule.com/rules/windows-dll-search-order-hijacking-suspicious-dll-writes-to-appdata-onedrive-tea-dbbd9f66 2026-07-30T04:23:09.457Z weekly 0.8 https://huntrule.com/rules/windows-impacket-secretsdump-sessionresume-file-creation-indicators-03f4ca17 2026-07-30T04:23:07.612Z weekly 0.8 https://huntrule.com/rules/windows-file-event-safetykatz-style-lsass-dump-file-named-temp-debug-bin-e074832a 2026-07-30T04:23:06.169Z weekly 0.8 https://huntrule.com/rules/windows-file-events-crackmapexec-or-impacket-secretsdump-credential-dumping-temp-6e2a900a 2026-07-30T04:23:04.733Z weekly 0.8 https://huntrule.com/rules/windows-quarkspwdump-credential-dump-file-written-to-temp-sam-dmp-847def9e 2026-07-30T04:23:02.782Z weekly 0.8 https://huntrule.com/rules/powershell-powerup-write-hijack-dll-abuse-creating-bat-on-windows-602a1f13 2026-07-30T04:23:01.077Z weekly 0.8 https://huntrule.com/rules/windows-file-writes-to-nppspy-txt-or-nppspy-dll-indicates-hacktool-credential-du-cad1fe90 2026-07-30T04:22:59.622Z weekly 0.8 https://huntrule.com/rules/windows-netexec-execution-indicators-via-pyinstaller-mei-temp-file-drops-efc21479 2026-07-30T04:22:57.814Z weekly 0.8 https://huntrule.com/rules/windows-hacktool-file-creation-mimikatz-kirbi-and-mimilsa-log-detection-9e099d99 2026-07-30T04:22:55.638Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-remotekrbrelay-smb-relay-module-temp-secrets-dumps-3ab79e90 2026-07-30T04:22:54.091Z weekly 0.8 https://huntrule.com/rules/windows-inveigh-hacktool-execution-artefacts-via-dropped-files-bb09dd3e 2026-07-30T04:22:52.192Z weekly 0.8 https://huntrule.com/rules/windows-hacktool-activity-hivenightmare-style-sam-file-exports-6ea858a8 2026-07-30T04:22:50.191Z weekly 0.8 https://huntrule.com/rules/windows-hacktool-outflank-dumpert-default-dump-file-creation-93d94efc 2026-07-30T04:22:48.506Z weekly 0.8 https://huntrule.com/rules/windows-file-event-indicators-for-crackmapexec-hacktool-artifacts-736ffa74 2026-07-30T04:22:47.010Z weekly 0.8 https://huntrule.com/rules/windows-notepad-updater-gup-exe-creates-files-in-uncommon-locations-3b8f4c92 2026-07-30T04:22:45.463Z weekly 0.8 https://huntrule.com/rules/gotoassist-temporary-installation-artefact-file-creation-windows-5d756aee 2026-07-30T04:22:43.872Z weekly 0.8 https://huntrule.com/rules/windows-persistence-file-drop-errorhandler-cmd-in-c-windows-setup-scripts-15904280 2026-07-30T04:22:39.094Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-dmp-hdmp-file-creation-via-shell-or-scripting-aba15bdd 2026-07-30T04:22:37.486Z weekly 0.8 https://huntrule.com/rules/windows-dll-search-order-hijacking-via-additional-space-in-dll-path-b6f91281 2026-07-30T04:22:35.826Z weekly 0.8 https://huntrule.com/rules/windows-desktop-ini-file-creation-access-by-unusual-process-81315b50 2026-07-30T04:22:34.297Z weekly 0.8 https://huntrule.com/rules/windows-dcom-internetexplorer-application-dll-hijack-via-iertutil-dll-file-write-2f7979ae 2026-07-30T04:22:32.662Z weekly 0.8 https://huntrule.com/rules/windows-dynamic-c-compilation-creates-cmdline-artefact-e4a74e34 2026-07-30T04:22:31.177Z weekly 0.8 https://huntrule.com/rules/windows-csexec-service-file-creation-via-csexecsvc-exe-f0e2b768 2026-07-30T04:22:29.767Z weekly 0.8 https://huntrule.com/rules/windows-wscript-cscript-script-file-dropper-via-file-write-to-scripting-extensio-002bdb95 2026-07-30T04:22:28.122Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-with-credential-dump-related-filenames-8fbf3271 2026-07-30T04:22:25.905Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-executing-program-exe-via-unquoted-file-path-8c3c76ca 2026-07-30T04:22:24.351Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-system-process-executables-in-non-system-locations-d5866ddf 2026-07-30T04:22:22.677Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-system-dll-names-in-uncommon-directories-13c02350 2026-07-30T04:22:20.867Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-scr-screensaver-binary-file-creation-97aa2e88 2026-07-30T04:22:19.255Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-new-custom-apppatch-shim-database-files-created-ee63c85c 2026-07-30T04:22:17.578Z weekly 0.8 https://huntrule.com/rules/windows-deno-writing-files-to-appdata-from-remote-https-sources-6c0ce3b6 2026-07-30T04:22:16.139Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-non-existent-system-dlls-in-system32-df6ecb8b 2026-07-30T04:22:14.523Z weekly 0.8 https://huntrule.com/rules/windows-evtx-file-creation-in-non-standard-locations-65236ec7 2026-07-30T04:22:07.278Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-creation-by-openedr-itsmservice-exe-using-executable-arc-9e4b7d3a 2026-07-30T04:22:05.654Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-for-sharphound-bloodhound-collection-output-filenames-02773bed 2026-07-30T04:22:03.953Z weekly 0.8 https://huntrule.com/rules/windows-new-dll-created-by-aspnet-compiler-exe-in-temporary-asp-net-assembly-pat-4c7f49ee 2026-07-30T04:22:01.943Z weekly 0.8 https://huntrule.com/rules/windows-arcsoc-exe-creates-potentially-malicious-script-or-executable-files-e890acee 2026-07-30T04:22:00.393Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-anydesk-binary-writes-except-gcapi-dll-2d367498 2026-07-30T04:21:58.554Z weekly 0.8 https://huntrule.com/rules/anydesk-temporary-artefact-file-writes-on-windows-0b9ad457 2026-07-30T04:21:56.732Z weekly 0.8 https://huntrule.com/rules/advanced-ip-scanner-execution-via-windows-temp-file-path-fed85bf9 2026-07-30T04:21:55.160Z weekly 0.8 https://huntrule.com/rules/windows-adsi-schema-cache-sch-file-creation-by-uncommon-executables-75bf09fa 2026-07-30T04:21:53.539Z weekly 0.8 https://huntrule.com/rules/windows-uncommon-process-deletes-zone-identifier-alternate-data-stream-ads-3109530e 2026-07-30T04:21:51.993Z weekly 0.8 https://huntrule.com/rules/windows-dns-exe-deletes-files-not-targeting-dns-log-8f0b1fb1 2026-07-30T04:21:50.410Z weekly 0.8 https://huntrule.com/rules/windows-file-deletion-using-sysinternals-sdelete-aaa-zzz-filename-suffixes-6ddab845 2026-07-30T04:21:48.946Z weekly 0.8 https://huntrule.com/rules/windows-deletion-of-tomcat-web-server-log-files-270185ff 2026-07-30T04:21:47.188Z weekly 0.8 https://huntrule.com/rules/windows-teamviewer-log-file-deletion-b1decb61 2026-07-30T04:21:45.703Z weekly 0.8 https://huntrule.com/rules/windows-prefetch-pf-file-deletion-via-filedelete-0a1f9d29 2026-07-30T04:21:44.089Z weekly 0.8 https://huntrule.com/rules/windows-powershell-console-history-file-deleted-psreadline-consolehost-history-t-ff301988 2026-07-30T04:21:42.335Z weekly 0.8 https://huntrule.com/rules/windows-process-deletes-its-own-executable-image-f01d1f70 2026-07-30T04:21:40.854Z weekly 0.8 https://huntrule.com/rules/windows-iis-webserver-access-log-files-deleted-3eb8c339 2026-07-30T04:21:39.230Z weekly 0.8 https://huntrule.com/rules/windows-exchange-powershell-cmdlet-history-log-files-deleted-a55349d8 2026-07-30T04:21:37.778Z weekly 0.8 https://huntrule.com/rules/windows-event-log-evtx-file-deletion-from-system32-winevt-logs-63c779ba 2026-07-30T04:21:36.148Z weekly 0.8 https://huntrule.com/rules/windows-deletion-of-backup-file-extensions-via-command-line-binaries-06125661 2026-07-30T04:21:34.526Z weekly 0.8 https://huntrule.com/rules/windows-dns-exe-modifies-unexpected-files-9f383dc0 2026-07-30T04:21:32.364Z weekly 0.8 https://huntrule.com/rules/windows-uncommon-processes-accessing-microsoft-teams-cookies-or-local-storage-le-65744385 2026-07-30T04:21:30.684Z weekly 0.8 https://huntrule.com/rules/windows-file-access-by-non-browser-processes-to-browser-credential-storage-a1dfd976 2026-07-30T04:21:27.341Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-dpapi-master-keys-by-uncommon-applications-46612ae6 2026-07-30T04:21:24.031Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-crypto-wallet-files-by-uncommon-applications-f41b0311 2026-07-30T04:21:22.547Z weekly 0.8 https://huntrule.com/rules/windows-credential-history-file-access-by-uncommon-image-paths-7a2a22ea 2026-07-30T04:21:20.794Z weekly 0.8 https://huntrule.com/rules/windows-credential-manager-and-vault-access-from-unusual-process-images-407aecb1 2026-07-30T04:21:19.349Z weekly 0.8 https://huntrule.com/rules/windows-windivert-driver-load-detection-via-loaded-driver-image-or-known-imphash-679085d5 2026-07-30T04:21:17.646Z weekly 0.8 https://huntrule.com/rules/windows-winring0-driver-load-via-imphash-or-image-path-match-1a42dfa6 2026-07-30T04:21:15.617Z weekly 0.8 https://huntrule.com/rules/windows-hacksys-extreme-vulnerable-driver-hevd-sys-load-detection-295c9289 2026-07-30T04:21:14.049Z weekly 0.8 https://huntrule.com/rules/windows-vulnerable-driver-load-by-known-file-name-72cd00d6 2026-07-30T04:21:12.082Z weekly 0.8 https://huntrule.com/rules/windows-driver-load-with-image-path-containing-temp-2c4523d5 2026-07-30T04:21:07.007Z weekly 0.8 https://huntrule.com/rules/windows-driver-load-for-system-informer-systeminformer-sys-with-known-hashes-10cb6535 2026-07-30T04:21:05.412Z weekly 0.8 https://huntrule.com/rules/windows-driver-load-process-hacker-kernel-driver-processhacker-sys-67add051 2026-07-30T04:21:03.582Z weekly 0.8 https://huntrule.com/rules/windows-malicious-driver-load-identified-by-known-driver-file-names-39b64854 2026-07-30T04:21:01.648Z weekly 0.8 https://huntrule.com/rules/windows-malicious-driver-load-by-known-hash-match-05296024 2026-07-30T04:20:59.949Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-for-visual-studio-code-tunnels-domain-b3e6418f 2026-07-30T04:20:58.167Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-containing-ufile-io-1cbbeaaf 2026-07-30T04:20:56.563Z weekly 0.8 https://huntrule.com/rules/windows-sysmon-detect-dns-queries-for-onion-and-tor-gateway-proxy-domains-b55ca2a3 2026-07-30T04:20:54.293Z weekly 0.8 https://huntrule.com/rules/windows-dns-teamviewer-domain-queried-by-non-teamviewer-named-process-778ba9a8 2026-07-30T04:20:52.723Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-for-public-ip-lookup-api-domains-by-non-browser-processes-ec82e2a5 2026-07-30T04:20:51.102Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-to-remote-access-remote-support-domains-from-non-browser-pro-4d07b1f4 2026-07-30T04:20:49.504Z weekly 0.8 https://huntrule.com/rules/windows-regsvr32-exe-dns-queries-detected-36e037c4 2026-07-30T04:20:47.467Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-from-quickassist-exe-to-remoteassistance-support-services-mi-882e858a 2026-07-30T04:20:45.736Z weekly 0.8 https://huntrule.com/rules/windows-onelaunch-update-domain-dns-queries-via-onelaunch-exe-df68f791 2026-07-30T04:20:44.156Z weekly 0.8 https://huntrule.com/rules/windows-dns-query-for-mega-userstorage-subdomains-613c03ba 2026-07-30T04:20:42.501Z weekly 0.8 https://huntrule.com/rules/suspicious-cobalt-strike-style-dns-beaconing-via-sysmon-on-windows-f356a9c4 2026-07-30T04:20:41.017Z weekly 0.8 https://huntrule.com/rules/windows-dns-query-contains-base64-kerberos-coercion-credential-target-signature-e7a21b5f 2026-07-30T04:20:39.502Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-triggered-by-azure-hybridconnectionmanager-to-servicebus-win-7bd3902d 2026-07-30T04:20:37.783Z weekly 0.8 https://huntrule.com/rules/windows-dns-detection-for-notepad-gup-exe-queries-to-uncommon-domains-2074e137 2026-07-30T04:20:35.842Z weekly 0.8 https://huntrule.com/rules/windows-finger-exe-dns-queries-indicating-potential-c2-command-fetching-c082c2b0 2026-07-30T04:20:34.242Z weekly 0.8 https://huntrule.com/rules/windows-dns-query-to-azurewebsites-net-by-non-browser-process-e043f529 2026-07-30T04:20:32.656Z weekly 0.8 https://huntrule.com/rules/windows-dns-server-discovery-via-ldap-query-to-ldap-domain-a21bcd7e 2026-07-30T04:20:30.745Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-to-devtunnels-devtunnels-ms-1cb0c6ce 2026-07-30T04:20:29.037Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-to-malware-hosting-and-url-shortener-domains-f8c1e80b 2026-07-30T04:20:27.513Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-matching-cloudflared-tunnel-domains-a1d9eec5 2026-07-30T04:20:25.857Z weekly 0.8 https://huntrule.com/rules/windows-appinstaller-exe-dns-queries-during-ms-appinstaller-package-installation-7cff77e1 2026-07-30T04:20:24.471Z weekly 0.8 https://huntrule.com/rules/windows-sysmon-dns-query-for-anonfiles-com-domain-065cceea 2026-07-30T04:20:22.858Z weekly 0.8 https://huntrule.com/rules/windows-file-download-indicators-of-suspicious-content-via-zip-tld-0bb4bbeb 2026-07-30T04:20:20.912Z weekly 0.8 https://huntrule.com/rules/windows-winget-installs-from-zone-identifier-marked-sources-in-temp-winget-a3f5c081 2026-07-30T04:20:19.185Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-downloads-from-direct-ip-urls-with-executable-attachment-025bd229 2026-07-30T04:20:17.177Z weekly 0.8 https://huntrule.com/rules/regedit-exe-exports-a-registry-key-into-an-alternate-data-stream-windows-0d7a9363 2026-07-30T04:20:15.527Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-stream-creation-matching-hack-tool-imphash-19b041f6 2026-07-30T04:20:13.840Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-stream-downloads-from-file-sharing-domains-with-script-e-ae02ed70 2026-07-30T04:20:12.091Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-file-download-via-file-sharing-domains-using-sysmon-stream-ha-52182dfb 2026-07-30T04:20:10.249Z weekly 0.8 https://huntrule.com/rules/windows-ads-creation-with-zone-identifier-markers-outside-browser-downloads-573df571 2026-07-30T04:20:08.391Z weekly 0.8 https://huntrule.com/rules/windows-executable-hidden-in-ntfs-alternate-data-stream-via-imphash-marker-b69888d4 2026-07-30T04:20:06.594Z weekly 0.8 https://huntrule.com/rules/windows-createremotethread-using-ttdinject-exe-as-proxy-c15e99a3 2026-07-30T04:20:04.726Z weekly 0.8 https://huntrule.com/rules/windows-remote-thread-creation-targeting-uncommon-image-processes-a1a144b7 2026-07-30T04:20:03.194Z weekly 0.8 https://huntrule.com/rules/windows-remote-thread-creation-triggered-from-uncommon-source-images-66d31e5f 2026-07-30T04:20:01.251Z weekly 0.8 https://huntrule.com/rules/windows-rare-remote-thread-creation-triggered-by-uncommon-source-images-02d1d718 2026-07-30T04:19:59.553Z weekly 0.8 https://huntrule.com/rules/windows-lsass-remote-thread-creation-indicating-password-dumper-behavior-f239b326 2026-07-30T04:19:57.581Z weekly 0.8 https://huntrule.com/rules/windows-powershell-remote-thread-creation-into-rundll32-exe-or-regsvr32-exe-99b97608 2026-07-30T04:19:55.679Z weekly 0.8 https://huntrule.com/rules/windows-powershell-remote-thread-into-lsass-exe-for-potential-credential-dumping-fb656378 2026-07-30T04:19:54.026Z weekly 0.8 https://huntrule.com/rules/windows-remote-thread-creation-in-mstsc-exe-triggered-by-suspicious-source-paths-c0aac16a 2026-07-30T04:19:52.072Z weekly 0.8 https://huntrule.com/rules/windows-remote-thread-created-in-keepass-exe-77564cc2 2026-07-30T04:19:50.474Z weekly 0.8 https://huntrule.com/rules/windows-createremotethread-with-startaddress-ending-in-0b80-0c7c-0c88-6309645e 2026-07-30T04:19:49.025Z weekly 0.8 https://huntrule.com/rules/windows-hacktool-cactustorch-remote-thread-creation-via-cscript-wscript-mshta-of-2e4e488a 2026-07-30T04:19:47.230Z weekly 0.8 https://huntrule.com/rules/windows-wmi-persistence-via-event-filter-and-event-consumer-event-ids-5861-and-5-0b7889b4 2026-07-30T04:19:45.372Z weekly 0.8 https://huntrule.com/rules/failed-wmi-nteventlogfile-cleareventlog-attempts-on-windows-event-5858-d4f1a2b3 2026-07-30T04:19:43.277Z weekly 0.8 https://huntrule.com/rules/windows-defender-windefend-virus-scanning-disabled-event-id-5012-686c0b4b 2026-07-30T04:19:41.401Z weekly 0.8 https://huntrule.com/rules/windows-windefend-logs-windows-defender-detections-and-remediation-actions-57b649ef 2026-07-30T04:19:39.628Z weekly 0.8 https://huntrule.com/rules/windows-windefend-tamper-protection-blocked-microsoft-defender-setting-changes-49e5bc24 2026-07-30T04:19:37.943Z weekly 0.8 https://huntrule.com/rules/windows-defender-configuration-change-alerts-via-microsoft-defender-windefend-ev-801bd44f 2026-07-30T04:19:36.445Z weekly 0.8 https://huntrule.com/rules/windows-windefend-antimalware-restores-file-from-quarantine-event-id-1009-bc92ca75 2026-07-30T04:19:34.651Z weekly 0.8 https://huntrule.com/rules/windows-defender-real-time-protection-feature-error-or-restart-windefend-dd80db93 2026-07-30T04:19:33.034Z weekly 0.8 https://huntrule.com/rules/windows-windefend-windows-defender-real-time-protection-disabled-event-id-5001-b28e58e4 2026-07-30T04:19:31.159Z weekly 0.8 https://huntrule.com/rules/windows-defender-windefend-amsi-alert-event-id-1116-ea9bf0fa 2026-07-30T04:19:29.662Z weekly 0.8 https://huntrule.com/rules/windows-defender-malware-and-pua-scanning-disabled-event-id-5010-bc275be9 2026-07-30T04:19:27.695Z weekly 0.8 https://huntrule.com/rules/windows-defender-windefend-deletes-malware-detection-history-event-id-1013-2afe6582 2026-07-30T04:19:26.099Z weekly 0.8 https://huntrule.com/rules/windows-defender-windefend-automatic-sample-submission-disabled-via-antimalware--91903aba 2026-07-30T04:19:24.649Z weekly 0.8 https://huntrule.com/rules/windows-defender-exploit-guard-tamper-via-protectedfolders-or-allowedapplication-a3ab73f1 2026-07-30T04:19:22.790Z weekly 0.8 https://huntrule.com/rules/windows-defender-exclusions-added-via-windefend-event-id-5007-1321dc4e 2026-07-30T04:19:21.205Z weekly 0.8 https://huntrule.com/rules/windows-defender-exploit-guard-blocks-psexec-and-wmi-process-creations-windefend-97b9ce1e 2026-07-30T04:19:19.654Z weekly 0.8 https://huntrule.com/rules/windows-defender-asr-lsass-access-block-event-1121-detection-a0a278fe 2026-07-30T04:19:17.904Z weekly 0.8 https://huntrule.com/rules/windows-defender-antimalware-grace-period-expired-event-id-5101-windefend-360a1340 2026-07-30T04:19:15.945Z weekly 0.8 https://huntrule.com/rules/windows-event-log-keyword-match-for-mimikatz-credential-dumping-and-kerberos-mod-06d71506 2026-07-30T04:19:14.206Z weekly 0.8 https://huntrule.com/rules/windows-ngrok-forwarding-to-local-rdp-port-via-terminalservices-eventid-21-64d51a51 2026-07-30T04:19:12.435Z weekly 0.8 https://huntrule.com/rules/windows-task-scheduler-detect-scheduled-task-deleted-or-disabled-for-key-system--9e3cb244 2026-07-30T04:19:10.600Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-execution-of-uncommon-binaries-via-taskscheduler-f0767f15 2026-07-30T04:19:08.940Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-execution-from-suspicious-paths-424273ea 2026-07-30T04:19:07.225Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-using-script-host-execution-event-id-7045-70f00d10 2026-07-30T04:19:05.184Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-referencing-suspicious-programdata-root-exe-paths-e-1b2ae822 2026-07-30T04:19:03.322Z weekly 0.8 https://huntrule.com/rules/windows-rtcore64-service-installation-event-id-7045-91c49341 2026-07-30T04:18:59.257Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-unexpected-termination-of-message-queuing-msmq-s-56abae0c 2026-07-30T04:18:56.068Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-important-service-terminated-with-error-d6b5520d 2026-07-30T04:18:54.419Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-service-terminated-with-error-eventid-7023-acfa2210 2026-07-30T04:18:52.318Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-for-tap-driver-installation-service-control-manager-704-8e4cf0e5 2026-07-30T04:18:49.016Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-tacticalrmm-agent-service-scm-event-id-7045-4bb79b62 2026-07-30T04:18:47.152Z weekly 0.8 https://huntrule.com/rules/windows-psexec-service-installation-via-service-control-manager-event-id-7045-42c575ea 2026-07-30T04:18:42.609Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-via-suspicious-command-line-imagepath-event-id-7045-1d61f71d 2026-07-30T04:18:41.067Z weekly 0.8 https://huntrule.com/rules/windows-service-installed-by-system-process-with-pid-0-71c276aa 2026-07-30T04:18:39.459Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-detects-sliver-service-installation-via-default--31c51af6 2026-07-30T04:18:37.942Z weekly 0.8 https://huntrule.com/rules/windows-remote-utilities-host-service-installation-via-service-control-manager-7-85cce894 2026-07-30T04:18:36.216Z weekly 0.8 https://huntrule.com/rules/windows-system-service-installation-of-remote-access-tools-1a31b18a 2026-07-30T04:18:34.293Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-detects-remcomsvc-service-installation-9e36ed87 2026-07-30T04:18:32.750Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-processhacker-privilege-elevation-via-service-control-m-c4ff1eac 2026-07-30T04:18:31.101Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-pdqdeployrunner-service-installation-pdqdeploy-b98a10af 2026-07-30T04:18:29.531Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-of-pdqdeploy-service-service-control-manager-event--ee9ca27c 2026-07-30T04:18:27.831Z weekly 0.8 https://huntrule.com/rules/windows-detects-paexec-service-installation-via-service-control-manager-event-id-de7ce410 2026-07-30T04:18:26.187Z weekly 0.8 https://huntrule.com/rules/windows-netsupport-manager-client32-service-installation-via-service-control-man-2d510d8d 2026-07-30T04:18:24.419Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-of-meshagent-exe-via-service-control-manager-event--e0d1ad53 2026-07-30T04:18:22.719Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-hacktool-service-registration-or-execution-d26ce60c 2026-07-30T04:18:21.028Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-csexec-service-installation-eventid-7045-a27e5fa9 2026-07-30T04:18:19.021Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-of-anydesk-service-event-id-7045-530a6faa 2026-07-30T04:18:17.458Z weekly 0.8 https://huntrule.com/rules/windows-powershell-script-executed-via-service-control-manager-event-id-7045-a2e5019d 2026-07-30T04:18:15.790Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-moriya-rootkit-related-zznetsvc-via-service-control-man-25b9c01c 2026-07-30T04:18:14.026Z weekly 0.8 https://huntrule.com/rules/windows-system-service-execution-of-credential-dumping-tools-via-service-control-4976aa50 2026-07-30T04:18:10.412Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-for-krbscm-via-krbrelayup-tool-e97d9903 2026-07-30T04:18:08.564Z weekly 0.8 https://huntrule.com/rules/windows-system-service-control-manager-detects-var-obfuscated-powershell-in-serv-14bcba49 2026-07-30T04:18:07.018Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-execution-of-rundll32-with-obfuscated-powershell-641a4bfb 2026-07-30T04:18:05.019Z weekly 0.8 https://huntrule.com/rules/windows-system-service-creation-using-mshta-with-vbscript-createobject-7e9c7999 2026-07-30T04:18:03.221Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-clipboard-related-clip-exe-execution-via-system--63e3365d 2026-07-30T04:18:01.409Z weekly 0.8 https://huntrule.com/rules/windows-system-event-7045-service-control-manager-runs-imagepath-with-invoke-env-487c7524 2026-07-30T04:17:59.697Z weekly 0.8 https://huntrule.com/rules/windows-system-service-control-manager-rundll32-launching-powershell-via-shell32-11b52f18 2026-07-30T04:17:57.776Z weekly 0.8 https://huntrule.com/rules/windows-system-service-creation-of-obfuscated-powershell-using-compress-obfuscat-175997c5 2026-07-30T04:17:55.807Z weekly 0.8 https://huntrule.com/rules/windows-system-service-control-manager-cmd-c-r-setting-variables-with-f-in-image-8ca7004b 2026-07-30T04:17:54.017Z weekly 0.8 https://huntrule.com/rules/windows-system-service-creates-cmd-launching-powershell-with-stdin-obfuscation-72862bf2 2026-07-30T04:17:52.201Z weekly 0.8 https://huntrule.com/rules/windows-system-service-creation-with-obfuscated-powershell-iex-invocation-patter-51aa9387 2026-07-30T04:17:50.545Z weekly 0.8 https://huntrule.com/rules/windows-system-service-control-manager-launches-cmd-with-obfuscated-clip-exe-to--f7385ee2 2026-07-30T04:17:48.962Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-event-7045-for-smbexec-py-style-service-name-and-52a85084 2026-07-30T04:17:47.021Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-windows-defender-threat-protection-service-stopp-6c0a7755 2026-07-30T04:17:45.272Z weekly 0.8 https://huntrule.com/rules/windows-service-control-manager-7045-suspicious-cobalt-strike-service-imagepath--5a105d34 2026-07-30T04:17:43.550Z weekly 0.8 https://huntrule.com/rules/windows-system-ntfs-event-id-55-corrupted-file-record-exploitation-activity-f14719ce 2026-07-30T04:17:41.671Z weekly 0.8 https://huntrule.com/rules/windows-system-netlogon-secure-channel-connection-allowed-event-id-5829-a0cb7110 2026-07-30T04:17:39.845Z weekly 0.8 https://huntrule.com/rules/windows-zerologon-exploitation-attempt-from-kali-host-using-mimikatz-18f37338 2026-07-30T04:17:37.812Z weekly 0.8 https://huntrule.com/rules/windows-system-log-windows-update-client-errors-installation-connection-revert-13cfeb75 2026-07-30T04:17:35.698Z weekly 0.8 https://huntrule.com/rules/windows-system-crash-dump-reporting-via-wer-event-id-1001-882fbe50 2026-07-30T04:17:34.026Z weekly 0.8 https://huntrule.com/rules/windows-detect-volume-shadow-copy-vss-mount-via-ntfs-event-98-f512acbf 2026-07-30T04:17:32.380Z weekly 0.8 https://huntrule.com/rules/windows-kernel-general-etw-reset-access-bits-for-temp-sam-security-hive-39f919f3 2026-07-30T04:17:30.757Z weekly 0.8 https://huntrule.com/rules/windows-kerberos-key-distribution-center-errors-no-suitable-key-or-unsupported-e-b1e0b3f5 2026-07-30T04:17:28.592Z weekly 0.8 https://huntrule.com/rules/windows-kerberos-kdc-event-39-41-certificate-valid-without-strong-user-mapping-993c2665 2026-07-30T04:17:26.996Z weekly 0.8 https://huntrule.com/rules/windows-system-eventlog-cleared-event-id-104-100ef69e 2026-07-30T04:17:25.357Z weekly 0.8 https://huntrule.com/rules/windows-event-log-cleared-microsoft-windows-eventlog-event-id-104-a62b37e0 2026-07-30T04:17:23.842Z weekly 0.8 https://huntrule.com/rules/windows-lpe-via-com-clsid-tabtip-exe-invoked-through-dcom-activation-microsoft-w-bc2e25ed 2026-07-30T04:17:22.267Z weekly 0.8 https://huntrule.com/rules/windows-dhcp-server-callout-dll-load-failures-event-ids-1031-1032-1034-75edd3fd 2026-07-30T04:17:20.638Z weekly 0.8 https://huntrule.com/rules/windows-dhcp-server-loads-callout-dll-via-registry-event-id-1033-13fc89a9 2026-07-30T04:17:18.928Z weekly 0.8 https://huntrule.com/rules/windows-active-directory-certificate-services-denied-enrollment-requests-event-i-994bfd6d 2026-07-30T04:17:17.130Z weekly 0.8 https://huntrule.com/rules/windows-isatap-router-address-configuration-set-microsoft-windows-iphlpsvc-d22df9cd 2026-07-30T04:17:14.536Z weekly 0.8 https://huntrule.com/rules/windows-system-ntlmv1-logon-reported-between-client-and-server-lsasrv-6038-6039-e9d4ab66 2026-07-30T04:17:12.921Z weekly 0.8 https://huntrule.com/rules/windows-sysmon-application-error-popups-application-popup-event-id-26-4d7f1827 2026-07-30T04:17:11.037Z weekly 0.8 https://huntrule.com/rules/windows-smb-server-share-access-without-signing-or-encryption-event-4000-8d91f6e4 2026-07-30T04:17:09.491Z weekly 0.8 https://huntrule.com/rules/windows-smb-client-security-rejected-guest-logon-with-blank-username-71886b70 2026-07-30T04:17:07.782Z weekly 0.8 https://huntrule.com/rules/windows-shell-core-suspicious-shortcut-app-resolver-cache-entries-zenmap-anydesk-83c161b6 2026-07-30T04:17:06.172Z weekly 0.8 https://huntrule.com/rules/windows-hybrid-connection-manager-service-events-with-service-bus-endpoints-b55d23e5 2026-07-30T04:17:04.280Z weekly 0.8 https://huntrule.com/rules/windows-security-mitigations-blocked-unsigned-dlls-loaded-from-suspicious-paths-8289bf8c 2026-07-30T04:17:02.435Z weekly 0.8 https://huntrule.com/rules/windows-defender-blocked-mpcmdrun-and-nissrv-from-loading-unsigned-dlls-0b0ea3cc 2026-07-30T04:17:00.586Z weekly 0.8 https://huntrule.com/rules/windows-security-remote-wmi-dll-hijack-via-wmiprvse-wbemcomn-dll-placed-in-syste-f6c68d5f 2026-07-30T04:16:42.779Z weekly 0.8 https://huntrule.com/rules/windows-wmi-persistence-via-subscription-namespace-objecttype-security-event-466-f033f3f3 2026-07-30T04:16:40.907Z weekly 0.8 https://huntrule.com/rules/windows-security-event-handle-write-access-requested-on-defender-exclusions-regi-e9c8808f 2026-07-30T04:16:39.238Z weekly 0.8 https://huntrule.com/rules/windows-security-log-windows-defender-exclusions-registry-key-value-modified-46a68649 2026-07-30T04:16:37.464Z weekly 0.8 https://huntrule.com/rules/windows-security-vssaudit-security-event-source-registration-event-ids-4904-4905-e9faba72 2026-07-30T04:16:35.766Z weekly 0.8 https://huntrule.com/rules/windows-security-4634-4647-user-logoff-events-0badd08f 2026-07-30T04:16:34.066Z weekly 0.8 https://huntrule.com/rules/windows-security-4673-seloaddriverprivilege-used-to-load-unload-kernel-drivers-f63508a0 2026-07-30T04:16:31.947Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-local-user-creation-event-id-4720-66b6be3d 2026-07-30T04:16:29.680Z weekly 0.8 https://huntrule.com/rules/windows-security-failed-lsaregisterlogonprocess-service-call-setcbprivilege-chec-6daac7fc 2026-07-30T04:16:28.346Z weekly 0.8 https://huntrule.com/rules/windows-security-4732-new-member-added-to-local-administrators-group-c265cf08 2026-07-30T04:16:26.320Z weekly 0.8 https://huntrule.com/rules/windows-security-event-5145-credential-file-transfers-via-network-shares-910ab938 2026-07-30T04:16:24.386Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-access-to-microsoft-teams-token-and-local-storage-objects-466-25cde13e 2026-07-30T04:16:21.510Z weekly 0.8 https://huntrule.com/rules/windows-security-4697-tap-driver-service-installation-tap0901-9c8afa4d 2026-07-30T04:16:19.995Z weekly 0.8 https://huntrule.com/rules/windows-security-event-alerts-on-sysmon-channel-reference-deletion-18beca67 2026-07-30T04:16:18.428Z weekly 0.8 https://huntrule.com/rules/windows-security-syskey-relevant-lsa-registry-keys-access-via-handle-and-object--9a4ff3b8 2026-07-30T04:16:16.561Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4616-for-system-time-changes-by-non-system-processes-faa031b5 2026-07-30T04:16:07.713Z weekly 0.8 https://huntrule.com/rules/windows-security-4702-scheduled-task-content-change-with-suspicious-strings-614cf376 2026-07-30T04:16:06.116Z weekly 0.8 https://huntrule.com/rules/windows-security-event-scheduled-task-deleted-or-disabled-important-task-names-7595ba94 2026-07-30T04:16:04.464Z weekly 0.8 https://huntrule.com/rules/windows-security-suspicious-scheduled-task-creation-via-event-4698-and-taskconte-3a734d25 2026-07-30T04:16:02.548Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4769-kerberos-service-tickets-requested-with-rc4-encrypti-496a0e47 2026-07-30T04:16:00.627Z weekly 0.8 https://huntrule.com/rules/windows-security-network-share-access-to-sensitive-file-extensions-91c945bc 2026-07-30T04:15:59.064Z weekly 0.8 https://huntrule.com/rules/windows-security-event-id-5136-msds-keycredentiallink-shadow-credentials-added-f598ea0c 2026-07-30T04:15:55.385Z weekly 0.8 https://huntrule.com/rules/uncommon-outbound-kerberos-port-88-connections-on-windows-security-events-5156-eca91c7c 2026-07-30T04:15:53.507Z weekly 0.8 https://huntrule.com/rules/windows-security-password-protected-zip-opened-from-outlook-attachment-571498c8 2026-07-30T04:15:51.809Z weekly 0.8 https://huntrule.com/rules/windows-security-opened-encrypted-zip-files-with-suspicious-invoice-order-filena-54f0434b 2026-07-30T04:15:50.338Z weekly 0.8 https://huntrule.com/rules/windows-security-password-protected-zip-opened-eventid-5379-00ba9da1 2026-07-30T04:15:48.143Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4661-sam-object-access-domain-administrator-group-recon-968eef52 2026-07-30T04:15:46.502Z weekly 0.8 https://huntrule.com/rules/windows-security-event-alert-suspicious-accessmask-requests-to-lsass-4a1b6da0 2026-07-30T04:15:44.649Z weekly 0.8 https://huntrule.com/rules/windows-security-password-dumping-via-lsass-handle-access-sam-domain-aa1697b7 2026-07-30T04:15:42.879Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-remote-logon-using-explicit-credentials-941e5c45 2026-07-30T04:15:41.266Z weekly 0.8 https://huntrule.com/rules/windows-security-suspicious-local-account-creation-with-anonymous-logon-account--1bbf25b9 2026-07-30T04:15:39.458Z weekly 0.8 https://huntrule.com/rules/windows-security-event-5136-suspicious-ldap-display-names-used-in-directory-serv-d00a9a72 2026-07-30T04:15:37.473Z weekly 0.8 https://huntrule.com/rules/windows-security-failed-kerberos-tgt-request-event-675-4768-4769-4771-f7644214 2026-07-30T04:15:35.909Z weekly 0.8 https://huntrule.com/rules/windows-gpo-startup-logon-script-added-to-user-or-computer-extensions-123e4e6d 2026-07-30T04:15:34.151Z weekly 0.8 https://huntrule.com/rules/windows-group-policy-object-attribute-change-adding-privileges-or-local-admins-1c480e10 2026-07-30T04:15:32.162Z weekly 0.8 https://huntrule.com/rules/windows-failed-logons-with-suspicious-status-substatus-codes-4625-4776-9eb99343 2026-07-30T04:15:30.382Z weekly 0.8 https://huntrule.com/rules/windows-security-4794-dsrm-directory-services-restore-mode-account-password-chan-53ad8e36 2026-07-30T04:15:22.885Z weekly 0.8 https://huntrule.com/rules/windows-security-suspicious-samtheadmin-computer-account-names-39698b3f 2026-07-30T04:15:21.126Z weekly 0.8 https://huntrule.com/rules/windows-security-ad-account-sidhistory-added-or-modified-event-4765-4766-4738-2632954e 2026-07-30T04:15:19.451Z weekly 0.8 https://huntrule.com/rules/windows-security-domain-trust-creation-event-id-4706-0255a820 2026-07-30T04:15:17.487Z weekly 0.8 https://huntrule.com/rules/windows-security-5145-smb-write-to-admin-share-c-by-non-machine-accounts-b210394c 2026-07-30T04:15:15.862Z weekly 0.8 https://huntrule.com/rules/windows-monitor-file-access-to-signal-desktop-config-json-and-db-sqlite-5d6c375a 2026-07-30T04:15:14.206Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-via-unusual-client-clientprocessid-or-parentprocess-c4e92a97 2026-07-30T04:15:12.202Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-of-remote-access-tools-event-id-4697-c8b00925 2026-07-30T04:15:10.561Z weekly 0.8 https://huntrule.com/rules/windows-potential-secure-deletion-via-sdelete-file-extensions-aaa-and-zzz-39a80702 2026-07-30T04:15:08.875Z weekly 0.8 https://huntrule.com/rules/windows-non-system-access-uses-setakeownershipprivilege-on-scm-database-object-dae8171c 2026-07-30T04:15:07.115Z weekly 0.8 https://huntrule.com/rules/windows-security-scm-database-handle-acquisition-failures-event-id-4656-13addce7 2026-07-30T04:15:05.189Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-sam-registry-hive-handle-requests-eventid-4656-f8748f2c 2026-07-30T04:15:03.282Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4649-flags-kerberos-replay-attempts-krb-ap-err-repeat-5a44727c 2026-07-30T04:15:01.647Z weekly 0.8 https://huntrule.com/rules/windows-security-log-detect-winrm-powershell-remoting-inbound-connections-on-598-13acf386 2026-07-30T04:15:00.002Z weekly 0.8 https://huntrule.com/rules/windows-security-4663-detects-read-control-read-control-access-to-service-regist-11d00fff 2026-07-30T04:14:58.263Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4611-new-trusted-logon-process-via-user32logonprocesss-12e6d621 2026-07-30T04:14:56.630Z weekly 0.8 https://huntrule.com/rules/windows-security-event-5156-rdp-3389-over-loopback-via-svchost-reverse-ssh-tunne-5bed80b6 2026-07-30T04:14:55.011Z weekly 0.8 https://huntrule.com/rules/windows-security-network-access-to-protected-storage-via-ipc-share-45545954 2026-07-30T04:14:53.149Z weekly 0.8 https://huntrule.com/rules/windows-powershell-script-installed-as-a-service-event-id-4697-2a926e6a 2026-07-30T04:14:51.645Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-dcshadow-like-spn-creation-gc-service-principal-names-32e19d25 2026-07-30T04:14:49.877Z weekly 0.8 https://huntrule.com/rules/windows-alert-on-suspicious-kerberos-tgt-requests-with-certificate-thumbprints-e-6a53d871 2026-07-30T04:14:48.004Z weekly 0.8 https://huntrule.com/rules/windows-pcap-driver-installation-via-sys-file-names-security-4697-7b687634 2026-07-30T04:14:44.380Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-password-policy-enumeration-via-event-id-4661-12ba6a38 2026-07-30T04:14:42.692Z weekly 0.8 https://huntrule.com/rules/windows-security-denied-remote-desktop-logon-attempts-event-id-4825-8e5c03fa 2026-07-30T04:14:40.803Z weekly 0.8 https://huntrule.com/rules/windows-security-new-or-renamed-user-account-name-contains-cfeed607 2026-07-30T04:14:38.663Z weekly 0.8 https://huntrule.com/rules/windows-security-event-5145-remote-writes-to-desktop-ini-via-unc-share-35bc7e28 2026-07-30T04:14:36.336Z weekly 0.8 https://huntrule.com/rules/windows-security-registry-netntlm-compatibilitylevel-and-ntlm-security-downgrade-d3abac66 2026-07-30T04:14:34.530Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-via-smb-psexec-using-psexesvc-event-id-4697-6fb63b40 2026-07-30T04:14:25.322Z weekly 0.8 https://huntrule.com/rules/metasploit-smb-authentication-attempts-via-ntlm-windows-security-4624-4625-4776-72124974 2026-07-30T04:14:23.259Z weekly 0.8 https://huntrule.com/rules/windows-security-events-wce-wceaux-dll-file-access-1de68c67 2026-07-30T04:14:20.802Z weekly 0.8 https://huntrule.com/rules/windows-security-service-execution-of-credential-dumping-tools-event-id-4697-f0d1feba 2026-07-30T04:14:19.436Z weekly 0.8 https://huntrule.com/rules/windows-security-event-detects-lsass-process-access-from-non-system-account-962fe167 2026-07-30T04:14:17.718Z weekly 0.8 https://huntrule.com/rules/windows-ad-dns-record-changes-containing-kerberos-credential-target-information--b07e58cf 2026-07-30T04:14:14.053Z weekly 0.8 https://huntrule.com/rules/windows-security-events-kerberos-tgt-requests-with-preauth-disabled-and-rc4-hmac-3e2f1b2c 2026-07-30T04:14:11.824Z weekly 0.8 https://huntrule.com/rules/windows-security-4769-kerberoasting-precursor-query-rc4-tgt-service-requests-d04ae2b8 2026-07-30T04:14:09.692Z weekly 0.8 https://huntrule.com/rules/windows-security-event-iso-image-mount-via-device-cdrom-0248a7bc 2026-07-30T04:14:07.764Z weekly 0.8 https://huntrule.com/rules/windows-security-4697-detects-var-launcher-obfuscated-powershell-in-servicefilen-4c54ba8f 2026-07-30T04:14:05.908Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4697-obfuscated-command-execution-using-rundll32-and-shel-cd0f7229 2026-07-30T04:14:04.265Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4697-mshta-script-obfuscation-indicators-9b8d9203 2026-07-30T04:14:02.310Z weekly 0.8 https://huntrule.com/rules/windows-security-eid-4697-powershell-launching-via-clip-exe-pattern-1a0a2ff1 2026-07-30T04:14:00.578Z weekly 0.8 https://huntrule.com/rules/powershell-obfuscation-via-stdin-using-service-parameter-strings-windows-securit-80b708f3 2026-07-30T04:13:58.907Z weekly 0.8 https://huntrule.com/rules/windows-security-4697-obfuscated-powershell-execution-via-rundll32-shell32-dll-f241cf1b 2026-07-30T04:13:56.998Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-obfuscated-powershell-using-compress-compression-stream--7a922f1b 2026-07-30T04:13:54.849Z weekly 0.8 https://huntrule.com/rules/windows-security-eid-4697-cmd-exe-command-using-obfuscated-set-with-f-likely-lau-dcf2db1f 2026-07-30T04:13:53.116Z weekly 0.8 https://huntrule.com/rules/windows-powershell-execution-via-obfuscated-cmdstdin-input-event-id-4697-0c718a5e 2026-07-30T04:13:51.158Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4697-obfuscated-powershell-iex-invocation-pattern-from-in-fd0f5778 2026-07-30T04:13:49.579Z weekly 0.8 https://huntrule.com/rules/windows-security-4697-clip-exe-obfuscated-powershell-via-cmd-and-clipboard-strin-4edf51e1 2026-07-30T04:13:47.540Z weekly 0.8 https://huntrule.com/rules/windows-service-installation-hybridconnectionmanager-event-id-4697-0ee4d8a5 2026-07-30T04:13:42.261Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-nofilter-execution-via-ronpolicy-filtering-platform-indi-7b14c76a 2026-07-30T04:13:40.758Z weekly 0.8 https://huntrule.com/rules/windows-security-edrsilencer-execution-via-filtering-platform-filter-added-98054878 2026-07-30T04:13:37.108Z weekly 0.8 https://huntrule.com/rules/windows-security-4720-hidden-local-user-account-creation-7b449a5e 2026-07-30T04:13:35.501Z weekly 0.8 https://huntrule.com/rules/windows-security-event-detection-gpo-scheduled-task-persistence-via-sysvol-sched-a8f29a7b 2026-07-30T04:13:33.240Z weekly 0.8 https://huntrule.com/rules/windows-security-log-usb-mass-storage-or-diskdrive-device-recognition-event-id-6-f69a87ea 2026-07-30T04:13:31.679Z weekly 0.8 https://huntrule.com/rules/windows-security-dpapi-domain-master-key-backup-attempt-event-id-4692-39a94fd1 2026-07-30T04:13:29.794Z weekly 0.8 https://huntrule.com/rules/windows-security-log-dpapi-domain-backup-key-extraction-via-lsa-secret-access-4ac1f50b 2026-07-30T04:13:28.142Z weekly 0.8 https://huntrule.com/rules/windows-registry-etw-disabled-for-net-via-complus-or-etwenabled-a4c90ea1 2026-07-30T04:13:26.634Z weekly 0.8 https://huntrule.com/rules/windows-security-4719-important-audit-policy-categories-disabled-ab4561b1 2026-07-30T04:13:24.490Z weekly 0.8 https://huntrule.com/rules/windows-security-log-auditing-disabled-via-windows-audit-policy-change-event-id--69aeb277 2026-07-30T04:13:22.238Z weekly 0.8 https://huntrule.com/rules/windows-security-log-device-installation-blocked-by-system-policy-event-id-6423-c9eb55c3 2026-07-30T04:13:19.935Z weekly 0.8 https://huntrule.com/rules/windows-security-event-5136-default-domain-gpo-container-modification-e5ac86dd 2026-07-30T04:13:18.399Z weekly 0.8 https://huntrule.com/rules/windows-security-4662-detects-mimikatz-style-dc-sync-directory-replication-acces-611eab06 2026-07-30T04:13:16.721Z weekly 0.8 https://huntrule.com/rules/windows-security-remote-dcom-ie-iertutil-dll-dll-hijack-via-network-file-write-5-c39f0c81 2026-07-30T04:13:14.899Z weekly 0.8 https://huntrule.com/rules/windows-security-failed-code-integrity-checks-event-ids-5038-and-6281-470ec5fa 2026-07-30T04:13:11.498Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4697-detects-suspicious-service-installations-with-c2-pow-d7a95147 2026-07-30T04:13:09.900Z weekly 0.8 https://huntrule.com/rules/windows-processes-accessing-microphone-and-webcam-capability-consent-stores-8cd538a4 2026-07-30T04:13:07.566Z weekly 0.8 https://huntrule.com/rules/windows-security-and-eventlog-clear-activity-event-ids-517-1102-d99b79d2 2026-07-30T04:13:05.449Z weekly 0.8 https://huntrule.com/rules/ruler-tool-activity-on-windows-security-event-4776-and-4624-4625-24549159 2026-07-30T04:13:02.072Z weekly 0.8 https://huntrule.com/rules/windows-security-4738-kerberoast-risk-via-weak-encryption-enabled-uac-change-f6de9536 2026-07-30T04:13:00.155Z weekly 0.8 https://huntrule.com/rules/windows-security-ad-user-backdoor-via-delegation-attributes-4738-5136-300bac00 2026-07-30T04:12:52.630Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-seenabledelegationprivilege-assigned-via-ad-event-id-470-311b6ce2 2026-07-30T04:12:50.853Z weekly 0.8 https://huntrule.com/rules/windows-security-access-to-admin-network-share-via-event-id-5140-098d7118 2026-07-30T04:12:49.167Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-computer-added-or-removed-from-domain-controller-20d96d95 2026-07-30T04:12:47.417Z weekly 0.8 https://huntrule.com/rules/windows-adcs-certificate-template-changes-with-risky-eku-and-enrollee-provided-s-bfbd3291 2026-07-30T04:12:45.991Z weekly 0.8 https://huntrule.com/rules/windows-ad-cs-detect-enrollment-template-using-ct-flag-enrollee-supplies-subject-5ee3a654 2026-07-30T04:12:42.889Z weekly 0.8 https://huntrule.com/rules/windows-security-4662-detects-ad-user-object-property-reads-from-non-machine-acc-ab6bffca 2026-07-30T04:12:41.169Z weekly 0.8 https://huntrule.com/rules/windows-security-4662-active-directory-replication-request-from-non-machine-acco-17d619c1 2026-07-30T04:12:39.332Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-write-dac-changes-on-active-directory-domain-objects-ds--028c7842 2026-07-30T04:12:37.542Z weekly 0.8 https://huntrule.com/rules/windows-security-privileged-user-group-sid-reconnaissance-via-sam-auditing-4661-35ba1d85 2026-07-30T04:12:35.823Z weekly 0.8 https://huntrule.com/rules/windows-security-detects-dcsync-extended-right-ace-changes-eventid-5136-via-powe-2c99737c 2026-07-30T04:12:33.888Z weekly 0.8 https://huntrule.com/rules/windows-security-event-registry-access-to-azure-ad-health-agent-keys-1d2ab8ac 2026-07-30T04:12:31.890Z weekly 0.8 https://huntrule.com/rules/windows-security-event-detection-access-to-azure-ad-health-monitoring-agent-regi-ff151c33 2026-07-30T04:12:30.026Z weekly 0.8 https://huntrule.com/rules/windows-wfp-blocked-connection-involving-edr-agent-binaries-bacf58c6 2026-07-30T04:12:28.403Z weekly 0.8 https://huntrule.com/rules/windows-successful-logons-triggered-by-wmi-wmiprvse-exe-5af54681 2026-07-30T04:12:26.703Z weekly 0.8 https://huntrule.com/rules/windows-security-4624-logon-type-3-anonymous-local-ip-rottenpotato-like-pattern-16f5d8ca 2026-07-30T04:12:24.851Z weekly 0.8 https://huntrule.com/rules/windows-detects-suspicious-local-kerberos-logon-of-built-in-administrator-potent-749c9f5e 2026-07-30T04:12:22.819Z weekly 0.8 https://huntrule.com/rules/windows-security-4624-logontype-9-using-new-credentials-def8b624 2026-07-30T04:12:20.716Z weekly 0.8 https://huntrule.com/rules/windows-failed-logons-from-public-ip-addresses-f88e112a 2026-07-30T04:12:19.270Z weekly 0.8 https://huntrule.com/rules/windows-successful-smb-logon-event-id-4624-logontype-3-from-public-ips-78d5cab4 2026-07-30T04:12:17.612Z weekly 0.8 https://huntrule.com/rules/windows-rdp-successful-logon-from-public-ip-event-id-4624-logontype-10-259a9cdf 2026-07-30T04:12:15.862Z weekly 0.8 https://huntrule.com/rules/windows-security-logs-security-enabled-global-group-deletion-event-id-4730-634-b237c54b 2026-07-30T04:12:14.010Z weekly 0.8 https://huntrule.com/rules/windows-rdp-logon-from-localhost-ip-127-0-0-1-1-51e33403 2026-07-30T04:12:12.505Z weekly 0.8 https://huntrule.com/rules/windows-security-event-pass-the-hash-via-4624-logontype-3-9-ntlmssp-seclogo-8eef149c 2026-07-30T04:12:10.804Z weekly 0.8 https://huntrule.com/rules/windows-successful-logon-type-9-newcredentials-via-negotiate-and-seclogo-192a0330 2026-07-30T04:12:09.116Z weekly 0.8 https://huntrule.com/rules/windows-security-member-removed-from-a-security-enabled-global-group-02c39d30 2026-07-30T04:12:06.681Z weekly 0.8 https://huntrule.com/rules/windows-security-log-member-added-to-security-enabled-global-group-4728-632-c43c26be 2026-07-30T04:12:04.947Z weekly 0.8 https://huntrule.com/rules/windows-security-diagtrackeop-default-logon-username-eventid-4624-logontype-9-2111118f 2026-07-30T04:12:03.097Z weekly 0.8 https://huntrule.com/rules/windows-security-admin-account-remote-logon-event-id-4624-logontype-10-0f63e1ef 2026-07-30T04:12:01.346Z weekly 0.8 https://huntrule.com/rules/windows-security-potential-access-token-abuse-via-new-credentials-impersonation-02f7c9c1 2026-07-30T04:11:59.406Z weekly 0.8 https://huntrule.com/rules/windows-openssh-server-starts-listening-on-ssh-socket-3ce8e9a4 2026-07-30T04:11:57.817Z weekly 0.8 https://huntrule.com/rules/windows-ntlm-logon-to-termsrv-target-not-domain-associated-host-ce5678bb 2026-07-30T04:11:56.190Z weekly 0.8 https://huntrule.com/rules/windows-ntlm-brute-force-via-common-spoofed-workstationname-values-9c8acf1a 2026-07-30T04:11:54.393Z weekly 0.8 https://huntrule.com/rules/windows-ntlm-logon-event-id-8002-98c3bcf1 2026-07-30T04:11:52.736Z weekly 0.8 https://huntrule.com/rules/windows-msexchange-management-failed-transport-agent-installation-install-transp-c7d16cae 2026-07-30T04:11:51.254Z weekly 0.8 https://huntrule.com/rules/windows-msexchange-management-transport-agent-installation-via-install-transport-4fe151c2 2026-07-30T04:11:49.641Z weekly 0.8 https://huntrule.com/rules/microsoft-exchange-management-set-oabvirtualdirectory-externalurl-script-injecti-9db37458 2026-07-30T04:11:48.180Z weekly 0.8 https://huntrule.com/rules/exchange-management-remove-mailboxexportrequest-triggered-with-confirm-false-09570ae5 2026-07-30T04:11:46.244Z weekly 0.8 https://huntrule.com/rules/microsoft-exchange-powershell-mailbox-export-to-unc-path-with-aspx-or-role-assig-516376b4 2026-07-30T04:11:44.382Z weekly 0.8 https://huntrule.com/rules/exchange-certificate-export-writes-csr-to-web-server-paths-or-aspx-suffixes-b7bc7038 2026-07-30T04:11:42.698Z weekly 0.8 https://huntrule.com/rules/windows-msexchange-management-post-proxylogon-set-oabvirtualdirectory-with-suspi-550d3350 2026-07-30T04:11:40.904Z weekly 0.8 https://huntrule.com/rules/windows-lsa-event-300-standard-user-added-to-privileged-groups-administrator-adm-7ac407cc 2026-07-30T04:11:39.327Z weekly 0.8 https://huntrule.com/rules/windows-ldap-recon-detect-ad-enumeration-via-ldap-search-filters-event-id-30-31d68132 2026-07-30T04:11:37.489Z weekly 0.8 https://huntrule.com/rules/windows-iis-module-removal-via-iis-configuration-event-id-29-9e1a1fdf 2026-07-30T04:11:35.673Z weekly 0.8 https://huntrule.com/rules/windows-iis-new-http-module-added-via-iis-configuration-eventid-29-dd857d3e 2026-07-30T04:11:34.161Z weekly 0.8 https://huntrule.com/rules/iis-http-logging-disabled-via-system-webserver-httplogging-configuration-change-e8ebd53a 2026-07-30T04:11:32.476Z weekly 0.8 https://huntrule.com/rules/windows-iis-configuration-change-disables-etw-logging-processing-option-a5b40a90 2026-07-30T04:11:30.933Z weekly 0.8 https://huntrule.com/rules/windows-firewall-configuration-changed-event-ids-2002-2003-2008-2082-2083-00bb5bd5 2026-07-30T04:11:29.341Z weekly 0.8 https://huntrule.com/rules/windows-defender-firewall-reset-to-default-configuration-firewall-as-log-04b60639 2026-07-30T04:11:27.614Z weekly 0.8 https://huntrule.com/rules/windows-firewall-service-failed-to-load-group-policy-event-id-2009-7ec15688 2026-07-30T04:11:26.275Z weekly 0.8 https://huntrule.com/rules/windows-firewall-exception-rule-deletion-eventid-2006-2052-c187c075 2026-07-30T04:11:24.739Z weekly 0.8 https://huntrule.com/rules/windows-firewall-rules-deleted-event-id-2033-2059-indicating-defense-impairment-79609c82 2026-07-30T04:11:23.042Z weekly 0.8 https://huntrule.com/rules/windows-firewall-allow-rule-added-via-wmiprvse-exe-eca81e8d 2026-07-30T04:11:21.428Z weekly 0.8 https://huntrule.com/rules/windows-firewall-exception-rule-added-for-application-in-suspicious-file-locatio-9e2575e7 2026-07-30T04:11:18.857Z weekly 0.8 https://huntrule.com/rules/windows-firewall-exception-rule-added-unusual-via-firewall-as-events-cde0a575 2026-07-30T04:11:17.176Z weekly 0.8 https://huntrule.com/rules/windows-usb-device-plugged-unplugged-events-driver-framework-user-mode-1a4bd6e3 2026-07-30T04:11:15.665Z weekly 0.8 https://huntrule.com/rules/windows-dns-server-plugin-dll-load-failure-serverlevelplugindll-via-dns-server-e-cbe51394 2026-07-30T04:11:13.896Z weekly 0.8 https://huntrule.com/rules/windows-dns-server-failed-dns-zone-transfer-event-id-6004-6d444368 2026-07-30T04:11:11.891Z weekly 0.8 https://huntrule.com/rules/windows-dns-client-detect-dns-queries-containing-ufile-io-090ffaad 2026-07-30T04:11:10.321Z weekly 0.8 https://huntrule.com/rules/windows-dns-client-query-for-tor-onion-or-tor2web-hidden-service-domains-8384bd26 2026-07-30T04:11:08.834Z weekly 0.8 https://huntrule.com/rules/windows-dns-client-queries-for-put-io-api-put-io-or-upload-put-io-8b69fd42 2026-07-30T04:11:07.234Z weekly 0.8 https://huntrule.com/rules/windows-dns-client-queries-for-mega-userstorage-subdomains-66474410 2026-07-30T04:11:05.704Z weekly 0.8 https://huntrule.com/rules/suspicious-cobalt-strike-dns-beaconing-via-windows-dns-client-event-id-3008-0d18728b 2026-07-30T04:11:04.021Z weekly 0.8 https://huntrule.com/rules/windows-dns-client-queryname-contains-anonfiles-com-29f171d7 2026-07-30T04:11:02.077Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-kernel-module-loaded-despite-unmet-whql-requirements-even-2f8cd7a0 2026-07-30T04:10:58.989Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-unsigned-image-loaded-event-id-3037-c92c24e7 2026-07-30T04:10:57.053Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-unsigned-kernel-module-loaded-event-id-3001-951f8d29 2026-07-30T04:10:55.429Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-revoked-image-loaded-events-3032-3035-881b7725 2026-07-30T04:10:53.961Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-blocked-file-image-load-due-to-revoked-signing-certificat-6f156c48 2026-07-30T04:10:52.378Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-operational-revoked-kernel-driver-loaded-event-id-3021-30-320fccbf 2026-07-30T04:10:50.783Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-blocks-revoked-driver-loads-event-id-3023-9b72b82d 2026-07-30T04:10:49.180Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-blocked-image-driver-load-due-to-signing-level-or-policy--e4be5675 2026-07-30T04:10:47.406Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-blocked-disallowed-file-for-protected-processes-event-id--5daf11c3 2026-07-30T04:10:45.668Z weekly 0.8 https://huntrule.com/rules/windows-code-integrity-operational-logs-file-load-rejected-for-unsatisfied-signi-f8931561 2026-07-30T04:10:42.939Z weekly 0.8 https://huntrule.com/rules/windows-certificate-services-client-exported-certificate-from-local-store-58c0bff0 2026-07-30T04:10:41.240Z weekly 0.8 https://huntrule.com/rules/windows-capi2-acquire-certificate-private-key-eventid-70-e2b5163d 2026-07-30T04:10:39.830Z weekly 0.8 https://huntrule.com/rules/windows-bits-client-job-downloads-to-suspicious-saved-file-locations-f8a56cb7 2026-07-30T04:10:38.345Z weekly 0.8 https://huntrule.com/rules/windows-bits-transfer-job-using-uncommon-or-suspicious-remote-domain-6d44fb93 2026-07-30T04:10:36.788Z weekly 0.8 https://huntrule.com/rules/windows-bits-client-job-downloads-from-direct-ip-addresses-90f138c1 2026-07-30T04:10:35.034Z weekly 0.8 https://huntrule.com/rules/windows-bits-client-download-from-file-sharing-domains-d635249d 2026-07-30T04:10:33.210Z weekly 0.8 https://huntrule.com/rules/windows-bits-transfer-job-writing-files-with-suspicious-executable-extensions-b85e5894 2026-07-30T04:10:31.721Z weekly 0.8 https://huntrule.com/rules/windows-powershell-created-new-bits-job-event-id-3-fe3a2d49 2026-07-30T04:10:29.868Z weekly 0.8 https://huntrule.com/rules/windows-bits-job-created-via-bitsadmin-exe-bits-client-eventid-3-1ff315dc 2026-07-30T04:10:28.230Z weekly 0.8 https://huntrule.com/rules/windows-appx-packaging-execute-packages-signed-with-a-known-suspicious-certifica-b5aa7d60 2026-07-30T04:10:26.574Z weekly 0.8 https://huntrule.com/rules/windows-appx-deployment-server-installs-unsigned-msix-appx-with-allowunsigned-9a025188 2026-07-30T04:10:25.083Z weekly 0.8 https://huntrule.com/rules/windows-appx-msix-full-trust-package-installation-via-appxdeployment-server-e54279c7 2026-07-30T04:10:23.402Z weekly 0.8 https://huntrule.com/rules/windows-appx-deployment-server-uncommon-appx-path-added-to-processing-pipeline-c977cb50 2026-07-30T04:10:21.767Z weekly 0.8 https://huntrule.com/rules/windows-appx-package-deployment-blocked-by-local-policy-appxdeployment-server-e021bbb5 2026-07-30T04:10:19.838Z weekly 0.8 https://huntrule.com/rules/suspicious-appx-package-installation-attempts-on-windows-via-appx-deployment-ser-09d3b48b 2026-07-30T04:10:18.200Z weekly 0.8 https://huntrule.com/rules/windows-appx-deployment-app-package-from-common-staging-directories-added-to-pro-5cdeaf3d 2026-07-30T04:10:16.571Z weekly 0.8 https://huntrule.com/rules/windows-appx-deployment-fails-due-to-unsatisfied-signing-requirements-0x80073cff-898d5fc9 2026-07-30T04:10:14.811Z weekly 0.8 https://huntrule.com/rules/windows-appx-deployment-server-remote-appx-package-downloaded-from-file-sharing--8b48ad89 2026-07-30T04:10:13.114Z weekly 0.8 https://huntrule.com/rules/windows-appx-package-deployment-blocked-by-applocker-appxdeployment-server-event-6ae53108 2026-07-30T04:10:11.300Z weekly 0.8 https://huntrule.com/rules/windows-execution-of-sysinternals-tools-via-appx-package-d29a20b2 2026-07-30T04:10:09.455Z weekly 0.8 https://huntrule.com/rules/windows-applocker-audit-only-events-indicate-would-be-blocked-executions-557e3bd3 2026-07-30T04:10:07.901Z weekly 0.8 https://huntrule.com/rules/windows-applocker-blocked-application-script-msi-or-packaged-app-execution-401e5d00 2026-07-30T04:10:06.327Z weekly 0.8 https://huntrule.com/rules/windows-error-reporting-msmpeng-exe-crash-involving-mpengine-dll-eventid-1001-6c82cf5c 2026-07-30T04:10:04.721Z weekly 0.8 https://huntrule.com/rules/screenconnect-rmm-file-transfer-activity-on-windows-event-id-201-5d19eb78 2026-07-30T04:10:02.937Z weekly 0.8 https://huntrule.com/rules/windows-screenconnect-remote-command-execution-via-application-event-200-076ebe48 2026-07-30T04:10:01.223Z weekly 0.8 https://huntrule.com/rules/windows-mssql-xp-cmdshell-configuration-change-event-id-15457-d08dd86f 2026-07-30T04:09:59.263Z weekly 0.8 https://huntrule.com/rules/windows-mssql-xp-cmdshell-execution-via-eventid-33205-7f103213 2026-07-30T04:09:57.590Z weekly 0.8 https://huntrule.com/rules/mssql-sp-procoption-startup-execution-changed-via-exec-eventid-33205-b3d57a5c 2026-07-30T04:09:55.113Z weekly 0.8 https://huntrule.com/rules/windows-mssql-failed-logons-event-id-18456-from-external-client-ips-ebfe73c2 2026-07-30T04:09:53.221Z weekly 0.8 https://huntrule.com/rules/windows-mssql-failed-logon-event-id-18456-via-application-provider-name-218d2855 2026-07-30T04:09:51.474Z weekly 0.8 https://huntrule.com/rules/windows-mssql-audit-policy-tampering-via-alter-drop-server-audit-350dfb37 2026-07-30T04:09:49.801Z weekly 0.8 https://huntrule.com/rules/windows-mssql-server-audit-destructive-sql-statements-drop-truncate-00321fee 2026-07-30T04:09:47.834Z weekly 0.8 https://huntrule.com/rules/windows-mssql-add-member-to-sysadmin-role-server-role-alter-eventid-33205-08200f85 2026-07-30T04:09:46.063Z weekly 0.8 https://huntrule.com/rules/windows-successful-installation-of-atera-remote-monitoring-agent-via-msi-87261fb2 2026-07-30T04:09:44.316Z weekly 0.8 https://huntrule.com/rules/windows-msiinstaller-installs-a-remote-msi-from-a-url-5594e67a 2026-07-30T04:09:42.740Z weekly 0.8 https://huntrule.com/rules/windows-installer-application-removal-msiinstaller-event-1034-11724-570ae5ec 2026-07-30T04:09:39.149Z weekly 0.8 https://huntrule.com/rules/windows-detect-blocked-application-access-enforced-by-software-restriction-polic-b4c8da4a 2026-07-30T04:09:37.478Z weekly 0.8 https://huntrule.com/rules/windows-backup-catalog-deletion-microsoft-windows-backup-event-524-9703792d 2026-07-30T04:09:35.857Z weekly 0.8 https://huntrule.com/rules/windows-application-audit-cve-microsoft-windows-audit-cve-eventid-1-from-cveeven-48d91a3a 2026-07-30T04:09:34.365Z weekly 0.8 https://huntrule.com/rules/windows-detect-esent-new-database-creation-for-ntds-dit-in-suspicious-paths-94dc4390 2026-07-30T04:09:32.450Z weekly 0.8 https://huntrule.com/rules/windows-ntdsutil-abuse-via-esent-events-containing-ntds-dit-e6e88853 2026-07-30T04:09:30.549Z weekly 0.8 https://huntrule.com/rules/windows-microsoft-malware-protection-engine-msmpeng-exe-crash-events-545a5da6 2026-07-30T04:09:28.207Z weekly 0.8 https://huntrule.com/rules/windows-application-error-lsass-lsass-exe-crash-events-event-id-1000-a18e0862 2026-07-30T04:09:26.122Z weekly 0.8 https://huntrule.com/rules/windows-application-log-antivirus-signature-and-malware-keyword-matches-78bc5783 2026-07-30T04:09:24.280Z weekly 0.8 https://huntrule.com/rules/webserver-xss-payload-strings-in-get-request-urls-access-logs-65354b83 2026-07-30T04:09:22.449Z weekly 0.8 https://huntrule.com/rules/webserver-log-detection-for-windows-webshell-command-strings-in-get-parameters-7ff9db12 2026-07-30T04:09:20.721Z weekly 0.8 https://huntrule.com/rules/webserver-log-detection-of-regeorg-webshell-http-post-probing-uri-query-2ea44a60 2026-07-30T04:09:19.321Z weekly 0.8 https://huntrule.com/rules/detect-suspicious-windows-path-strings-in-web-uri-query-windows-exfil-webshell-c-9f6a34b4 2026-07-30T04:09:17.636Z weekly 0.8 https://huntrule.com/rules/webserver-detection-user-agent-contains-known-recon-and-scanning-tool-strings-19aa4f58 2026-07-30T04:09:15.899Z weekly 0.8 https://huntrule.com/rules/web-server-ssti-probe-strings-in-get-requests-ada3bc4f 2026-07-30T04:09:14.196Z weekly 0.8 https://huntrule.com/rules/detect-potential-sql-injection-payloads-in-http-get-uris-webserver-logs-5513deaf 2026-07-30T04:09:12.601Z weekly 0.8 https://huntrule.com/rules/webserver-url-keyword-match-for-source-code-enumeration-via-git-paths-953d460b 2026-07-30T04:09:10.970Z weekly 0.8 https://huntrule.com/rules/webserver-path-traversal-exploitation-attempts-via-suspicious-uri-query-encoding-7745c2ea 2026-07-30T04:09:09.340Z weekly 0.8 https://huntrule.com/rules/webserver-detection-for-jndi-exploit-kit-exploit-and-memshell-url-path-patterns-412d55bc 2026-07-30T04:09:07.708Z weekly 0.8 https://huntrule.com/rules/java-payload-indicators-in-web-access-logs-583aa0a2 2026-07-30T04:09:06.015Z weekly 0.8 https://huntrule.com/rules/successful-iis-shortname-fuzzing-scans-via-1-and-a-aspx-probe-http-7cb02516 2026-07-30T04:09:04.460Z weekly 0.8 https://huntrule.com/rules/f5-big-ip-icontrol-rest-api-bash-endpoint-command-execution-via-webserver-post-85254a62 2026-07-30T04:09:02.825Z weekly 0.8 https://huntrule.com/rules/suspicious-external-webdav-downloads-leading-to-execution-via-proxy-logs-1ae64f96 2026-07-30T04:09:01.095Z weekly 0.8 https://huntrule.com/rules/proxy-user-agent-ending-with-indicating-potential-base64-encoding-894a8613 2026-07-30T04:08:59.578Z weekly 0.8 https://huntrule.com/rules/suspicious-and-malformed-user-agent-strings-in-proxy-logs-7195a772 2026-07-30T04:08:58.188Z weekly 0.8 https://huntrule.com/rules/proxy-logs-rclone-user-agent-activity-via-default-rclone-v-prefix-2c03648b 2026-07-30T04:08:56.276Z weekly 0.8 https://huntrule.com/rules/windows-powershell-web-access-user-agent-in-proxy-logs-c8557060 2026-07-30T04:08:54.685Z weekly 0.8 https://huntrule.com/rules/suspicious-malware-user-agent-strings-in-proxy-logs-5c84856b 2026-07-30T04:08:53.043Z weekly 0.8 https://huntrule.com/rules/proxy-logs-suspicious-hack-tool-user-agent-strings-c42a3073 2026-07-30T04:08:51.409Z weekly 0.8 https://huntrule.com/rules/suspicious-exploit-framework-user-agent-strings-in-proxy-logs-fdd1bfb5 2026-07-30T04:08:49.596Z weekly 0.8 https://huntrule.com/rules/proxy-http-requests-with-empty-user-agent-header-21e44d78 2026-07-30T04:08:48.081Z weekly 0.8 https://huntrule.com/rules/suspicious-proxy-user-agents-for-crypto-miners-xmrig-ccminer-fa935401 2026-07-30T04:08:46.549Z weekly 0.8 https://huntrule.com/rules/microsoft-bits-proxy-requests-to-uncommon-tlds-9eb68894 2026-07-30T04:08:45.037Z weekly 0.8 https://huntrule.com/rules/microsoft-bits-proxy-traffic-to-ip-like-hostnames-uncommon-server-address-8ccd35a2 2026-07-30T04:08:43.362Z weekly 0.8 https://huntrule.com/rules/proxy-traffic-with-suspicious-base64-encoded-user-agent-prefixes-d443095b 2026-07-30T04:08:36.668Z weekly 0.8 https://huntrule.com/rules/suspicious-apt-related-user-agent-strings-in-proxy-logs-6ec820f2 2026-07-30T04:08:35.230Z weekly 0.8 https://huntrule.com/rules/suspicious-telegram-api-proxy-requests-without-telegram-user-agent-b494b165 2026-07-30T04:08:33.128Z weekly 0.8 https://huntrule.com/rules/proxy-requests-to-ipfs-urls-containing-email-addresses-eb6c2004 2026-07-30T04:08:31.579Z weekly 0.8 https://huntrule.com/rules/proxy-activity-flash-player-update-download-from-non-adobe-host-4922a5dd 2026-07-30T04:08:29.913Z weekly 0.8 https://huntrule.com/rules/proxy-requests-to-raw-paste-service-endpoints-5468045b 2026-07-30T04:08:28.205Z weekly 0.8 https://huntrule.com/rules/proxy-activity-download-requests-to-pwndrop-pwndrp-web-server-2b1ee7e4 2026-07-30T04:08:26.528Z weekly 0.8 https://huntrule.com/rules/advanced-ip-port-scanner-update-check-over-http-proxy-1a9bb21a 2026-07-30T04:08:24.925Z weekly 0.8 https://huntrule.com/rules/proxy-detects-empire-style-user-agent-with-post-to-common-php-admin-auth-paths-b923f7d6 2026-07-30T04:08:23.067Z weekly 0.8 https://huntrule.com/rules/proxy-traffic-matches-cobalt-strike-malleable-profile-indicators-uri-user-agent--f3f21ce1 2026-07-30T04:08:21.538Z weekly 0.8 https://huntrule.com/rules/babyshark-agent-default-c2-url-query-string-pattern-proxy-logs-304810ed 2026-07-30T04:08:14.130Z weekly 0.8 https://huntrule.com/rules/proxy-traffic-with-hello-world-1-0-user-agent-using-get-1712bafe 2026-07-30T04:08:12.218Z weekly 0.8 https://huntrule.com/rules/f5-big-ip-icontrol-rest-api-bash-endpoint-command-execution-via-post-proxy-b59c98c6 2026-07-30T04:08:10.652Z weekly 0.8 https://huntrule.com/rules/windows-webdav-downloader-activity-via-proxy-user-agent-and-http-get-e09aed7a 2026-07-30T04:08:09.055Z weekly 0.8 https://huntrule.com/rules/proxy-flag-executable-downloads-from-non-whitelisted-suspicious-tlds-b5de2919 2026-07-30T04:08:07.112Z weekly 0.8 https://huntrule.com/rules/proxy-suspicious-tld-downloads-of-executable-and-office-file-types-00d0b5ab 2026-07-30T04:08:05.092Z weekly 0.8 https://huntrule.com/rules/proxy-downloads-of-executable-and-script-files-from-suspicious-dynamic-dns-hosts-195c1119 2026-07-30T04:08:02.956Z weekly 0.8 https://huntrule.com/rules/nginx-worker-core-dump-indicating-crash-or-possible-exploitation-59ec40bb 2026-07-30T04:08:00.888Z weekly 0.8 https://huntrule.com/rules/apache-error-log-threading-assertion-detected-e9a2b582 2026-07-30T04:07:59.143Z weekly 0.8 https://huntrule.com/rules/apache-service-crashes-segmentation-fault-message-in-apache-error-logs-1da8ce0b 2026-07-30T04:07:57.685Z weekly 0.8 https://huntrule.com/rules/zeek-smb-files-network-share-transfers-of-credential-related-file-names-2e69f167 2026-07-30T04:07:54.077Z weekly 0.8 https://huntrule.com/rules/zeek-smb-file-activity-access-to-sensitive-email-database-backup-and-credential--286b47ed 2026-07-30T04:07:52.260Z weekly 0.8 https://huntrule.com/rules/zeek-smb-files-impacket-secretdump-activity-via-admin-and-system32-tmp-drops-92dae1ed 2026-07-30T04:07:45.866Z weekly 0.8 https://huntrule.com/rules/zeek-rdp-connections-from-non-routable-public-ip-ranges-1fc0809e 2026-07-30T04:07:42.745Z weekly 0.8 https://huntrule.com/rules/zeek-http-webdav-user-agent-with-put-method-to-local-network-705072a5 2026-07-30T04:07:40.459Z weekly 0.8 https://huntrule.com/rules/zeek-http-requests-to-low-reputation-tlds-or-suspicious-executable-file-types-68c2c604 2026-07-30T04:07:38.528Z weekly 0.8 https://huntrule.com/rules/zeek-http-executable-download-over-webdav-by-detecting-webdav-user-agent-uri-and-aac2fd97 2026-07-30T04:07:36.226Z weekly 0.8 https://huntrule.com/rules/zeek-dns-queries-to-tor-proxy-and-onion-domain-indicators-a8322756 2026-07-30T04:07:34.382Z weekly 0.8 https://huntrule.com/rules/zeek-dns-nkn-seed-domain-lookups-for-potential-c2-over-nkn-org-fa7703d6 2026-07-30T04:07:30.735Z weekly 0.8 https://huntrule.com/rules/zeek-dns-lookups-for-known-cryptocurrency-mining-pool-domains-bf74135c 2026-07-30T04:07:29.081Z weekly 0.8 https://huntrule.com/rules/zeek-dns-detection-of-suspicious-kerberos-coercion-pattern-in-query-payload-5588576c 2026-07-30T04:07:27.145Z weekly 0.8 https://huntrule.com/rules/zeek-x509-default-cobalt-strike-certificate-serial-in-https-traffic-7100f7e3 2026-07-30T04:07:25.599Z weekly 0.8 https://huntrule.com/rules/zeek-smb-files-spoolss-named-pipe-access-via-ipc-bae2865c 2026-07-30T04:07:24.101Z weekly 0.8 https://huntrule.com/rules/zeek-dce-rpc-encrypting-file-system-efs-rpc-operations-starting-with-efs-4096842a 2026-07-30T04:07:22.649Z weekly 0.8 https://huntrule.com/rules/zeek-dce-rpc-indicators-of-windows-persistence-via-rpc-printer-logon-functions-53389db6 2026-07-30T04:07:20.658Z weekly 0.8 https://huntrule.com/rules/zeek-dce-rpc-execution-indicators-via-jobadd-task-scheduler-wmi-and-service-cont-b640c0b8 2026-07-30T04:07:18.397Z weekly 0.8 https://huntrule.com/rules/juniper-bgp-missing-md5-digest-a7c0ae48 2026-07-30T04:07:16.494Z weekly 0.8 https://huntrule.com/rules/huawei-bgp-authentication-failure-events-a557ffe6 2026-07-30T04:07:14.773Z weekly 0.8 https://huntrule.com/rules/fortigate-vpn-ssl-settings-edited-via-event-logs-8b5dacf2 2026-07-30T04:07:13.284Z weekly 0.8 https://huntrule.com/rules/fortigate-user-group-edited-vpn-access-impact-69ffc84e 2026-07-30T04:07:11.721Z weekly 0.8 https://huntrule.com/rules/fortigate-event-addition-of-vpn-ssl-web-portal-2bfb6216 2026-07-30T04:07:10.423Z weekly 0.8 https://huntrule.com/rules/fortigate-local-user-added-user-local-via-event-logs-ddbbe845 2026-07-30T04:07:09.037Z weekly 0.8 https://huntrule.com/rules/fortigate-new-firewall-policy-added-via-event-logs-f24ab7a8 2026-07-30T04:07:07.171Z weekly 0.8 https://huntrule.com/rules/fortigate-firewall-address-object-added-5c8d7b41 2026-07-30T04:07:05.533Z weekly 0.8 https://huntrule.com/rules/fortigate-administrator-account-added-via-system-admin-event-cd0a4943 2026-07-30T04:07:04.053Z weekly 0.8 https://huntrule.com/rules/firewall-logs-cleartext-protocol-traffic-to-common-service-ports-d7fb8f0e 2026-07-30T04:07:02.482Z weekly 0.8 https://huntrule.com/rules/detect-wannacry-killswitch-domains-in-dns-queries-3eaf6218 2026-07-30T04:07:00.971Z weekly 0.8 https://huntrule.com/rules/dns-txt-responses-containing-command-execution-strings-powershell-windows-8ae51330 2026-07-30T04:06:59.593Z weekly 0.8 https://huntrule.com/rules/dns-queries-to-api-telegram-org-from-telegram-bot-api-clients-c64c5175 2026-07-30T04:06:57.993Z weekly 0.8 https://huntrule.com/rules/suspicious-dns-queries-containing-base64-delimiters-4153a907 2026-07-30T04:06:56.216Z weekly 0.8 https://huntrule.com/rules/suspicious-dns-lookups-for-monero-mining-pool-domains-b593fd50 2026-07-30T04:06:54.382Z weekly 0.8 https://huntrule.com/rules/suspicious-dns-beaconing-patterns-indicative-of-cobalt-strike-dns-2975af79 2026-07-30T04:06:53.072Z weekly 0.8 https://huntrule.com/rules/dns-queries-to-oast-callback-service-domains-external-dns-interactions-aff715fa 2026-07-30T04:06:51.456Z weekly 0.8 https://huntrule.com/rules/cisco-ldp-authentication-failures-indicating-tcp-md5-auth-rejects-50e606bf 2026-07-30T04:06:49.740Z weekly 0.8 https://huntrule.com/rules/cisco-bgp-authentication-failures-on-tcp-179-56fa3cd6 2026-07-30T04:06:48.264Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-monitor-span-rspan-capture-point-commands-b9e1f193 2026-07-30T04:06:46.762Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-stage-data-using-tftp-rcp-copy-and-archive-commands-5e51acb2 2026-07-30T04:06:45.273Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-cli-configuration-commands-http-https-kron-acl-ntp-modification-671ffc77 2026-07-30T04:06:43.230Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-local-account-creation-modification-and-remote-authentication-configur-6d844f0f 2026-07-30T04:06:41.539Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-captures-show-history-and-show-logging-command-input-b094d9fb 2026-07-30T04:06:39.932Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-file-deletion-activity-via-erase-delete-or-format-keywords-71d65515 2026-07-30T04:06:38.233Z weekly 0.8 https://huntrule.com/rules/cisco-ios-ios-xe-aaa-logs-manual-802-1x-dot1x-port-authentication-disabled-ef0ff092 2026-07-30T04:06:36.370Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-commands-triggering-shutdown-or-boot-mode-via-config-register-values-d94a35f0 2026-07-30T04:06:34.575Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-command-keyword-discovery-via-show-and-dir-9705a6a1 2026-07-30T04:06:32.709Z weekly 0.8 https://huntrule.com/rules/cisco-aaa-logging-disabled-via-no-logging-and-no-aaa-new-model-9e8f6035 2026-07-30T04:06:31.030Z weekly 0.8 https://huntrule.com/rules/cisco-ios-aaa-crypto-pki-commands-for-key-export-or-certificate-import-1f978c6a 2026-07-30T04:06:29.278Z weekly 0.8 https://huntrule.com/rules/cisco-ios-command-output-collection-via-config-display-commands-cd072b25 2026-07-30T04:06:27.811Z weekly 0.8 https://huntrule.com/rules/cisco-network-os-clear-logging-commands-detected-aaa-ceb407f6 2026-07-30T04:06:26.123Z weekly 0.8 https://huntrule.com/rules/macos-xcsset-infection-indicators-from-bash-launched-curl-osacompile-plutil-and--47d65ac0 2026-07-30T04:06:24.817Z weekly 0.8 https://huntrule.com/rules/macos-gatekeeper-bypass-attempt-using-xattr-to-remove-com-apple-quarantine-f5141b6d 2026-07-30T04:06:22.583Z weekly 0.8 https://huntrule.com/rules/macos-process-execution-indicators-for-wizardupdate-associated-malware-f68c4a4f 2026-07-30T04:06:21.004Z weekly 0.8 https://huntrule.com/rules/macos-detect-tmutil-adding-time-machine-exclusions-addexclusion-9acf45ed 2026-07-30T04:06:19.336Z weekly 0.8 https://huntrule.com/rules/macos-disabling-time-machine-via-tmutil-process-execution-2c95fa8a 2026-07-30T04:06:17.769Z weekly 0.8 https://huntrule.com/rules/macos-tmutil-time-machine-backup-deletion-command-attempt-452df256 2026-07-30T04:06:16.105Z weekly 0.8 https://huntrule.com/rules/macos-bash-pipeline-tail-extracting-data-from-image-and-base64-decoding-output-09a910bf 2026-07-30T04:06:14.578Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-for-shutdown-reboot-or-halt-commands-40b1fbe2 2026-07-30T04:06:12.731Z weekly 0.8 https://huntrule.com/rules/macos-process-discovery-via-system-profiler-with-targeted-data-types-4809c683 2026-07-30T04:06:11.162Z weekly 0.8 https://huntrule.com/rules/macos-system-network-connections-discovery-via-who-w-last-lsof-netstat-9a7a0393 2026-07-30T04:06:09.485Z weekly 0.8 https://huntrule.com/rules/macos-sysctl-execution-for-system-hardware-kernel-discovery-6ff08e55 2026-07-30T04:06:07.646Z weekly 0.8 https://huntrule.com/rules/macos-sysadminctl-used-to-enable-guest-account-d7329412 2026-07-30T04:06:06.163Z weekly 0.8 https://huntrule.com/rules/macos-sysadminctl-used-to-add-user-to-admin-group-652c098d 2026-07-30T04:06:04.409Z weekly 0.8 https://huntrule.com/rules/macos-system-information-discovery-via-sw-vers-with-product-build-version-flags-5de06a6f 2026-07-30T04:06:02.719Z weekly 0.8 https://huntrule.com/rules/macos-detect-applet-osascript-execution-of-osacompile-via-process-command-line-a753a6af 2026-07-30T04:06:01.053Z weekly 0.8 https://huntrule.com/rules/macos-local-network-discovery-via-network-configuration-commands-58800443 2026-07-30T04:05:58.920Z weekly 0.8 https://huntrule.com/rules/macos-firmwarepasswd-password-manipulation-via-setpasswd-full-delete-check-7ed2c9f7 2026-07-30T04:05:55.808Z weekly 0.8 https://huntrule.com/rules/macos-in-memory-download-and-compile-via-curl-and-osacompile-13db8d2e 2026-07-30T04:05:54.098Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-command-line-access-or-modification-of-shell-history-file-508a9374 2026-07-30T04:05:52.095Z weekly 0.8 https://huntrule.com/rules/macos-process-execution-of-find-with-setuid-setgid-or-world-writable-permission--85de3a19 2026-07-30T04:05:50.286Z weekly 0.8 https://huntrule.com/rules/macos-script-editor-spawning-unusual-processes-curl-shells-scripting-runtimes-6e4dcdd1 2026-07-30T04:05:48.377Z weekly 0.8 https://huntrule.com/rules/suspicious-child-process-spawned-by-browsers-on-macos-via-shell-and-script-runti-0250638a 2026-07-30T04:05:46.718Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-of-split-used-to-divide-files-into-pieces-7f2bb9d5 2026-07-30T04:05:44.743Z weekly 0.8 https://huntrule.com/rules/macos-process-command-line-and-image-with-trailing-space-after-filename-b6e2a2e3 2026-07-30T04:05:43.137Z weekly 0.8 https://huntrule.com/rules/macos-security-tool-discovery-via-grep-of-known-agent-and-firewall-strings-0ed75b9c 2026-07-30T04:05:40.673Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-screencapture-used-for-screenshot-collection-0877ed01 2026-07-30T04:05:38.837Z weekly 0.8 https://huntrule.com/rules/macos-cron-job-abuse-via-tmp-crontab-entries-7c3b43d8 2026-07-30T04:05:37.256Z weekly 0.8 https://huntrule.com/rules/macos-remote-system-discovery-via-arp-or-ping-enumeration-10227522 2026-07-30T04:05:35.511Z weekly 0.8 https://huntrule.com/rules/macos-process-execution-teamviewer-session-command-line-via-teamviewer-service-f459ccb4 2026-07-30T04:05:34.008Z weekly 0.8 https://huntrule.com/rules/macos-meshagent-execution-with-renamed-instance-via-meshservicename-bd3b5eaa 2026-07-30T04:05:32.218Z weekly 0.8 https://huntrule.com/rules/macos-detect-meshagent-remote-access-execution-via-meshservicename-22c45af6 2026-07-30T04:05:30.688Z weekly 0.8 https://huntrule.com/rules/macos-persistence-attempts-using-plistbuddy-to-configure-launchagents-launchdaem-65d506d3 2026-07-30T04:05:29.006Z weekly 0.8 https://huntrule.com/rules/macos-openssl-decodes-and-decrypts-payloads-from-mounted-dmg-volumes-234dc5df 2026-07-30T04:05:27.136Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-osacompile-run-only-execution-via-inline-e-script-b9d9b652 2026-07-30T04:05:24.591Z weekly 0.8 https://huntrule.com/rules/macos-suspicious-shell-python-child-processes-spawned-by-microsoft-office-apps-69483748 2026-07-30T04:05:22.970Z weekly 0.8 https://huntrule.com/rules/macos-nscurl-file-download-via-command-line-options-6d8a7cf1 2026-07-30T04:05:21.113Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-detect-tcpdump-tshark-network-sniffing-tool-usage-adc9bcc4 2026-07-30T04:05:19.445Z weekly 0.8 https://huntrule.com/rules/macos-network-service-enumeration-via-nc-netcat-nmap-or-telnet-84bae5d4 2026-07-30T04:05:18.016Z weekly 0.8 https://huntrule.com/rules/macos-local-groups-discovery-via-dscacheutil-cat-dscl-enumeration-89bb1f97 2026-07-30T04:05:16.441Z weekly 0.8 https://huntrule.com/rules/macos-local-system-account-discovery-via-dscl-dscacheutil-id-lsof-who-and-relate-ddf36b67 2026-07-30T04:05:14.789Z weekly 0.8 https://huntrule.com/rules/macos-launchctl-submits-loads-starts-launch-agents-and-daemons-via-process-execu-ae9d710f 2026-07-30T04:05:12.947Z weekly 0.8 https://huntrule.com/rules/macos-jxa-in-memory-javascript-execution-via-osascript-f1408a58 2026-07-30T04:05:11.130Z weekly 0.8 https://huntrule.com/rules/macos-jamf-cli-command-execution-for-account-mdm-and-framework-changes-be2e3a5c 2026-07-30T04:05:09.576Z weekly 0.8 https://huntrule.com/rules/macos-detect-suspicious-child-processes-spawned-by-jamf-2316929c 2026-07-30T04:05:07.907Z weekly 0.8 https://huntrule.com/rules/macos-process-monitoring-for-i-o-kit-registry-discovery-via-ioreg-2d5e7a8b 2026-07-30T04:05:06.466Z weekly 0.8 https://huntrule.com/rules/macos-installer-script-spawning-suspicious-child-interpreter-processes-e0cfaecd 2026-07-30T04:05:04.813Z weekly 0.8 https://huntrule.com/rules/macos-detect-hdiutil-disk-image-mounting-via-attach-or-mount-commands-bf241472 2026-07-30T04:05:03.074Z weekly 0.8 https://huntrule.com/rules/macos-hdiutil-disk-image-creation-execution-1cf98dc2 2026-07-30T04:05:01.610Z weekly 0.8 https://huntrule.com/rules/macos-osascript-display-dialog-prompts-for-credential-capture-60f1ce20 2026-07-30T04:04:59.956Z weekly 0.8 https://huntrule.com/rules/macos-process-activity-grep-for-password-and-lazagne-credential-extraction-53b1b378 2026-07-30T04:04:57.921Z weekly 0.8 https://huntrule.com/rules/macos-file-and-directory-discovery-via-system-utilities-089dbdf6 2026-07-30T04:04:56.042Z weekly 0.8 https://huntrule.com/rules/macos-root-account-enable-via-dsenableroot-821bcf4d 2026-07-30T04:04:54.161Z weekly 0.8 https://huntrule.com/rules/macos-dseditgroup-used-to-add-a-user-to-the-admin-group-5d0fdb62 2026-07-30T04:04:52.556Z weekly 0.8 https://huntrule.com/rules/macos-dscl-used-to-append-user-to-groups-admin-group-b743623c 2026-07-30T04:04:50.858Z weekly 0.8 https://huntrule.com/rules/macos-unloading-security-agents-via-launchctl-or-disabling-gatekeeper-ff39f1a6 2026-07-30T04:04:49.194Z weekly 0.8 https://huntrule.com/rules/macos-csrutil-sip-status-enumeration-via-process-command-line-53821412 2026-07-30T04:04:47.545Z weekly 0.8 https://huntrule.com/rules/macos-csrutil-used-to-disable-system-integrity-protection-sip-3603f18a 2026-07-30T04:04:46.093Z weekly 0.8 https://huntrule.com/rules/macos-keychain-password-dumping-via-usr-bin-security-command-lines-b120b587 2026-07-30T04:04:44.287Z weekly 0.8 https://huntrule.com/rules/macos-hidden-user-creation-via-dscl-uniqueid-500-or-ishidden-true-b22a5b36 2026-07-30T04:04:42.288Z weekly 0.8 https://huntrule.com/rules/macos-local-user-account-creation-via-dscl-or-sysadminctl-51719bf5 2026-07-30T04:04:40.493Z weekly 0.8 https://huntrule.com/rules/macos-osascript-clipboard-access-via-applescript-7794fa3c 2026-07-30T04:04:38.919Z weekly 0.8 https://huntrule.com/rules/macos-indicator-removal-process-deletion-of-local-logs-via-rm-unlink-shred-acf61bd8 2026-07-30T04:04:37.433Z weekly 0.8 https://huntrule.com/rules/macos-process-execution-of-chflags-to-set-hidden-file-flags-3b2c1059 2026-07-30T04:04:35.614Z weekly 0.8 https://huntrule.com/rules/macos-touch-timestamp-attribute-modification-via-command-line-88c0f9d8 2026-07-30T04:04:34.168Z weekly 0.8 https://huntrule.com/rules/macos-detect-dd-and-truncate-usage-for-binary-padding-95361ce5 2026-07-30T04:04:32.314Z weekly 0.8 https://huntrule.com/rules/macos-base64-decoding-via-usr-bin-base64-d-719c22d7 2026-07-30T04:04:30.564Z weekly 0.8 https://huntrule.com/rules/macos-process-execution-of-osascript-running-applescript-scripts-1bc2e6c5 2026-07-30T04:04:28.787Z weekly 0.8 https://huntrule.com/rules/macos-startup-item-plist-created-in-startupitems-directories-dfe8b941 2026-07-30T04:04:26.752Z weekly 0.8 https://huntrule.com/rules/macos-emond-launch-daemon-persistence-via-new-rule-plist-files-23c43900 2026-07-30T04:04:24.981Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-using-xterm-with-display-1-reverse-shell-indicator-4e25af4b 2026-07-30T04:04:22.948Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-wget-downloaded-files-to-tmp-cf610c15 2026-07-30T04:04:21.286Z weekly 0.8 https://huntrule.com/rules/linux-web-server-process-child-commands-indicative-of-webshell-activity-818f7b24 2026-07-30T04:04:19.778Z weekly 0.8 https://huntrule.com/rules/linux-vim-gtfobin-abuse-via-process-execution-flags-and-shell-commands-7ab8f73a 2026-07-30T04:04:17.899Z weekly 0.8 https://huntrule.com/rules/linux-usermod-adds-user-to-root-or-sudoers-group-via-ag-6a50f16c 2026-07-30T04:04:16.218Z weekly 0.8 https://huntrule.com/rules/linux-userdel-execution-indicates-account-deletion-08f26069 2026-07-30T04:04:14.642Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-triple-cross-ebpf-rootkit-install-commands-via-sudo-t-22236d75 2026-07-30T04:04:13.229Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-execve-hijack-execution-via-sudo-0326c3c8 2026-07-30T04:04:11.398Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-detect-touch-used-on-service-files-31545105 2026-07-30T04:04:09.936Z weekly 0.8 https://huntrule.com/rules/linux-systemctl-mask-used-to-disable-power-management-targets-c172b7b5 2026-07-30T04:04:07.450Z weekly 0.8 https://huntrule.com/rules/linux-system-network-discovery-via-firewall-netstat-route-and-interface-commands-e7bd1cfa 2026-07-30T04:04:05.737Z weekly 0.8 https://huntrule.com/rules/linux-system-network-connections-discovery-via-who-w-last-lsof-netstat-4c519226 2026-07-30T04:04:04.247Z weekly 0.8 https://huntrule.com/rules/linux-system-information-discovery-via-common-system-command-execution-42df45e7 2026-07-30T04:04:02.375Z weekly 0.8 https://huntrule.com/rules/linux-script-execution-from-tmp-via-shell-c-30bcce26 2026-07-30T04:04:00.744Z weekly 0.8 https://huntrule.com/rules/linux-shell-execution-where-parent-process-runs-from-tmp-2fade0b6 2026-07-30T04:03:57.957Z weekly 0.8 https://huntrule.com/rules/linux-process-executions-editing-sensitive-or-critical-files-via-shell-redirecti-86157017 2026-07-30T04:03:56.272Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-script-interpreter-spawns-trufflehog-or-gitleaks-f0025a69 2026-07-30T04:03:54.303Z weekly 0.8 https://huntrule.com/rules/linux-recon-command-line-indicators-for-suid-htpasswd-discovery-0cf7a157 2026-07-30T04:03:52.775Z weekly 0.8 https://huntrule.com/rules/linux-reading-etc-sudoers-via-file-content-inspection-utilities-0f79c4d2 2026-07-30T04:03:51.053Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-shell-command-piped-into-another-shell-880973f3 2026-07-30T04:03:49.546Z weekly 0.8 https://huntrule.com/rules/linux-execution-of-network-scanning-and-recon-tools-3e102cd9 2026-07-30T04:03:47.500Z weekly 0.8 https://huntrule.com/rules/linux-java-process-spawning-shells-and-downloaders-d292e0af 2026-07-30T04:03:45.717Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-interactive-bash-launching-suspicious-child-commands-ea3ecad2 2026-07-30T04:03:44.157Z weekly 0.8 https://huntrule.com/rules/linux-process-command-line-inode-directory-listing-for-container-discovery-43e26eb5 2026-07-30T04:03:42.027Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-match-for-known-hacktool-and-scanning-binaries-a015e032 2026-07-30T04:03:40.416Z weekly 0.8 https://huntrule.com/rules/linux-process-command-line-printing-of-shell-history-files-d7821ff1 2026-07-30T04:03:38.850Z weekly 0.8 https://huntrule.com/rules/linux-history-file-deletion-via-rm-unlink-shred-commands-1182f3b3 2026-07-30T04:03:36.766Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-git-clone-containing-exploit-or-vulnerability-keyword-cfec9d29 2026-07-30T04:03:35.208Z weekly 0.8 https://huntrule.com/rules/linux-process-discovery-via-find-command-searching-setuid-sgid-and-writable-exec-8344c0e5 2026-07-30T04:03:33.224Z weekly 0.8 https://huntrule.com/rules/suspicious-linux-process-execution-from-tmp-directory-312b42b1 2026-07-30T04:03:31.543Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-from-dev-shm-shared-memory-5cd16c8f 2026-07-30T04:03:29.750Z weekly 0.8 https://huntrule.com/rules/linux-process-discovery-by-listing-dockerenv-via-common-file-utilities-11701de9 2026-07-30T04:03:28.371Z weekly 0.8 https://huntrule.com/rules/suspicious-curl-user-agent-changes-on-linux-via-process-creation-b86d356d 2026-07-30T04:03:26.719Z weekly 0.8 https://huntrule.com/rules/linux-curl-process-uploads-files-via-form-upload-flags-00b90cc1 2026-07-30T04:03:25.253Z weekly 0.8 https://huntrule.com/rules/linux-container-discovery-via-proc-virtual-filesystem-enumeration-746c86fb 2026-07-30T04:03:23.457Z weekly 0.8 https://huntrule.com/rules/linux-amazon-ssm-agent-hijacking-via-suspicious-register-code-command-line-f9b3edc5 2026-07-30T04:03:21.562Z weekly 0.8 https://huntrule.com/rules/linux-ssh-used-to-invoke-a-shell-via-proxycommand-and-embedded-local-command-opt-8737b7f6 2026-07-30T04:03:19.816Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-chown-root-and-chmod-u-s-g-s-indicating-setuid-setgid-changes-c21c4eaa 2026-07-30T04:03:18.095Z weekly 0.8 https://huntrule.com/rules/linux-service-management-tool-usage-to-stop-or-disable-services-de25eeb8 2026-07-30T04:03:16.384Z weekly 0.8 https://huntrule.com/rules/linux-service-commands-stopping-or-disabling-security-tools-iptables-firewalld-c-e3a8a052 2026-07-30T04:03:14.658Z weekly 0.8 https://huntrule.com/rules/linux-process-discovery-via-grep-egrep-searching-for-security-monitoring-tools-c9d8b7fd 2026-07-30T04:03:12.737Z weekly 0.8 https://huntrule.com/rules/linux-cron-job-uploads-from-tmp-via-crontab-process-creation-6b14bac8 2026-07-30T04:03:11.001Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-ruby-e-scripts-calling-tcpsocket-via-rsocket-b8bdac18 2026-07-30T04:03:09.441Z weekly 0.8 https://huntrule.com/rules/linux-shell-spawned-by-rsync-without-expected-e-flag-297241f3 2026-07-30T04:03:07.718Z weekly 0.8 https://huntrule.com/rules/linux-rsync-used-with-e-to-spawn-a-shell-e2326866 2026-07-30T04:03:05.864Z weekly 0.8 https://huntrule.com/rules/linux-package-uninstall-commands-via-yum-apt-dpkg-rpm-95d61234 2026-07-30T04:03:04.225Z weekly 0.8 https://huntrule.com/rules/linux-remote-system-discovery-via-arp-or-ping-enumeration-11063ec2 2026-07-30T04:03:02.449Z weekly 0.8 https://huntrule.com/rules/linux-teamviewer-remote-session-start-via-teamviewer-desktop-command-line-1f6b8cd4 2026-07-30T04:03:00.902Z weekly 0.8 https://huntrule.com/rules/linux-inline-python-c-calls-os-system-to-spawn-shell-2d2f44ff 2026-07-30T04:02:59.129Z weekly 0.8 https://huntrule.com/rules/linux-python-reverse-shell-via-pty-and-socket-imports-32e62bc7 2026-07-30T04:02:57.527Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-python-imports-pty-and-spawns-a-pseudo-tty-c4042d54 2026-07-30T04:02:55.939Z weekly 0.8 https://huntrule.com/rules/linux-python-http-server-execution-via-command-line-http-server-simplehttpserver-3f0f5957 2026-07-30T04:02:54.122Z weekly 0.8 https://huntrule.com/rules/linux-process-executions-of-python-base64-decoding-in-one-liners-55e862a8 2026-07-30T04:02:52.610Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-trufflehog-with-secret-search-platform-arguments-d7a650c4 2026-07-30T04:02:50.939Z weekly 0.8 https://huntrule.com/rules/linux-process-sets-http-proxy-https-proxy-environment-variables-72f4ab3f 2026-07-30T04:02:49.088Z weekly 0.8 https://huntrule.com/rules/linux-process-command-lines-showing-pnscan-binary-data-transfer-usage-97de11cd 2026-07-30T04:02:47.613Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-php-inline-code-using-r-and-fsockopen-for-reverse-shell-s-c6714a24 2026-07-30T04:02:46.070Z weekly 0.8 https://huntrule.com/rules/linux-perl-reverse-shell-pattern-via-perl-e-with-socket-inet-and-connect-open-ex-259df6bc 2026-07-30T04:02:43.978Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-nohupp-execution-from-tmp-457df417 2026-07-30T04:02:38.178Z weekly 0.8 https://huntrule.com/rules/linux-nohup-execution-via-process-creation-nohu-p-command-path-e4ffe466 2026-07-30T04:02:36.472Z weekly 0.8 https://huntrule.com/rules/linux-shell-execution-using-nice-utility-093d68c7 2026-07-30T04:02:34.881Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-netcat-ncat-with-e-followed-by-shell-invocation-7f734ed0 2026-07-30T04:02:32.894Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-mount-executed-with-hidepid-2-option-ec52985a 2026-07-30T04:02:30.986Z weekly 0.8 https://huntrule.com/rules/linux-named-pipe-creation-via-mkfifo-from-tmp-999c3b12 2026-07-30T04:02:29.316Z weekly 0.8 https://huntrule.com/rules/linux-named-pipe-creation-via-mkfifo-utility-9d779ce8 2026-07-30T04:02:27.697Z weekly 0.8 https://huntrule.com/rules/linux-grep-command-used-to-locate-specific-malware-related-files-process-discove-e34cfa0c 2026-07-30T04:02:26.261Z weekly 0.8 https://huntrule.com/rules/linux-local-system-groups-enumeration-via-groups-cat-to-etc-group-676381a6 2026-07-30T04:02:24.720Z weekly 0.8 https://huntrule.com/rules/linux-local-account-discovery-via-system-account-and-password-file-viewing-b45e3d6f 2026-07-30T04:02:21.840Z weekly 0.8 https://huntrule.com/rules/linux-iptables-ufw-chain-flush-commands-enabling-all-network-traffic-3be619f4 2026-07-30T04:02:19.974Z weekly 0.8 https://huntrule.com/rules/linux-package-installation-commands-for-potential-recon-tool-deployment-700fb7e8 2026-07-30T04:02:18.142Z weekly 0.8 https://huntrule.com/rules/linux-root-certificate-installation-via-update-ca-certificates-or-update-ca-trus-78a80655 2026-07-30T04:02:16.564Z weekly 0.8 https://huntrule.com/rules/linux-groupdel-execution-identified-by-process-creation-8a46f16c 2026-07-30T04:02:15.079Z weekly 0.8 https://huntrule.com/rules/linux-os-architecture-discovery-using-grep-for-cpu-arch-strings-d27ab432 2026-07-30T04:02:13.357Z weekly 0.8 https://huntrule.com/rules/linux-git-invoked-with-shell-execution-via-redirected-stdin-to-bash-dash-sh-47b3bbd4 2026-07-30T04:02:11.590Z weekly 0.8 https://huntrule.com/rules/linux-gcc-invocation-used-to-execute-shell-scripts-via-wrapper-9b5de532 2026-07-30T04:02:09.749Z weekly 0.8 https://huntrule.com/rules/linux-flock-used-to-launch-an-interactive-shell-4b09c71e 2026-07-30T04:02:08.008Z weekly 0.8 https://huntrule.com/rules/linux-find-command-using-exec-to-spawn-a-shell-6adfbf8f 2026-07-30T04:02:06.327Z weekly 0.8 https://huntrule.com/rules/linux-file-deletion-via-rm-shred-or-unlink-process-creation-30aed7b6 2026-07-30T04:02:04.705Z weekly 0.8 https://huntrule.com/rules/linux-file-and-directory-discovery-via-system-utilities-execution-d3feb4ee 2026-07-30T04:02:03.198Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-esxcli-vsan-for-virtual-storage-information-discovery-d54c2f06 2026-07-30T04:02:01.687Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-esxcli-vm-kill-shutdown-a-vm-on-esxi-2992ac4d 2026-07-30T04:01:59.877Z weekly 0.8 https://huntrule.com/rules/linux-process-monitoring-esxi-vm-discovery-via-esxcli-vm-process-list-5f1573a7 2026-07-30T04:01:58.188Z weekly 0.8 https://huntrule.com/rules/esxi-user-account-creation-via-esxcli-command-execution-b28e4eb3 2026-07-30T04:01:56.644Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-esxi-esxcli-system-discovery-commands-e80273e1 2026-07-30T04:01:55.062Z weekly 0.8 https://huntrule.com/rules/esxi-syslog-configuration-change-via-esxcli-on-linux-38eb1dbb 2026-07-30T04:01:53.461Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-esxi-esxcli-storage-discovery-f41dada5 2026-07-30T04:01:51.727Z weekly 0.8 https://huntrule.com/rules/linux-process-esxi-esxcli-used-to-set-admin-permission-on-an-account-9691f58d 2026-07-30T04:01:50.048Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-esxi-esxcli-network-discovery-commands-33e814e0 2026-07-30T04:01:48.456Z weekly 0.8 https://huntrule.com/rules/linux-detect-env-based-shell-invocation-using-common-interactive-shells-bed978f8 2026-07-30T04:01:46.379Z weekly 0.8 https://huntrule.com/rules/linux-doas-tool-execution-process-creation-067d8238 2026-07-30T04:01:44.492Z weekly 0.8 https://huntrule.com/rules/linux-attempt-to-disable-or-stop-ufw-firewall-via-ufw-init-or-ufw-disable-84c9e83c 2026-07-30T04:01:43.115Z weekly 0.8 https://huntrule.com/rules/linux-dd-process-memory-overwrite-for-code-injection-via-proc-pid-mem-4cad6c64 2026-07-30T04:01:41.134Z weekly 0.8 https://huntrule.com/rules/linux-dd-file-overwrite-deletion-attempt-via-of-and-dev-zero-dev-null-2953194b 2026-07-30T04:01:39.536Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-curl-wget-download-to-temporary-dir-followed-by-sh-c-execution-a2d9e2f3 2026-07-30T04:01:37.813Z weekly 0.8 https://huntrule.com/rules/linux-curl-execution-observed-via-process-start-ea34fb97 2026-07-30T04:01:35.913Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-crypto-miner-command-line-indicators-9069ea3c 2026-07-30T04:01:34.485Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-crontab-r-removes-current-user-crontab-c2e234de 2026-07-30T04:01:32.856Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-crontab-l-enumeration-403ed92c 2026-07-30T04:01:31.215Z weekly 0.8 https://huntrule.com/rules/linux-copy-passwd-or-shadow-from-tmp-using-cp-fa4aaed5 2026-07-30T04:01:29.028Z weekly 0.8 https://huntrule.com/rules/linux-clipboard-collection-via-xclip-with-select-clip-output-sel-clip-o-ec127035 2026-07-30T04:01:27.068Z weekly 0.8 https://huntrule.com/rules/linux-syslog-file-clearing-or-removal-via-common-system-utilities-3fcc9b35 2026-07-30T04:01:25.387Z weekly 0.8 https://huntrule.com/rules/linux-process-activity-clearing-logs-with-rm-rmdir-shred-or-unlink-targeting-var-80915f59 2026-07-30T04:01:23.314Z weekly 0.8 https://huntrule.com/rules/linux-sudo-chroot-command-execution-f2bed782 2026-07-30T04:01:20.748Z weekly 0.8 https://huntrule.com/rules/linux-chmod-process-creation-targeting-sensitive-directory-paths-6419afd1 2026-07-30T04:01:19.042Z weekly 0.8 https://huntrule.com/rules/linux-chattr-i-used-to-remove-immutable-file-attribute-34979410 2026-07-30T04:01:17.336Z weekly 0.8 https://huntrule.com/rules/linux-capsh-invoked-with-shell-commandline-pattern-db1ac3be 2026-07-30T04:01:15.929Z weekly 0.8 https://huntrule.com/rules/linux-capabilities-discovery-via-getcap-r-d8d97d51 2026-07-30T04:01:14.363Z weekly 0.8 https://huntrule.com/rules/linux-setcap-sets-cap-setuid-on-a-binary-via-process-execution-ed447910 2026-07-30T04:01:12.576Z weekly 0.8 https://huntrule.com/rules/linux-setcap-used-to-assign-cap-setgid-setgid-capability-to-a-binary-3a716279 2026-07-30T04:01:09.737Z weekly 0.8 https://huntrule.com/rules/linux-bpftrace-commandline-use-of-unsafe-option-f8341cb2 2026-07-30T04:01:07.920Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-enabling-bpf-kprobes-tracing-via-debugfs-and-probe-enable-7692f583 2026-07-30T04:01:06.368Z weekly 0.8 https://huntrule.com/rules/linux-bash-launched-in-interactive-mode-via-i-6104e693 2026-07-30T04:01:04.705Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-base64-encoded-shebang-in-command-line-fe2f9663 2026-07-30T04:01:03.093Z weekly 0.8 https://huntrule.com/rules/linux-processes-using-base64-input-piped-to-shell-bash-sh-ba592c6d 2026-07-30T04:01:01.263Z weekly 0.8 https://huntrule.com/rules/linux-base64-utility-decoding-via-base64-d-command-line-e2072cab 2026-07-30T04:00:59.368Z weekly 0.8 https://huntrule.com/rules/linux-shell-invocation-via-awk-gawk-mawk-nawk-system-in-commandline-8c1a5675 2026-07-30T04:00:57.767Z weekly 0.8 https://huntrule.com/rules/linux-kaspersky-endpoint-security-stopped-via-command-line-init-d-systemctl-36388120 2026-07-30T04:00:55.947Z weekly 0.8 https://huntrule.com/rules/linux-auditctl-used-with-d-to-delete-all-audit-rules-bed26dea 2026-07-30T04:00:54.352Z weekly 0.8 https://huntrule.com/rules/linux-at-atd-process-execution-for-scheduled-job-creation-d2d642d7 2026-07-30T04:00:52.607Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-via-apt-apt-get-shell-proxy-option-bb382fd5 2026-07-30T04:00:50.586Z weekly 0.8 https://huntrule.com/rules/linux-malware-callback-style-network-connections-to-known-suspicious-ports-dbfc7c98 2026-07-30T04:00:48.866Z weekly 0.8 https://huntrule.com/rules/linux-process-network-connections-to-ngrok-tunnel-endpoints-19bf6fdb 2026-07-30T04:00:46.938Z weekly 0.8 https://huntrule.com/rules/linux-network-connections-to-localtonet-tunneling-subdomains-c4568f5d 2026-07-30T04:00:45.352Z weekly 0.8 https://huntrule.com/rules/linux-network-connections-to-known-monero-mining-pool-hosts-a46c93b7 2026-07-30T04:00:43.458Z weekly 0.8 https://huntrule.com/rules/linux-reverse-shell-via-bin-bash-connecting-to-external-ips-83dcd9f6 2026-07-30T04:00:41.872Z weekly 0.8 https://huntrule.com/rules/linux-wget-writes-files-to-tmp-or-var-tmp-35a05c60 2026-07-30T04:00:40.126Z weekly 0.8 https://huntrule.com/rules/linux-ebpf-backdoor-file-creation-in-cron-d-and-sudoers-d-for-persistence-1a2ea919 2026-07-30T04:00:38.007Z weekly 0.8 https://huntrule.com/rules/linux-alert-on-tmp-rootlog-creation-associated-with-triplecross-ebpf-rootkit-sta-c0239255 2026-07-30T04:00:36.347Z weekly 0.8 https://huntrule.com/rules/suspicious-linux-shell-script-creation-under-etc-profile-d-13f08f54 2026-07-30T04:00:34.049Z weekly 0.8 https://huntrule.com/rules/linux-file-events-suspicious-filenames-embedding-base64-decoded-bash-commands-179b3686 2026-07-30T04:00:32.228Z weekly 0.8 https://huntrule.com/rules/linux-cron-file-creation-in-cron-directories-6c4e2f43 2026-07-30T04:00:30.007Z weekly 0.8 https://huntrule.com/rules/linux-persistence-attempts-by-creating-modifying-etc-sudoers-d-files-ddb26b76 2026-07-30T04:00:27.966Z weekly 0.8 https://huntrule.com/rules/linux-doas-conf-file-creation-00eee2a5 2026-07-30T04:00:26.491Z weekly 0.8 https://huntrule.com/rules/linux-vsftpd-suspicious-error-messages-indicating-potential-exploitation-attempt-377f33a1 2026-07-30T04:00:25.012Z weekly 0.8 https://huntrule.com/rules/linux-syslog-suspicious-bind-named-error-messages-fatal-or-access-denied-c8e35e96 2026-07-30T04:00:23.459Z weekly 0.8 https://huntrule.com/rules/linux-syslog-alert-for-stopping-security-tools-via-service-disruption-49f5dfc1 2026-07-30T04:00:21.872Z weekly 0.8 https://huntrule.com/rules/linux-sshd-logs-suspicious-openssh-daemon-error-messages-e76b413a 2026-07-30T04:00:20.334Z weekly 0.8 https://huntrule.com/rules/linux-command-line-symlink-attempts-targeting-etc-passwd-c67fc22a 2026-07-30T04:00:18.863Z weekly 0.8 https://huntrule.com/rules/linux-jexboss-like-reverse-shell-command-sequence-via-bash-with-dev-tcp-8ec2c8b4 2026-07-30T04:00:17.199Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-dev-tcp-shell-redirection-and-file-descriptor-usage-6cc5fceb 2026-07-30T04:00:15.507Z weekly 0.8 https://huntrule.com/rules/linux-shellshock-function-body-expression-strings-in-logs-c67e0c98 2026-07-30T04:00:14.068Z weekly 0.8 https://huntrule.com/rules/suspicious-reverse-shell-command-lines-on-linux-738d9bcf 2026-07-30T04:00:12.132Z weekly 0.8 https://huntrule.com/rules/linux-logs-alert-on-suspicious-syslog-keywords-f64b6e9a 2026-07-30T04:00:10.444Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-shell-command-execution-indicators-in-command-lines-2aa1440c 2026-07-30T04:00:08.967Z weekly 0.8 https://huntrule.com/rules/linux-new-user-created-with-privileged-uid-gid-values-0ac15ec3 2026-07-30T04:00:05.532Z weekly 0.8 https://huntrule.com/rules/linux-ebpf-warning-indicators-bpf-probe-write-user-helper-messages-0fadd880 2026-07-30T04:00:03.924Z weekly 0.8 https://huntrule.com/rules/linux-code-injection-via-ld-so-preload-file-etc-ld-so-preload-7e3c4651 2026-07-30T04:00:02.209Z weekly 0.8 https://huntrule.com/rules/linux-remote-file-copy-via-scp-rsync-sftp-with-remote-host-targeting-7a14080d 2026-07-30T04:00:00.513Z weekly 0.8 https://huntrule.com/rules/linux-commands-clearing-or-removing-var-log-syslog-e09eb557 2026-07-30T03:59:58.805Z weekly 0.8 https://huntrule.com/rules/linux-syslog-buffer-overflow-and-stack-smashing-attempt-keywords-18b042f0 2026-07-30T03:59:56.856Z weekly 0.8 https://huntrule.com/rules/linux-execution-flagging-suspicious-shell-commands-from-equation-group-scripts-41e5c73d 2026-07-30T03:59:54.994Z weekly 0.8 https://huntrule.com/rules/guacamole-linux-alert-on-session-showing-two-users-present-anomaly-1edd77db 2026-07-30T03:59:53.157Z weekly 0.8 https://huntrule.com/rules/linux-cron-suspicious-crontab-modification-via-replace-af202fd3 2026-07-30T03:59:51.579Z weekly 0.8 https://huntrule.com/rules/linux-clamav-alerts-keyword-matched-trojan-webshell-rootkit-and-htran-detections-36aa86ca 2026-07-30T03:59:50.127Z weekly 0.8 https://huntrule.com/rules/linux-auditd-webshell-like-remote-command-execution-via-execve-execveat-as-web-s-c0d3734d 2026-07-30T03:59:47.414Z weekly 0.8 https://huntrule.com/rules/linux-audit-mknod-syscall-used-to-create-special-files-710bdbce 2026-07-30T03:59:45.798Z weekly 0.8 https://huntrule.com/rules/linux-auditd-program-execution-from-suspicious-directories-a39d7fa7 2026-07-30T03:59:44.208Z weekly 0.8 https://huntrule.com/rules/linux-sysinfo-syscall-used-for-system-information-discovery-b207d563 2026-07-30T03:59:42.558Z weekly 0.8 https://huntrule.com/rules/linux-split-utility-used-to-divide-files-into-chunks-auditd-syscall-2dad0cba 2026-07-30T03:59:40.979Z weekly 0.8 https://huntrule.com/rules/linux-auditd-process-executions-of-telnet-nmap-netcat-for-network-service-scanni-3761e026 2026-07-30T03:59:39.401Z weekly 0.8 https://huntrule.com/rules/linux-kernel-module-load-via-insmod-kmod-106d7cbd 2026-07-30T03:59:37.827Z weekly 0.8 https://huntrule.com/rules/linux-auditd-new-user-account-creation-via-useradd-syscall-or-add-user-audit-eve-759d0d51 2026-07-30T03:59:36.329Z weekly 0.8 https://huntrule.com/rules/linux-clear-disable-kernel-ring-buffer-via-syslog-syscall-auditd-a0-5-6-eca5e022 2026-07-30T03:59:34.802Z weekly 0.8 https://huntrule.com/rules/linux-service-stop-firewalld-iptables-or-ufw-firewall-disabled-53059bc0 2026-07-30T03:59:32.889Z weekly 0.8 https://huntrule.com/rules/linux-auditd-alerts-on-unix-shell-configuration-file-modifications-a94cdd87 2026-07-30T03:59:31.185Z weekly 0.8 https://huntrule.com/rules/linux-auditd-creation-of-systemd-unit-files-in-system-user-directories-1bac86ba 2026-07-30T03:59:29.554Z weekly 0.8 https://huntrule.com/rules/linux-system-and-hardware-information-discovery-via-file-reads-1f358e2e 2026-07-30T03:59:27.912Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-sysrq-trigger-or-configuration-path-access-ea61bb82 2026-07-30T03:59:25.955Z weekly 0.8 https://huntrule.com/rules/linux-auditd-alerts-for-syslog-daemon-configuration-file-changes-c830f15d 2026-07-30T03:59:24.379Z weekly 0.8 https://huntrule.com/rules/linux-ld-so-preload-file-modification-for-shared-object-injection-4b3cb710 2026-07-30T03:59:22.841Z weekly 0.8 https://huntrule.com/rules/linux-auditd-executable-command-path-containing-hidden-files-or-hidden-directori-9e1bef8d 2026-07-30T03:59:21.144Z weekly 0.8 https://huntrule.com/rules/linux-auditd-rule-for-bpfdoor-related-pid-and-lock-file-access-under-var-run-808146b2 2026-07-30T03:59:19.573Z weekly 0.8 https://huntrule.com/rules/linux-auditd-detect-writes-to-audit-configuration-files-and-related-paths-977ef627 2026-07-30T03:59:17.966Z weekly 0.8 https://huntrule.com/rules/linux-system-information-discovery-via-auditd-uname-uptime-lsmod-hostname-env-f34047d9 2026-07-30T03:59:16.507Z weekly 0.8 https://huntrule.com/rules/linux-auditd-suspicious-command-line-tool-usage-for-c2-wget-curl-nc-ssh-nmap-etc-f7158a64 2026-07-30T03:59:14.116Z weekly 0.8 https://huntrule.com/rules/linux-password-policy-discovery-via-chage-and-passwd-ca94a6db 2026-07-30T03:59:12.351Z weekly 0.8 https://huntrule.com/rules/linux-pam-tty-auditing-change-via-auditd-path-events-49aae26c 2026-07-30T03:59:10.819Z weekly 0.8 https://huntrule.com/rules/linux-aslr-disabled-via-personality-syscall-sysctl-or-proc-randomize-va-space-e497a24e 2026-07-30T03:59:09.165Z weekly 0.8 https://huntrule.com/rules/linux-audio-capture-via-arecord-and-ecasound-memfd-create-a7af2487 2026-07-30T03:59:07.347Z weekly 0.8 https://huntrule.com/rules/linux-system-owner-and-user-discovery-via-utility-execution-9a0d8ca0 2026-07-30T03:59:05.641Z weekly 0.8 https://huntrule.com/rules/linux-auditd-unzip-extraction-from-jpg-png-files-for-hidden-data-edd595d7 2026-07-30T03:59:04.198Z weekly 0.8 https://huntrule.com/rules/linux-auditd-detect-system-shutdown-reboot-halt-poweroff-via-execve-4cb57c2f 2026-07-30T03:59:02.566Z weekly 0.8 https://huntrule.com/rules/linux-service-management-via-systemctl-service-start-or-reload-2625cc59 2026-07-30T03:59:00.990Z weekly 0.8 https://huntrule.com/rules/linux-shell-history-file-access-via-executed-commands-eae8ce9f 2026-07-30T03:58:59.424Z weekly 0.8 https://huntrule.com/rules/linux-auditd-suspicious-chmod-and-file-replacement-via-cp-1543ae20 2026-07-30T03:58:57.886Z weekly 0.8 https://huntrule.com/rules/linux-steghide-steganography-extraction-via-steghide-extract-targeting-jpg-png-a5a827d9 2026-07-30T03:58:56.150Z weekly 0.8 https://huntrule.com/rules/linux-auditd-detect-steghide-file-embedding-via-embed-command-ce446a9e 2026-07-30T03:58:54.099Z weekly 0.8 https://huntrule.com/rules/linux-screen-capture-via-xwd-writing-xwd-output-files-e2f17c5d 2026-07-30T03:58:52.281Z weekly 0.8 https://huntrule.com/rules/linux-screen-capture-via-imagemagick-import-tool-outputting-desktop-images-dbe4b9c5 2026-07-30T03:58:50.734Z weekly 0.8 https://huntrule.com/rules/linux-auditd-detect-execution-of-tcpdump-or-tshark-with-interface-flag-f4d3748a 2026-07-30T03:58:49.056Z weekly 0.8 https://huntrule.com/rules/linux-firewall-rule-deletions-via-iptables-firewall-cmd-ufw-or-nft-323ff3f5 2026-07-30T03:58:47.117Z weekly 0.8 https://huntrule.com/rules/linux-masquerading-cp-via-bin-sh-ending-with-crond-9d4548fa 2026-07-30T03:58:45.383Z weekly 0.8 https://huntrule.com/rules/linux-auditd-cat-command-appends-zip-data-to-jpg-png-45810b50 2026-07-30T03:58:42.368Z weekly 0.8 https://huntrule.com/rules/linux-auditd-hidden-file-or-directory-creation-via-dot-prefixed-paths-d08722cd 2026-07-30T03:58:40.772Z weekly 0.8 https://huntrule.com/rules/linux-grep-search-for-password-in-executed-commands-df3fcaea 2026-07-30T03:58:39.176Z weekly 0.8 https://huntrule.com/rules/linux-auditd-chmod-and-chown-executions-indicating-file-or-folder-permission-cha-74c01ace 2026-07-30T03:58:37.836Z weekly 0.8 https://huntrule.com/rules/linux-auditd-dd-overwrites-a-file-using-if-dev-null-or-if-dev-zero-37222991 2026-07-30T03:58:36.392Z weekly 0.8 https://huntrule.com/rules/linux-wget-exfiltration-via-post-file-command-line-cb39d16b 2026-07-30T03:58:34.877Z weekly 0.8 https://huntrule.com/rules/linux-auditd-execution-of-zip-gzip-tar-for-data-compression-a3b5e3e9 2026-07-30T03:58:33.446Z weekly 0.8 https://huntrule.com/rules/linux-auditd-processes-using-cpu-priority-command-line-option-071d5e5a 2026-07-30T03:58:31.833Z weekly 0.8 https://huntrule.com/rules/linux-clipboard-image-data-collection-via-xclip-f200dc3f 2026-07-30T03:58:30.447Z weekly 0.8 https://huntrule.com/rules/linux-auditd-xclip-clipboard-collection-via-selection-and-output-option-214e7e6c 2026-07-30T03:58:28.819Z weekly 0.8 https://huntrule.com/rules/linux-auditd-detect-chattr-removing-the-immutable-i-attribute-a5b977d6 2026-07-30T03:58:27.014Z weekly 0.8 https://huntrule.com/rules/linux-auditd-file-timestamp-manipulation-via-touch-t-a-c-m-r-options-b3cec4e7 2026-07-30T03:58:24.980Z weekly 0.8 https://huntrule.com/rules/linux-auditd-getcap-scans-for-capability-files-on-the-root-path-fe10751f 2026-07-30T03:58:23.396Z weekly 0.8 https://huntrule.com/rules/linux-auditd-iptables-nat-redirect-from-attacker-ports-via-bpfdoor-tcp-redirecti-70b4156e 2026-07-30T03:58:21.918Z weekly 0.8 https://huntrule.com/rules/linux-detect-dd-truncate-binary-padding-used-to-alter-on-disk-file-contents-c52a914f 2026-07-30T03:58:20.112Z weekly 0.8 https://huntrule.com/rules/onelogin-user-account-lock-or-suspension-via-api-events-a717c561 2026-07-30T03:58:18.363Z weekly 0.8 https://huntrule.com/rules/onelogin-events-user-assumed-another-user-account-event-type-id-3-62fff148 2026-07-30T03:58:17.013Z weekly 0.8 https://huntrule.com/rules/okta-user-session-start-from-anonymizing-proxy-service-bde30855 2026-07-30T03:58:15.618Z weekly 0.8 https://huntrule.com/rules/okta-user-lifecycle-create-event-for-new-user-accounts-b6c718dd 2026-07-30T03:58:14.157Z weekly 0.8 https://huntrule.com/rules/okta-account-locked-out-after-max-sign-in-attempts-14701da0 2026-07-30T03:58:12.731Z weekly 0.8 https://huntrule.com/rules/okta-unauthorized-app-access-attempt-via-system-log-display-message-6cc2b61b 2026-07-30T03:58:11.259Z weekly 0.8 https://huntrule.com/rules/okta-user-reports-suspicious-activity-on-their-own-account-via-end-user-activity-07e97cc6 2026-07-30T03:58:09.771Z weekly 0.8 https://huntrule.com/rules/okta-detects-security-threat-detected-events-from-threat-insight-5c82f0b9 2026-07-30T03:58:08.335Z weekly 0.8 https://huntrule.com/rules/okta-policy-rule-updated-or-deleted-via-policy-rule-api-events-0c97c1d3 2026-07-30T03:58:06.761Z weekly 0.8 https://huntrule.com/rules/okta-policy-lifecycle-update-or-deletion-events-1667a172 2026-07-30T03:58:05.187Z weekly 0.8 https://huntrule.com/rules/okta-failed-login-where-password-like-alternateid-was-provided-91b76b84 2026-07-30T03:58:03.948Z weekly 0.8 https://huntrule.com/rules/okta-new-or-positive-admin-console-access-heuristics-via-policy-evaluate-sign-on-a0b38b70 2026-07-30T03:58:02.158Z weekly 0.8 https://huntrule.com/rules/okta-network-zone-deactivated-or-deleted-9f308120 2026-07-30T03:58:00.514Z weekly 0.8 https://huntrule.com/rules/okta-mfa-factor-deactivation-or-reset-detection-50e068d7 2026-07-30T03:57:59.113Z weekly 0.8 https://huntrule.com/rules/okta-identity-provider-creation-via-system-idp-lifecycle-create-969c7590 2026-07-30T03:57:57.396Z weekly 0.8 https://huntrule.com/rules/okta-fastpass-phishing-blocked-mfa-authentication-failure-ee39a9f7 2026-07-30T03:57:55.714Z weekly 0.8 https://huntrule.com/rules/okta-sign-on-policy-update-or-rule-deletion-8f668cc4 2026-07-30T03:57:54.077Z weekly 0.8 https://huntrule.com/rules/okta-application-lifecycle-update-or-deletion-7899144b 2026-07-30T03:57:52.186Z weekly 0.8 https://huntrule.com/rules/okta-detect-api-token-revocation-via-system-api-token-revoke-events-cf1dbc6b 2026-07-30T03:57:50.799Z weekly 0.8 https://huntrule.com/rules/okta-api-token-creation-via-system-api-token-create-event-19951c21 2026-07-30T03:57:49.439Z weekly 0.8 https://huntrule.com/rules/okta-admin-role-assignment-created-via-iam-resource-set-binding-add-139bdd4b 2026-07-30T03:57:48.104Z weekly 0.8 https://huntrule.com/rules/okta-administrator-privilege-granted-to-user-or-group-413d4a81 2026-07-30T03:57:46.639Z weekly 0.8 https://huntrule.com/rules/okta-admin-function-access-via-proxy-9058ca8b 2026-07-30T03:57:45.194Z weekly 0.8 https://huntrule.com/rules/cisco-duo-mfa-successful-login-using-bypass-code-reason-bypass-user-6f7e1c10 2026-07-30T03:57:43.463Z weekly 0.8 https://huntrule.com/rules/microsoft-365-securitycompliancecenter-user-restricted-from-sending-email-succes-ff246f56 2026-07-30T03:57:41.984Z weekly 0.8 https://huntrule.com/rules/microsoft-365-threat-management-high-volume-file-deletion-by-a-user-78a34b67 2026-07-30T03:57:40.454Z weekly 0.8 https://huntrule.com/rules/microsoft-365-suspicious-oauth-app-file-downloads-from-sharepoint-onedrive-ee111937 2026-07-30T03:57:38.896Z weekly 0.8 https://huntrule.com/rules/microsoft-365-threat-management-alert-on-suspicious-inbox-forwarding-6c220477 2026-07-30T03:57:37.197Z weekly 0.8 https://huntrule.com/rules/m365-pst-export-via-new-compliancesearchaction-export-in-securitycompliancecente-6897cd82 2026-07-30T03:57:35.724Z weekly 0.8 https://huntrule.com/rules/microsoft-365-ediscovery-pst-export-alert-securitycompliancecenter-success-event-18b88d08 2026-07-30T03:57:33.954Z weekly 0.8 https://huntrule.com/rules/microsoft-365-cloud-app-security-reports-potential-ransomware-uploads-bd132164 2026-07-30T03:57:32.161Z weekly 0.8 https://huntrule.com/rules/m365-securitycompliancecenter-successful-logon-from-risky-ip-address-in-sanction-c191e2fa 2026-07-30T03:57:30.584Z weekly 0.8 https://huntrule.com/rules/microsoft-365-impossible-travel-activity-via-securitycompliancecenter-successful-d7eab125 2026-07-30T03:57:29.007Z weekly 0.8 https://huntrule.com/rules/microsoft-365-cloud-app-security-successful-data-exfiltration-to-unsanctioned-ap-2b669496 2026-07-30T03:57:27.249Z weekly 0.8 https://huntrule.com/rules/microsoft-cloud-app-security-success-events-from-infrequent-countries-0f2468a2 2026-07-30T03:57:25.622Z weekly 0.8 https://huntrule.com/rules/microsoft-365-threat-management-activity-from-anonymous-proxy-ip-addresses-d8b0a4fe 2026-07-30T03:57:23.976Z weekly 0.8 https://huntrule.com/rules/microsoft-cloud-app-security-activity-by-terminated-user-across-platforms-2e669ed8 2026-07-30T03:57:22.259Z weekly 0.8 https://huntrule.com/rules/microsoft-cloud-app-security-successful-logins-from-microsoft-threat-intel-risky-a3501e8e 2026-07-30T03:57:20.718Z weekly 0.8 https://huntrule.com/rules/exchange-added-federated-domain-successfully-via-add-federateddomain-42127bdd 2026-07-30T03:57:19.089Z weekly 0.8 https://huntrule.com/rules/microsoft-365-mail-delivery-of-suspicious-inbound-emails-to-inbox-or-junk-3569aefd 2026-07-30T03:57:17.432Z weekly 0.8 https://huntrule.com/rules/microsoft-365-audit-new-federated-domain-added-via-domain-add-operation-58f88172 2026-07-30T03:57:15.515Z weekly 0.8 https://huntrule.com/rules/microsoft-365-audit-disabling-strong-authentication-mfa-60de9b57 2026-07-30T03:57:13.932Z weekly 0.8 https://huntrule.com/rules/m365-audit-successful-intune-company-portal-login-tied-to-cmsi-request-13f2d3f5 2026-07-30T03:57:12.404Z weekly 0.8 https://huntrule.com/rules/google-workspace-logins-marked-suspicious-by-google-gcp-38360161 2026-07-30T03:57:10.744Z weekly 0.8 https://huntrule.com/rules/gcp-google-workspace-login-email-forwarding-out-of-domain-activity-2a0bb2dd 2026-07-30T03:57:09.077Z weekly 0.8 https://huntrule.com/rules/google-workspace-detect-gov-attack-warning-login-events-from-login-googleapis-co-eafe6f2b 2026-07-30T03:57:07.521Z weekly 0.8 https://huntrule.com/rules/gcp-google-workspace-admin-role-granted-to-user-2d1b83e4 2026-07-30T03:57:05.629Z weekly 0.8 https://huntrule.com/rules/google-workspace-admin-role-privilege-removed-via-remove-privilege-bf638ef7 2026-07-30T03:57:04.186Z weekly 0.8 https://huntrule.com/rules/google-workspace-admin-role-modified-or-deleted-via-admin-api-audit-events-6aef64e3 2026-07-30T03:57:02.232Z weekly 0.8 https://huntrule.com/rules/google-workspace-admin-api-mfa-enforcement-relaxed-by-setting-to-false-780601d1 2026-07-30T03:57:00.814Z weekly 0.8 https://huntrule.com/rules/gcp-google-workspace-admin-api-client-access-authorized-at-domain-level-04e2a23a 2026-07-30T03:56:59.293Z weekly 0.8 https://huntrule.com/rules/google-workspace-admin-audit-application-removed-from-domain-ee2803f0 2026-07-30T03:56:57.505Z weekly 0.8 https://huntrule.com/rules/gcp-admin-sdk-google-workspace-application-access-level-changed-via-contextaware-22f2fb54 2026-07-30T03:56:55.949Z weekly 0.8 https://huntrule.com/rules/google-cloud-vpn-tunnel-insert-or-delete-via-audit-logs-99980a85 2026-07-30T03:56:54.516Z weekly 0.8 https://huntrule.com/rules/gcp-cloud-sql-database-or-user-modified-deleted-via-audit-api-f346bbd5 2026-07-30T03:56:52.710Z weekly 0.8 https://huntrule.com/rules/gcp-audit-service-account-modified-via-service-accounts-api-methods-6b67c12e 2026-07-30T03:56:51.185Z weekly 0.8 https://huntrule.com/rules/google-cloud-audit-service-account-disabled-or-deleted-13f81a90 2026-07-30T03:56:49.314Z weekly 0.8 https://huntrule.com/rules/gcp-kubernetes-audit-secrets-modified-or-deleted-via-kubernetes-api-methods-2f0bae2d 2026-07-30T03:56:47.589Z weekly 0.8 https://huntrule.com/rules/gcp-audit-logs-kubernetes-rolebinding-and-clusterrolebinding-create-patch-update-0322d9f2 2026-07-30T03:56:46.093Z weekly 0.8 https://huntrule.com/rules/gcp-audit-detects-kubernetes-cronjob-and-job-creation-requests-cd3a808c 2026-07-30T03:56:44.475Z weekly 0.8 https://huntrule.com/rules/gcp-kubernetes-admission-webhook-configuration-changes-via-audit-logs-6ad91e31 2026-07-30T03:56:42.868Z weekly 0.8 https://huntrule.com/rules/gcp-audit-full-network-packet-mirroring-api-activity-980a7598 2026-07-30T03:56:40.843Z weekly 0.8 https://huntrule.com/rules/gcp-audit-logs-firewall-rule-modified-or-deleted-fe513c69 2026-07-30T03:56:39.270Z weekly 0.8 https://huntrule.com/rules/google-cloud-dns-managed-zone-updated-patched-or-deleted-audit-logs-28268a8f 2026-07-30T03:56:37.314Z weekly 0.8 https://huntrule.com/rules/gcp-audit-sensitive-data-re-identified-via-projects-content-reidentify-234f9f48 2026-07-30T03:56:35.657Z weekly 0.8 https://huntrule.com/rules/google-cloud-storage-buckets-modified-or-deleted-via-audit-api-4d9f2ee2 2026-07-30T03:56:34.064Z weekly 0.8 https://huntrule.com/rules/gcp-audit-detects-google-cloud-storage-bucket-enumeration-via-list-apis-e2feb918 2026-07-30T03:56:32.625Z weekly 0.8 https://huntrule.com/rules/gcp-audit-log-break-glass-flag-kubernetes-pod-created-in-gke-cluster-76737c19 2026-07-30T03:56:31.134Z weekly 0.8 https://huntrule.com/rules/gcp-access-policy-deletion-via-accesscontextmanager-audit-logs-32438676 2026-07-30T03:56:29.385Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-blocked-by-conditional-access-policy-token-issuance-denied-9a60e676 2026-07-30T03:56:27.919Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-authentication-interruption-via-device-and-external-security-chall-8366030e 2026-07-30T03:56:26.442Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-mfa-strong-authentication-failures-strong-auth-interrupted-5496ff55 2026-07-30T03:56:24.690Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-mfa-denied-authenticationrequirement-e40f4962 2026-07-30T03:56:23.185Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-in-attempts-to-disabled-accounts-908655e0 2026-07-30T03:56:21.718Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-legacy-authentication-protocols-used-by-account-60f6535a 2026-07-30T03:56:20.322Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-failure-blocked-by-conditional-access-requirement-not-met-b4a6d707 2026-07-30T03:56:18.423Z weekly 0.8 https://huntrule.com/rules/azure-entra-sign-in-logs-account-disabled-or-blocked-on-failed-login-attempts-4afac85c 2026-07-30T03:56:16.414Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-detect-ropc-authentication-flow-use-in-applications-55695bc0 2026-07-30T03:56:14.642Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-application-using-device-code-authentication-flow-248649b7 2026-07-30T03:56:13.022Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-in-success-from-legacy-client-user-agents-suggesting-mfa-bypass-ri-53bb4f7f 2026-07-30T03:56:11.205Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-ins-by-unknown-devices-from-non-trusted-locations-4d136857 2026-07-30T03:56:09.666Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-ins-from-non-compliant-devices-4f77e1d7 2026-07-30T03:56:07.991Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-risky-success-from-non-registered-device-without-mfa-requirement-572b12d4 2026-07-30T03:56:05.664Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-in-success-without-mfa-required-single-factor-authentication-28eea407 2026-07-30T03:56:03.926Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-device-registration-or-join-successful-without-mfa-5afa454e 2026-07-30T03:56:02.468Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-detect-azurehound-discovery-via-user-agent-after-successful-a-35b781cc 2026-07-30T03:56:00.777Z weekly 0.8 https://huntrule.com/rules/azure-sign-in-logs-detect-account-lockout-after-too-many-failed-password-or-user-2b7d6fc0 2026-07-30T03:55:59.307Z weekly 0.8 https://huntrule.com/rules/azure-pim-alert-too-many-global-administrator-accounts-assigned-to-tenant-7bbc309f 2026-07-30T03:55:57.786Z weekly 0.8 https://huntrule.com/rules/azure-pim-redundant-privileged-role-assignments-not-being-used-8c6ec464 2026-07-30T03:55:56.143Z weekly 0.8 https://huntrule.com/rules/azure-pim-role-activation-without-mfa-alert-nomfaonroleactivationalertincident-94a66f46 2026-07-30T03:55:54.699Z weekly 0.8 https://huntrule.com/rules/azure-pim-role-activated-too-frequently-sequential-activation-renewals-645fd80d 2026-07-30T03:55:53.273Z weekly 0.8 https://huntrule.com/rules/azure-pim-alert-for-roles-assigned-outside-privileged-identity-management-b1bc08d1 2026-07-30T03:55:51.702Z weekly 0.8 https://huntrule.com/rules/azure-pim-invalid-license-alert-detection-58af08eb 2026-07-30T03:55:50.020Z weekly 0.8 https://huntrule.com/rules/azure-pim-stale-sign-in-alerts-for-privileged-roles-e402c26a 2026-07-30T03:55:48.425Z weekly 0.8 https://huntrule.com/rules/azure-risk-detection-unfamiliar-sign-in-properties-events-128faeef 2026-07-30T03:55:46.782Z weekly 0.8 https://huntrule.com/rules/azure-saml-token-issuer-anomaly-risk-event-e3393cba 2026-07-30T03:55:45.153Z weekly 0.8 https://huntrule.com/rules/azure-ad-risk-detection-threat-intelligence-sign-in-investigation-events-a2cb56ff 2026-07-30T03:55:43.636Z weekly 0.8 https://huntrule.com/rules/azure-risk-detection-suspicious-browser-sign-in-activity-across-countries-and-te-944f6adb 2026-07-30T03:55:41.985Z weekly 0.8 https://huntrule.com/rules/azure-riskdetection-attempted-primary-refresh-token-prt-access-a84fc3b1 2026-07-30T03:55:40.440Z weekly 0.8 https://huntrule.com/rules/azure-entra-id-risk-detection-successful-password-spray-activity-28ecba0a 2026-07-30T03:55:38.906Z weekly 0.8 https://huntrule.com/rules/azure-ad-risk-detection-new-country-sign-in-adf9f4d2 2026-07-30T03:55:37.242Z weekly 0.8 https://huntrule.com/rules/azure-ad-sign-in-risk-malware-infected-ip-address-sign-ins-821b4dc3 2026-07-30T03:55:35.416Z weekly 0.8 https://huntrule.com/rules/azure-entra-riskdetection-suspiciousipaddress-sign-in-from-known-malicious-ip-36440e1c 2026-07-30T03:55:33.937Z weekly 0.8 https://huntrule.com/rules/azure-risk-detections-malicious-ip-sign-in-failure-rate-a3f55ebd 2026-07-30T03:55:31.997Z weekly 0.8 https://huntrule.com/rules/azure-ad-risk-detection-leaked-credentials-event-leakedcredentials-19128e5e 2026-07-30T03:55:30.436Z weekly 0.8 https://huntrule.com/rules/azure-risk-detection-suspicious-inbox-manipulation-rules-set-to-delete-or-move-i-ceb55fd0 2026-07-30T03:55:28.871Z weekly 0.8 https://huntrule.com/rules/azure-risk-detection-suspicious-inbox-forwarding-identity-protection-events-27e4f1d6 2026-07-30T03:55:27.028Z weekly 0.8 https://huntrule.com/rules/azure-entra-risk-impossible-travel-sign-in-detection-impossibletravel-b2572bf9 2026-07-30T03:55:25.182Z weekly 0.8 https://huntrule.com/rules/azure-entra-unlikelytravel-risk-events-indicating-atypical-travel-between-distan-1a41023f 2026-07-30T03:55:23.685Z weekly 0.8 https://huntrule.com/rules/azure-riskdetection-anonymous-ip-address-sign-ins-53acd925 2026-07-30T03:55:21.944Z weekly 0.8 https://huntrule.com/rules/azure-riskdetection-user-activity-triggered-by-risky-anonymous-proxy-ip-be4d9c86 2026-07-30T03:55:20.476Z weekly 0.8 https://huntrule.com/rules/azure-ad-risk-detection-anomalous-user-activity-riskeventtype-anomaloususeractiv-258b6593 2026-07-30T03:55:19.005Z weekly 0.8 https://huntrule.com/rules/azure-entra-id-riskdetection-anomalous-token-risk-events-6555754e 2026-07-30T03:55:17.208Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-successful-password-reset-by-user-account-340ee172 2026-07-30T03:55:15.616Z weekly 0.8 https://huntrule.com/rules/azure-entra-audit-logs-strongauthenticationrequirement-set-to-disabled-or-state--b18454c8 2026-07-30T03:55:14.030Z weekly 0.8 https://huntrule.com/rules/azure-ad-management-ux-audit-user-risk-and-mfa-registration-policy-updated-d4c7758e 2026-07-30T03:55:12.439Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-temporary-access-pass-added-to-an-account-fa84aaf5 2026-07-30T03:55:10.529Z weekly 0.8 https://huntrule.com/rules/azure-auditlogs-permission-elevation-to-user-access-administrator-for-subscripti-ca9bf243 2026-07-30T03:55:09.047Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-service-principal-removal-448fd1ea 2026-07-30T03:55:07.163Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-service-principal-added-via-add-service-principal-operation-0ddcff6d 2026-07-30T03:55:05.560Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-successful-admin-account-creation-via-add-user-to-role-f7b5b004 2026-07-30T03:55:04.049Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-bulk-removal-of-privileged-role-members-102e11e3 2026-07-30T03:55:02.524Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-user-added-to-privileged-role-49a268a4 2026-07-30T03:55:00.959Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-pim-role-setting-updates-db6c06c4 2026-07-30T03:54:59.474Z weekly 0.8 https://huntrule.com/rules/azure-pim-alert-disablement-in-audit-logs-aeaef14c 2026-07-30T03:54:57.898Z weekly 0.8 https://huntrule.com/rules/azure-ad-privileged-identity-management-pim-elevation-approval-or-denial-audit-e-039a7469 2026-07-30T03:54:56.312Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-owner-removed-from-application-or-service-principal-636e30d5 2026-07-30T03:54:54.716Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-successful-disable-strong-authentication-mfa-user-action-7ea78478 2026-07-30T03:54:53.224Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-user-type-changed-from-guest-to-member-8dee7a0d 2026-07-30T03:54:51.704Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-failed-guest-invitation-by-non-authorized-inviter-0b4b72e3 2026-07-30T03:54:50.239Z weekly 0.8 https://huntrule.com/rules/azure-entra-detect-member-removal-from-group-with-conditional-access-policy-modi-665e2d43 2026-07-30T03:54:48.829Z weekly 0.8 https://huntrule.com/rules/azure-entra-id-added-user-to-group-granted-conditional-access-policy-modificatio-91c95675 2026-07-30T03:54:47.200Z weekly 0.8 https://huntrule.com/rules/azure-ad-federation-settings-modified-via-audit-logs-352a54e1 2026-07-30T03:54:45.555Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-device-no-longer-managed-or-compliant-542b9912 2026-07-30T03:54:44.201Z weekly 0.8 https://huntrule.com/rules/azure-ad-user-registers-new-security-info-authentication-method-change-4d78a000 2026-07-30T03:54:42.337Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-application-deletion-via-entra-admin-operations-410d2a41 2026-07-30T03:54:39.039Z weekly 0.8 https://huntrule.com/rules/azure-app-uri-updates-in-audit-logs-appaddress-property-changes-0055ad1f 2026-07-30T03:54:37.137Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-service-principal-assigned-azure-rbac-microsoft-entra-roles-b04934b2 2026-07-30T03:54:35.536Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-admin-adds-privileged-delegated-or-app-role-permissions-to-serv-5aecf3d5 2026-07-30T03:54:33.999Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-app-granted-microsoft-graph-exchange-sharepoint-azure-ad-per-c1d147ae 2026-07-30T03:54:32.454Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-log-owner-added-to-application-74298991 2026-07-30T03:54:30.714Z weekly 0.8 https://huntrule.com/rules/azure-ad-end-user-consent-blocked-for-risky-apps-by-risk-based-consent-7091372f 2026-07-30T03:54:29.044Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-end-user-consent-to-application-9b2cc4c4 2026-07-30T03:54:27.549Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-delegated-permissions-granted-for-all-users-a6355fbe 2026-07-30T03:54:25.932Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-appid-uri-configuration-updates-for-applications-or-service--1b45b0d1 2026-07-30T03:54:23.062Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-user-added-to-global-or-device-administrator-roles-11c767ae 2026-07-30T03:54:21.486Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-logs-user-added-to-administrator-role-ebbeb024 2026-07-30T03:54:19.750Z weekly 0.8 https://huntrule.com/rules/azure-ad-audit-trustedcasforpasswordlessauth-root-ca-added-via-set-company-infor-4bb80281 2026-07-30T03:54:18.167Z weekly 0.8 https://huntrule.com/rules/azure-ad-device-registration-policy-changes-via-audit-logs-9494bff8 2026-07-30T03:54:16.594Z weekly 0.8 https://huntrule.com/rules/azure-ad-certificate-based-authentication-enabled-via-authentication-methods-pol-c2496b41 2026-07-30T03:54:15.071Z weekly 0.8 https://huntrule.com/rules/azure-audit-logs-bitlocker-key-retrieval-via-read-bitlocker-key-a0413867 2026-07-30T03:54:12.570Z weekly 0.8 https://huntrule.com/rules/azure-entra-audit-logs-user-account-added-and-deleted-quickly-6f583da0 2026-07-30T03:54:10.646Z weekly 0.8 https://huntrule.com/rules/azure-ad-conditional-access-policy-added-by-non-approved-actor-0922467f 2026-07-30T03:54:09.107Z weekly 0.8 https://huntrule.com/rules/azure-conditional-access-policy-updated-by-non-approved-actor-50a3c7aa 2026-07-30T03:54:07.496Z weekly 0.8 https://huntrule.com/rules/azure-ad-conditional-access-policy-deleted-by-non-approved-actor-26e7c5e2 2026-07-30T03:54:05.807Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-vpn-gateway-connection-modified-or-deleted-61171ffc 2026-07-30T03:54:02.909Z weekly 0.8 https://huntrule.com/rules/azure-activity-log-virtual-network-modified-or-deleted-bcfcc962 2026-07-30T03:54:01.442Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-alert-suppression-rule-created-92cc3e5d 2026-07-30T03:53:58.838Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-permission-elevation-to-manage-all-subscriptions-09438caa 2026-07-30T03:53:57.371Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-alert-on-rare-subscription-level-operations-from-new-source--c1182e02 2026-07-30T03:53:55.816Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-cloud-shell-created-via-microsoft-portal-consoles-write-72af37e2 2026-07-30T03:53:54.308Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-virtual-network-device-modified-or-deleted-15ef3fac 2026-07-30T03:53:52.603Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-network-security-group-security-rules-modified-or-deleted-d22b4df4 2026-07-30T03:53:50.490Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-point-to-site-vpn-gateway-modified-or-deleted-d9557b75 2026-07-30T03:53:48.892Z weekly 0.8 https://huntrule.com/rules/azure-firewall-rule-collections-and-groups-modified-or-deleted-via-activity-logs-2a7d64cf 2026-07-30T03:53:47.494Z weekly 0.8 https://huntrule.com/rules/azure-network-firewall-policy-modified-or-deleted-via-activity-logs-83c17918 2026-07-30T03:53:45.516Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-service-account-write-delete-or-impersonate-12d027c3 2026-07-30T03:53:44.080Z weekly 0.8 https://huntrule.com/rules/azure-kubernetes-service-activity-logs-secret-configmap-write-or-delete-7ee0b4aa 2026-07-30T03:53:42.406Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-rolebinding-clusterrolebinding-created-patched-or-deleted-ku-25cb259b 2026-07-30T03:53:40.581Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-rbac-roles-clusterroles-modified-or-deleted-818fee0c 2026-07-30T03:53:38.821Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-pod-deletion-via-connected-clusters-api-b02f9591 2026-07-30T03:53:37.275Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-network-policy-write-delete-operations-08d6ac24 2026-07-30T03:53:35.749Z weekly 0.8 https://huntrule.com/rules/azure-kubernetes-event-deletion-in-activity-logs-225d8b09 2026-07-30T03:53:34.168Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-cronjob-or-job-write-operations-1c71e254 2026-07-30T03:53:32.832Z weekly 0.8 https://huntrule.com/rules/azure-kubernetes-connected-cluster-created-or-deleted-via-activity-logs-9541f321 2026-07-30T03:53:31.239Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-kubernetes-admission-webhook-configuration-write-a61a3c56 2026-07-30T03:53:29.610Z weekly 0.8 https://huntrule.com/rules/azure-key-vault-secrets-modified-or-deleted-via-activity-logs-b831353c 2026-07-30T03:53:27.971Z weekly 0.8 https://huntrule.com/rules/azure-key-vault-write-delete-deployment-and-access-policy-changes-459a2970 2026-07-30T03:53:26.495Z weekly 0.8 https://huntrule.com/rules/azure-key-vault-key-modified-or-deleted-via-activity-log-80eeab92 2026-07-30T03:53:24.440Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-granting-role-permissions-via-roleassignments-write-from-new-a622fcd2 2026-07-30T03:53:22.777Z weekly 0.8 https://huntrule.com/rules/azure-firewall-rule-collections-modified-or-deleted-activity-logs-025c9fe7 2026-07-30T03:53:21.279Z weekly 0.8 https://huntrule.com/rules/azure-firewall-created-modified-or-deleted-via-azure-activity-logs-512cf937 2026-07-30T03:53:19.756Z weekly 0.8 https://huntrule.com/rules/azure-dns-zone-modified-or-deleted-via-activity-logs-af6925b0 2026-07-30T03:53:18.199Z weekly 0.8 https://huntrule.com/rules/azure-activity-log-device-or-device-configuration-modified-or-deleted-46530378 2026-07-30T03:53:16.584Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-high-rate-of-vm-creation-or-deployment-writes-d2d901db 2026-07-30T03:53:14.891Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-container-registry-created-or-deleted-93e0ef48 2026-07-30T03:53:13.434Z weekly 0.8 https://huntrule.com/rules/azure-application-security-group-modified-or-deleted-via-activity-logs-835747f1 2026-07-30T03:53:12.013Z weekly 0.8 https://huntrule.com/rules/azure-application-gateway-modified-or-deleted-via-activity-logs-ad87d14e 2026-07-30T03:53:10.596Z weekly 0.8 https://huntrule.com/rules/azure-activity-logs-deletion-of-azure-ad-hybrid-health-ad-fs-service-48739819 2026-07-30T03:53:08.995Z weekly 0.8 https://huntrule.com/rules/azure-ad-hybrid-health-ad-fs-new-updated-service-member-server-via-administrativ-288a39fc 2026-07-30T03:53:07.162Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-updateloginprofile-password-changes-for-other-users-055fb148 2026-07-30T03:53:05.473Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-suspicious-saml-provider-updates-and-assumerolewithsaml-f43f5d2f 2026-07-30T03:53:03.872Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-iamuser-getsessiontoken-activity-b45ab1d2 2026-07-30T03:53:01.553Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-sts-getcalleridentity-user-agent-trufflehog-enumeration-9b1b8e9b 2026-07-30T03:53:00.055Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detect-assumerole-events-where-the-caller-is-an-assumed-role-905d389b 2026-07-30T03:52:58.369Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detects-aws-identity-center-identity-provider-changes-d3adb3ef 2026-07-30T03:52:55.733Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-modify-ec2-snapshot-permissions-for-cross-account-access-abae8fec 2026-07-30T03:52:54.131Z weekly 0.8 https://huntrule.com/rules/aws-security-hub-finding-evasion-via-finding-updates-and-deletions-cloudtrail-a607e1fe 2026-07-30T03:52:52.460Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-s3-bucket-configuration-and-object-restore-tampering-via-manageme-78b3756a 2026-07-30T03:52:50.874Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-route-53-domain-transferred-to-another-aws-account-b056de1a 2026-07-30T03:52:48.936Z weekly 0.8 https://huntrule.com/rules/aws-route-53-domain-transfer-lock-disabled-via-cloudtrail-disabledomaintransferl-3940b5f1 2026-07-30T03:52:47.312Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-root-user-activity-for-account-access-8ad1600d 2026-07-30T03:52:45.594Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-public-rds-instance-restored-from-snapshot-c3f265c7 2026-07-30T03:52:43.804Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-rds-cluster-modifydbcluster-or-deletedbcluster-activity-457cc9ac 2026-07-30T03:52:42.311Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-rds-modifydbinstance-master-user-password-change-8a63cdd4 2026-07-30T03:52:40.703Z weekly 0.8 https://huntrule.com/rules/aws-glue-development-endpoint-management-via-cloudtrail-api-4990c2e3 2026-07-30T03:52:39.056Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detects-lambda-layer-attach-via-updatefunctionconfiguration-97fbabf8 2026-07-30T03:52:37.378Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-lambda-function-url-configuration-created-ec541962 2026-07-30T03:52:35.889Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-kms-imported-key-material-use-importkeymaterial-deleteimportedkey-1279262f 2026-07-30T03:52:34.451Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-s3-browser-creating-iam-user-or-access-key-db014773 2026-07-30T03:52:32.695Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-s3-browser-creates-inline-iam-policy-with-default-bucket-placehol-db014773 2026-07-30T03:52:31.104Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-s3-browser-enumerating-iam-loginprofiles-and-creating-missing-pro-db014773 2026-07-30T03:52:29.297Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-iam-createaccesskey-for-another-user-potential-backdoor-keys-0a5177f4 2026-07-30T03:52:27.491Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-guardduty-trusted-ip-set-updates-via-createipset-6e61ee20 2026-07-30T03:52:25.759Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-s3-listbuckets-by-non-assumedrole-accounts-possible-bucket-enumer-f305fd62 2026-07-30T03:52:24.201Z weekly 0.8 https://huntrule.com/rules/aws-elasticache-security-group-modified-or-deleted-cloudtrail-7c797da2 2026-07-30T03:52:22.706Z weekly 0.8 https://huntrule.com/rules/aws-elasticache-cache-security-group-created-via-cloudtrail-4ae68615 2026-07-30T03:52:21.157Z weekly 0.8 https://huntrule.com/rules/aws-eks-cluster-createcluster-or-deletecluster-via-cloudtrail-33d50d03 2026-07-30T03:52:19.770Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-efs-mount-target-deleted-or-modified-6a7ba45c 2026-07-30T03:52:18.183Z weekly 0.8 https://huntrule.com/rules/aws-efs-deletefilesystem-events-for-fileshare-modification-or-deletion-25cb1ba1 2026-07-30T03:52:16.314Z weekly 0.8 https://huntrule.com/rules/aws-ecs-task-definitions-that-reference-container-credential-endpoint-uri-b94bf91e 2026-07-30T03:52:14.745Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detects-ec2-createinstanceexporttask-failure-54b9a76a 2026-07-30T03:52:11.864Z weekly 0.8 https://huntrule.com/rules/aws-ec2-startup-script-userdata-modified-via-modifyinstanceattribute-1ab3c5ed 2026-07-30T03:52:09.523Z weekly 0.8 https://huntrule.com/rules/aws-ec2-importkeypair-cloudtrail-activity-92f84194 2026-07-30T03:52:08.051Z weekly 0.8 https://huntrule.com/rules/aws-ec2-disable-default-ebs-encryption-in-current-region-16124c2d 2026-07-30T03:52:06.430Z weekly 0.8 https://huntrule.com/rules/aws-s3-bucket-versioning-disabled-via-putbucketversioning-cloudtrail-a136ac98 2026-07-30T03:52:04.958Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-successful-deletion-of-saml-provider-ccd6a6c8 2026-07-30T03:52:02.849Z weekly 0.8 https://huntrule.com/rules/aws-ses-identity-deletion-via-cloudtrail-deleteidentity-event-20f754db 2026-07-30T03:52:01.246Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-getsignintoken-with-suspicious-console-user-agent-f8103686 2026-07-30T03:51:59.485Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detects-aws-config-delivery-channel-deletion-or-recorder-stopping-07330162 2026-07-30T03:51:57.821Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-vpc-flow-logs-deleted-via-ec2-deleteflowlogs-e386b9b5 2026-07-30T03:51:56.233Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-ssm-sendcommand-with-successful-execution-38e7f511 2026-07-30T03:51:54.716Z weekly 0.8 https://huntrule.com/rules/aws-rds-security-group-rule-changes-via-cloudtrail-14f3f1c8 2026-07-30T03:51:52.930Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-elb-alb-security-group-changes-via-applysecuritygroupstoloadbalan-7a4409fc 2026-07-30T03:51:51.388Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-security-group-ingress-egress-rule-changes-6fb77778 2026-07-30T03:51:49.656Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-enableregion-api-command-monitoring-for-account-region-enablement-a5ffb6ea 2026-07-30T03:51:47.880Z weekly 0.8 https://huntrule.com/rules/pua-aws-cloudtrail-execution-of-trufflehog-via-trufflehog-user-agent-a840e606 2026-07-30T03:51:46.279Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-createroute-new-network-route-added-to-route-table-c803b2ce 2026-07-30T03:51:44.543Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detect-createnetworkaclentry-new-network-acl-rule-added-e1f7febb 2026-07-30T03:51:43.024Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-detect-assumed-role-imds-activity-outside-ssm-managed-instance-re-352a918a 2026-07-30T03:51:41.345Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-guardduty-detector-deleted-or-disabled-via-deletedetector-updated-d2656e78 2026-07-30T03:51:39.212Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-stoplogging-updatetrail-and-deletetrail-changes-4db60cc0 2026-07-30T03:51:37.371Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-consolelogin-success-events-where-mfaused-is-no-77caf516 2026-07-30T03:51:35.902Z weekly 0.8 https://huntrule.com/rules/aws-cloudtrail-consolelogin-failed-authentication-events-6393e346 2026-07-30T03:51:34.393Z weekly 0.8 https://huntrule.com/rules/aws-s3-bucket-deletion-observed-in-cloudtrail-39c9f26d 2026-07-30T03:51:32.093Z weekly 0.8 https://huntrule.com/rules/aws-bedrock-guardrail-updated-updateguardrail-api-via-cloudtrail-1c722651 2026-07-30T03:51:30.547Z weekly 0.8 https://huntrule.com/rules/aws-bedrock-guardrail-deletion-via-cloudtrail-deleteguardrail-api-call-59b70e4d 2026-07-30T03:51:29.016Z weekly 0.8 https://huntrule.com/rules/suspicious-sql-keyword-matching-drop-truncate-dump-select-d84c0ded 2026-07-30T03:51:27.334Z weekly 0.8 https://huntrule.com/rules/antivirus-web-shell-signature-alerts-asp-jsp-php-perl-vbs-and-related-backdoor-i-fdf135a2 2026-07-30T03:51:25.761Z weekly 0.8 https://huntrule.com/rules/antivirus-remote-access-tool-detections-by-malware-family-signatures-agentb-agen-97233998 2026-07-30T03:51:23.933Z weekly 0.8 https://huntrule.com/rules/antivirus-detections-for-executables-and-web-scripts-in-relevant-file-paths-c9a88268 2026-07-30T03:51:22.287Z weekly 0.8 https://huntrule.com/rules/antivirus-ransomware-signature-alert-based-on-known-family-name-strings-4c6ca276 2026-07-30T03:51:20.736Z weekly 0.8 https://huntrule.com/rules/antivirus-password-dumper-signature-match-pws-78cc2dd2 2026-07-30T03:51:19.260Z weekly 0.8 https://huntrule.com/rules/antivirus-detect-hacktool-and-attack-tool-signatures-by-name-and-prefix-fa0c05b6 2026-07-30T03:51:17.468Z weekly 0.8 https://huntrule.com/rules/antivirus-detections-matching-known-exploitation-framework-signatures-238527ad 2026-07-30T03:51:15.780Z weekly 0.8 https://huntrule.com/rules/antivirus-signature-hits-for-apt-malware-naming-patterns-101a1877 2026-07-30T03:51:14.416Z weekly 0.8 https://huntrule.com/rules/velocity-template-renderer-exceptions-indicating-possible-ssti-via-parseerrorexc-16c86189 2026-07-30T03:51:12.673Z weekly 0.8 https://huntrule.com/rules/sql-error-message-keywords-indicating-potential-injection-probing-8a670c6d 2026-07-30T03:51:11.017Z weekly 0.8 https://huntrule.com/rules/spring-application-logs-potential-spel-injection-causing-expressionexception-err-e9edd087 2026-07-30T03:51:08.841Z weekly 0.8 https://huntrule.com/rules/spring-framework-security-exceptions-indicating-suspicious-access-and-csrf-handl-ae48ab93 2026-07-30T03:51:07.367Z weekly 0.8 https://huntrule.com/rules/ruby-on-rails-application-exceptions-indicating-invalid-requests-0d2c3d4c 2026-07-30T03:51:05.947Z weekly 0.8 https://huntrule.com/rules/sharphound-discovery-via-rpc-firewall-opnum-12-sessions-6d580420 2026-07-30T03:51:04.666Z weekly 0.8 https://huntrule.com/rules/sharphound-account-discovery-via-rpc-firewall-blocking-opnum-2-interface-uuid-ma-65f77b1e 2026-07-30T03:51:03.022Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-sasec-scheduled-task-reconnaissance-opnum-0-1-via-ms-tsch-0a3ff354 2026-07-30T03:51:01.391Z weekly 0.8 https://huntrule.com/rules/windows-rpc-firewall-alerts-on-remote-scheduled-task-creation-or-execution-via-s-aff229ab 2026-07-30T03:50:59.664Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-remote-efsr-encryption-service-calls-for-lateral-movement-10018e73 2026-07-30T03:50:58.025Z weekly 0.8 https://huntrule.com/rules/remote-rpcfw-eventid-3-ms-srvs-interfaceuuid-abuse-indicators-b6ea3cc7 2026-07-30T03:50:56.510Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-registry-remote-recon-via-rrp-interface-uuid-d8ffe17e 2026-07-30T03:50:54.953Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-detects-remote-registry-modification-via-microsoft-rrp-interface-ca-35c55673 2026-07-30T03:50:53.083Z weekly 0.8 https://huntrule.com/rules/detect-remote-dcom-wmi-rpc-connections-via-rpc-firewall-event-id-3-68050b10 2026-07-30T03:50:51.169Z weekly 0.8 https://huntrule.com/rules/microsoft-rpc-firewall-remote-printing-rpc-interface-calls-bc3a4b0c 2026-07-30T03:50:49.509Z weekly 0.8 https://huntrule.com/rules/remote-rpc-scheduled-task-recon-via-itaskschedulerservice-7f7c49eb 2026-07-30T03:50:47.872Z weekly 0.8 https://huntrule.com/rules/remote-task-scheduler-lateral-movement-via-itaskschedulerservice-rpc-ace3ff54 2026-07-30T03:50:46.123Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-detects-remote-windows-event-log-recon-via-even-even6-eventid-3-2053961f 2026-07-30T03:50:42.531Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-detection-for-remote-ms-efsr-encrypting-file-system-abuse-5f92fff9 2026-07-30T03:50:40.930Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-ms-drsr-opcode-detections-from-non-domain-controllers-56fda488 2026-07-30T03:50:39.151Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-detects-remote-scheduled-task-reconnaissance-via-atscv-f177f2bc 2026-07-30T03:50:37.101Z weekly 0.8 https://huntrule.com/rules/rpc-firewall-atsvc-remote-schedule-task-execution-opnum-0-1-detection-0fcd1c79 2026-07-30T03:50:35.586Z weekly 0.8 https://huntrule.com/rules/python-sql-exception-errors-pep-249-logged-by-applications-19aefed0 2026-07-30T03:50:33.779Z weekly 0.8 https://huntrule.com/rules/opencanary-vnc-connection-attempt-on-instrumented-node-9db5446c 2026-07-30T03:50:31.814Z weekly 0.8 https://huntrule.com/rules/opencanary-tftp-service-request-observed-b4e6b016 2026-07-30T03:50:30.423Z weekly 0.8 https://huntrule.com/rules/opencanary-telnet-login-attempt-on-port-23-512cff7a 2026-07-30T03:50:28.844Z weekly 0.8 https://huntrule.com/rules/opencanary-detects-new-ssh-connection-attempts-on-monitored-nodes-cd55f721 2026-07-30T03:50:27.380Z weekly 0.8 https://huntrule.com/rules/opencanary-ssh-login-attempt-on-application-log-events-ff7139bc 2026-07-30T03:50:25.836Z weekly 0.8 https://huntrule.com/rules/opencanary-snmp-oid-request-observed-e9856028 2026-07-30T03:50:24.198Z weekly 0.8 https://huntrule.com/rules/opencanary-smb-file-open-request-observed-22777c9e 2026-07-30T03:50:22.683Z weekly 0.8 https://huntrule.com/rules/opencanary-sip-request-activity-application-logs-e30de276 2026-07-30T03:50:20.919Z weekly 0.8 https://huntrule.com/rules/opencanary-redis-action-command-attempt-547dfc53 2026-07-30T03:50:19.282Z weekly 0.8 https://huntrule.com/rules/opencanary-rdp-service-new-connection-attempt-logged-598290cf 2026-07-30T03:50:17.845Z weekly 0.8 https://huntrule.com/rules/opencanary-application-telemetry-syn-port-scan-targeting-a-host-974be8d2 2026-07-30T03:50:16.094Z weekly 0.8 https://huntrule.com/rules/opencanary-network-service-logs-nmap-xmas-scan-targeting-detection-d7553d7b 2026-07-30T03:50:14.457Z weekly 0.8 https://huntrule.com/rules/opencanary-nmap-os-scan-targeting-via-application-logtype-5002-e8a677fd 2026-07-30T03:50:12.946Z weekly 0.8 https://huntrule.com/rules/opencanary-nmap-null-scan-targeting-logtype-5003-68b8547b 2026-07-30T03:50:11.291Z weekly 0.8 https://huntrule.com/rules/opencanary-nmap-fin-scan-targeting-detection-application-logtype-5005-eae8c0c8 2026-07-30T03:50:09.773Z weekly 0.8 https://huntrule.com/rules/opencanary-ntp-service-monlist-request-logged-7cded4b3 2026-07-30T03:50:08.297Z weekly 0.8 https://huntrule.com/rules/opencanary-mysql-service-login-attempt-e7d79a1b 2026-07-30T03:50:06.848Z weekly 0.8 https://huntrule.com/rules/opencanary-mssql-windows-authentication-login-attempt-6e78f90f 2026-07-30T03:50:05.157Z weekly 0.8 https://huntrule.com/rules/opencanary-mssql-sqlauth-login-attempt-detected-3ec9a16d 2026-07-30T03:50:03.435Z weekly 0.8 https://huntrule.com/rules/opencanary-httpproxy-login-attempt-proxy-request-5498fc09 2026-07-30T03:50:01.840Z weekly 0.8 https://huntrule.com/rules/opencanary-http-form-post-login-attempt-application-logtype-3001-af1ac430 2026-07-30T03:50:00.325Z weekly 0.8 https://huntrule.com/rules/opencanary-http-get-request-received-on-service-port-af6c3078 2026-07-30T03:49:58.850Z weekly 0.8 https://huntrule.com/rules/opencanary-detects-git-clone-requests-on-git-service-4fe17521 2026-07-30T03:49:57.153Z weekly 0.8 https://huntrule.com/rules/opencanary-ftp-login-attempt-activity-6991bc2b 2026-07-30T03:49:55.490Z weekly 0.8 https://huntrule.com/rules/node-js-application-error-logs-indicating-potential-rce-via-child-process-97661d9d 2026-07-30T03:49:54.003Z weekly 0.8 https://huntrule.com/rules/kubernetes-api-audit-unauthorized-401-or-forbidden-403-access-attempts-0d933542 2026-07-30T03:49:52.209Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-sidecar-injection-via-kubectl-patch-on-deployments-ad9012a6 2026-07-30T03:49:50.590Z weekly 0.8 https://huntrule.com/rules/kubernetes-serviceaccount-created-via-audit-logging-e31bae15 2026-07-30T03:49:49.014Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-secrets-modified-or-deleted-via-api-verbs-58d31a75 2026-07-30T03:49:47.221Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-logs-listing-secrets-for-enumeration-eeb3e9e1 2026-07-30T03:49:45.500Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-rolebinding-clusterrolebinding-created-or-modified-via-rbac-api-10b97915 2026-07-30T03:49:43.802Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-selfsubjectrulesreviews-rbac-permission-enumeration-attempt-84b777bd 2026-07-30T03:49:42.082Z weekly 0.8 https://huntrule.com/rules/kubernetes-privileged-pod-created-via-api-server-audit-logs-c5cd1b20 2026-07-30T03:49:40.079Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-log-signals-potential-enumeration-via-shells-and-recon-tools-597a7e84 2026-07-30T03:49:38.131Z weekly 0.8 https://huntrule.com/rules/kubernetes-pod-creation-in-kube-system-namespace-via-api-audit-logs-a80d927d 2026-07-30T03:49:36.043Z weekly 0.8 https://huntrule.com/rules/kubernetes-pod-created-with-hostpath-volume-mount-402b955c 2026-07-30T03:49:34.519Z weekly 0.8 https://huntrule.com/rules/kubernetes-pod-container-exec-via-kubernetes-api-remote-command-execution-a1b0ca4e 2026-07-30T03:49:32.712Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-events-deleted-3132570d 2026-07-30T03:49:31.293Z weekly 0.8 https://huntrule.com/rules/kubernetes-deployment-deleted-via-audit-logs-40967487 2026-07-30T03:49:29.957Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-cronjob-job-create-or-modification-events-batch-api-0c9b3bda 2026-07-30T03:49:28.512Z weekly 0.8 https://huntrule.com/rules/kubernetes-audit-admission-webhook-configuration-changes-via-api-actions-eed82177 2026-07-30T03:49:27.007Z weekly 0.8 https://huntrule.com/rules/jvm-application-error-logs-indicating-possible-xxe-parsing-failures-c4e06896 2026-07-30T03:49:25.226Z weekly 0.8 https://huntrule.com/rules/jvm-process-execution-error-messages-indicating-failed-program-launch-d65f37da 2026-07-30T03:49:23.402Z weekly 0.8 https://huntrule.com/rules/jvm-application-error-logs-ognl-injection-exploitation-indicators-4d0af518 2026-07-30T03:49:20.614Z weekly 0.8 https://huntrule.com/rules/jvm-application-errors-indicating-local-file-read-path-traversal-attempts-e032f5bc 2026-07-30T03:49:19.141Z weekly 0.8 https://huntrule.com/rules/jvm-application-error-logs-indicating-jndi-injection-payloads-bb0e9cec 2026-07-30T03:49:17.238Z weekly 0.8 https://huntrule.com/rules/github-enterprise-audit-ssh-certificate-authority-config-change-2f575940 2026-07-30T03:49:15.530Z weekly 0.8 https://huntrule.com/rules/github-audit-log-self-hosted-runner-configuration-change-alerts-f8ed0e8f 2026-07-30T03:49:13.426Z weekly 0.8 https://huntrule.com/rules/github-secret-scanning-disabled-audit-actions-for-enterprise-or-repository-3883d9a0 2026-07-30T03:49:11.837Z weekly 0.8 https://huntrule.com/rules/github-audit-logs-repository-archived-unarchived-status-change-dca8991c 2026-07-30T03:49:10.266Z weekly 0.8 https://huntrule.com/rules/github-audit-repository-or-organization-transfer-events-04ad83ef 2026-07-30T03:49:08.882Z weekly 0.8 https://huntrule.com/rules/github-secret-scanning-push-protection-disabled-ccd55945 2026-07-30T03:49:07.163Z weekly 0.8 https://huntrule.com/rules/github-audit-secret-scanning-push-protection-bypass-activity-detected-02cf536a 2026-07-30T03:49:05.648Z weekly 0.8 https://huntrule.com/rules/github-audit-log-repository-pages-changed-to-public-0c46d4f4 2026-07-30T03:49:04.229Z weekly 0.8 https://huntrule.com/rules/github-audit-outside-collaborator-membership-and-permissions-changed-eaa9ac35 2026-07-30T03:49:02.522Z weekly 0.8 https://huntrule.com/rules/github-audit-new-actions-secret-created-organization-environment-codespaces-or-r-f9405037 2026-07-30T03:49:00.852Z weekly 0.8 https://huntrule.com/rules/github-audit-log-new-org-member-added-or-invited-3908d64a 2026-07-30T03:48:59.181Z weekly 0.8 https://huntrule.com/rules/github-audit-private-repository-forking-policy-enabled-or-cleared-69b3bd1e 2026-07-30T03:48:57.711Z weekly 0.8 https://huntrule.com/rules/github-audit-logs-dependabot-alerts-or-security-updates-disabled-34e1c7d4 2026-07-30T03:48:56.061Z weekly 0.8 https://huntrule.com/rules/github-audit-organizational-high-risk-security-controls-disabled-8622c92d 2026-07-30T03:48:54.351Z weekly 0.8 https://huntrule.com/rules/github-audit-logs-codespaces-and-repo-delete-actions-16a71777 2026-07-30T03:48:52.742Z weekly 0.8 https://huntrule.com/rules/django-application-exceptions-suspicious-security-related-errors-fd435618 2026-07-30T03:48:51.008Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-logs-user-permissions-export-attempt-87cc6698 2026-07-30T03:48:49.331Z weekly 0.8 https://huntrule.com/rules/bitbucket-ssh-user-login-failures-audit-authentication-events-d3f90469 2026-07-30T03:48:47.742Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-user-login-failed-authentication-events-70ed1d26 2026-07-30T03:48:41.817Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-logs-user-permissions-export-attempt-5259cbf2 2026-07-30T03:48:40.271Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-unauthorized-full-data-export-triggered-34d81081 2026-07-30T03:48:38.698Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-unauthorized-access-to-a-resource-7215374a 2026-07-30T03:48:36.797Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-secret-scanning-rule-deleted-for-project-or-repository-ff91e3f0 2026-07-30T03:48:35.363Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-secret-scanning-exempt-repository-added-b91e8d5e 2026-07-30T03:48:33.841Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-project-secret-scanning-allowlist-rule-added-42ccce6d 2026-07-30T03:48:32.097Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-log-configuration-updated-6aa12161 2026-07-30T03:48:30.639Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-global-ssh-settings-changed-16ab6143 2026-07-30T03:48:29.009Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-global-secret-scanning-rule-deleted-e16cf0f0 2026-07-30T03:48:27.601Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-global-permission-added-or-removed-aac6c4f4 2026-07-30T03:48:26.197Z weekly 0.8 https://huntrule.com/rules/bitbucket-audit-logs-full-data-export-triggered-195e1b9d 2026-07-30T03:48:24.729Z weekly 0.8 https://huntrule.com/rules/windows-registry-shell-context-menu-command-tampering-via-shell-command-key-chan-868df2d1 2026-07-30T03:48:23.402Z weekly 0.8 https://huntrule.com/rules/windows-service-imagepath-set-to-user-controlled-directory-via-registry-277dc340 2026-07-30T03:48:21.933Z weekly 0.8 https://huntrule.com/rules/windows-detect-run-dialog-command-history-in-runmru-registry-f9d091f6 2026-07-30T03:48:20.149Z weekly 0.8 https://huntrule.com/rules/windows-registry-modification-via-powershell-crypto-classes-in-shell-open-comman-1c2a3268 2026-07-30T03:48:18.743Z weekly 0.8 https://huntrule.com/rules/windows-registry-microsoft-office-trusted-locations-modified-a0bed973 2026-07-30T03:48:16.308Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-created-via-registry-key-activity-93ff0ceb 2026-07-30T03:48:14.732Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-wusa-exe-cab-extraction-using-unsupported-extract-flag-59b39960 2026-07-30T03:48:13.078Z weekly 0.8 https://huntrule.com/rules/potential-arbitrary-command-execution-via-wsl-wsl-exe-on-windows-dec44ca7 2026-07-30T03:48:11.662Z weekly 0.8 https://huntrule.com/rules/detect-wscript-cscript-executing-javascript-vbscript-vba-vbe-wsf-wsh-files-on-wi-1e33157c 2026-07-30T03:48:09.420Z weekly 0.8 https://huntrule.com/rules/windows-wmic-system-information-discovery-via-wmi-command-line-d85ecdd7 2026-07-30T03:48:07.476Z weekly 0.8 https://huntrule.com/rules/windows-detect-winscp-execution-from-non-default-install-path-7674f8ef 2026-07-30T03:48:05.639Z weekly 0.8 https://huntrule.com/rules/windows-winscp-cli-ftp-sftp-open-attempt-via-command-c1477deb 2026-07-30T03:48:03.950Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-tasklist-exe-process-discovery-via-command-line-63332011 2026-07-30T03:48:00.463Z weekly 0.8 https://huntrule.com/rules/windows-process-termination-using-taskkill-exe-86085955 2026-07-30T03:47:58.946Z weekly 0.8 https://huntrule.com/rules/windows-script-interpreter-execution-from-extracted-compressed-files-7zip-winrar-95724fc1 2026-07-30T03:47:56.932Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-self-launching-executable-running-as-sacrificial-proces-bafd07c6 2026-07-30T03:47:54.675Z weekly 0.8 https://huntrule.com/rules/windows-browser-process-opens-html-from-downloads-folder-538c5851 2026-07-30T03:47:52.524Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-command-lines-using-8-3-short-name-paths-1-2-349d891d 2026-07-30T03:47:50.787Z weekly 0.8 https://huntrule.com/rules/windows-process-based-detection-of-file-and-folder-permission-changes-via-acl-to-37ae075c 2026-07-30T03:47:49.011Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-of-common-tunneling-and-proxy-tools-c75309a3 2026-07-30T03:47:47.126Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-from-web-server-root-directories-35efb964 2026-07-30T03:47:45.332Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detect-guid-like-folder-paths-in-command-line-90b63c33 2026-07-30T03:47:43.070Z weekly 0.8 https://huntrule.com/rules/windows-process-command-lines-query-event-logs-via-wevtutil-wmic-or-powershell-9cd55b6c 2026-07-30T03:47:41.317Z weekly 0.8 https://huntrule.com/rules/windows-system-privileged-shell-spawn-via-elevated-logon-powershell-cmd-61065c72 2026-07-30T03:47:39.415Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-command-line-parameters-for-7z-and-rar-compr-27a72a60 2026-07-30T03:47:37.793Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-creation-via-schtasks-exe-from-suspicious-parent-paths-9494479d 2026-07-30T03:47:34.488Z weekly 0.8 https://huntrule.com/rules/windows-sc-exe-service-query-execution-via-command-line-57712d7a 2026-07-30T03:47:32.589Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-exe-explicit-dllregisterserver-export-calls-from-non-standard-p-d81a9fc6 2026-07-30T03:47:30.899Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-exe-loads-dll-exports-by-ordinal-in-command-line-e79a9e79 2026-07-30T03:47:29.363Z weekly 0.8 https://huntrule.com/rules/windows-screenconnect-remote-command-execution-via-clientservice-exe-process-cre-d1a401ab 2026-07-30T03:47:27.509Z weekly 0.8 https://huntrule.com/rules/anyviewer-rmm-remote-session-executes-cmd-exe-via-avcore-exe-bc533330 2026-07-30T03:47:26.045Z weekly 0.8 https://huntrule.com/rules/windows-ammy-admin-agent-execution-via-rundll32-7da7809e 2026-07-30T03:47:24.443Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-of-action1-agent-and-remote-session-setup-aa3168fb 2026-07-30T03:47:22.977Z weekly 0.8 https://huntrule.com/rules/windows-regsvr32-executes-dlls-with-s-and-e-from-uncommon-paths-implicit-dllregi-ce2c44b5 2026-07-30T03:47:21.179Z weekly 0.8 https://huntrule.com/rules/suspicious-windows-powershell-child-processes-spawned-by-powershell-exe-pwsh-exe-e4b6d2a7 2026-07-30T03:47:19.397Z weekly 0.8 https://huntrule.com/rules/powershell-new-netfirewallrule-adds-windows-allow-firewall-rule-51483085 2026-07-30T03:47:17.318Z weekly 0.8 https://huntrule.com/rules/windows-powershell-process-import-module-execution-in-command-line-4ad74d01 2026-07-30T03:47:15.564Z weekly 0.8 https://huntrule.com/rules/powershell-process-command-line-uses-system-security-cryptography-classes-ad856965 2026-07-30T03:47:14.000Z weekly 0.8 https://huntrule.com/rules/windows-powershell-alert-on-unusually-long-commandline-length-1000-characters-d0d28567 2026-07-30T03:47:12.078Z weekly 0.8 https://huntrule.com/rules/windows-svchost-spawning-office-applications-via-com-instance-creation-9bdaf1e9 2026-07-30T03:47:10.058Z weekly 0.8 https://huntrule.com/rules/windows-net-exe-mounting-smb-over-quic-via-transport-quic-2238d337 2026-07-30T03:47:08.327Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-net-exe-or-net1-exe-execution-183e7ea8 2026-07-30T03:47:06.538Z weekly 0.8 https://huntrule.com/rules/windows-code-page-change-via-mode-com-d48c5ffa 2026-07-30T03:47:04.759Z weekly 0.8 https://huntrule.com/rules/windows-execution-of-microsoft-workflow-compiler-exe-419dbf2b 2026-07-30T03:47:03.223Z weekly 0.8 https://huntrule.com/rules/windows-detect-iexpress-creating-self-extracting-packages-via-makecab-c2b478fc 2026-07-30T03:47:01.591Z weekly 0.8 https://huntrule.com/rules/windows-findstr-exe-password-keyword-search-in-multiple-languages-1a0f6f16 2026-07-30T03:46:59.688Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-extexport-exe-execution-indicative-of-dll-sideloading-fb0b815b 2026-07-30T03:46:57.907Z weekly 0.8 https://huntrule.com/rules/windows-proxy-execution-explorer-exe-spawned-by-cmd-exe-or-powershell-9eb271b9 2026-07-30T03:46:56.225Z weekly 0.8 https://huntrule.com/rules/windows-diskshadow-script-mode-execution-via-s-flag-0c2f8629 2026-07-30T03:46:54.592Z weekly 0.8 https://huntrule.com/rules/windows-detect-diskshadow-exe-spawning-child-processes-56b1dde8 2026-07-30T03:46:52.874Z weekly 0.8 https://huntrule.com/rules/windows-clickonce-deployment-execution-via-dfsvc-exe-child-process-241d52b5 2026-07-30T03:46:51.248Z weekly 0.8 https://huntrule.com/rules/windows-curl-exe-execution-using-custom-user-agent-option-3286d37a 2026-07-30T03:46:49.399Z weekly 0.8 https://huntrule.com/rules/windows-flagged-curl-exe-upload-or-form-data-command-line-activity-00bca14a 2026-07-30T03:46:47.955Z weekly 0.8 https://huntrule.com/rules/windows-curl-exe-process-execution-for-remote-file-transfer-bbeaed61 2026-07-30T03:46:46.029Z weekly 0.8 https://huntrule.com/rules/windows-curl-exe-file-download-via-o-remote-name-or-output-9a517fca 2026-07-30T03:46:44.530Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-csc-exe-dynamic-net-compilation-acf2807c 2026-07-30T03:46:42.350Z weekly 0.8 https://huntrule.com/rules/windows-headless-child-process-spawned-via-conhost-exe-00ca75ab 2026-07-30T03:46:40.693Z weekly 0.8 https://huntrule.com/rules/windows-cmd-exe-set-p-file-append-override-pattern-65e4c134 2026-07-30T03:46:38.879Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-uc-berkeley-boinc-related-software-execution-string-mat-0090b851 2026-07-30T03:46:35.391Z weekly 0.8 https://huntrule.com/rules/windows-attrib-exe-run-with-s-flag-to-mark-files-as-system-files-bb19e94c 2026-07-30T03:46:33.854Z weekly 0.8 https://huntrule.com/rules/windows-7-zip-extraction-of-password-protected-archives-using-p-b717b8fd 2026-07-30T03:46:31.960Z weekly 0.8 https://huntrule.com/rules/windows-process-access-with-high-grantedaccess-to-wmi-provider-and-lsass-250ae82f 2026-07-30T03:46:30.065Z weekly 0.8 https://huntrule.com/rules/windows-process-access-to-lsass-from-suspicious-source-folders-fa34b441 2026-07-30T03:46:26.530Z weekly 0.8 https://huntrule.com/rules/windows-powershell-process-accessing-lsass-exe-for-possible-credential-dumping-0f920ebe 2026-07-30T03:46:24.902Z weekly 0.8 https://huntrule.com/rules/windows-winapi-function-calls-from-powershell-script-blocks-9f22ccd5 2026-07-30T03:46:23.113Z weekly 0.8 https://huntrule.com/rules/powershell-scripts-calling-winapi-dlls-on-windows-19d65a1c 2026-07-30T03:46:21.602Z weekly 0.8 https://huntrule.com/rules/powershell-script-block-token-obfuscation-via-invoke-obfuscation-patterns-f3a98ce4 2026-07-30T03:46:19.391Z weekly 0.8 https://huntrule.com/rules/powershell-scriptblock-send-mailmessage-with-attachments-for-possible-smtp-data--9a7afa56 2026-07-30T03:46:16.922Z weekly 0.8 https://huntrule.com/rules/windows-powershell-scriptblock-remove-item-used-to-delete-files-or-folders-b8af5f36 2026-07-30T03:46:15.526Z weekly 0.8 https://huntrule.com/rules/powershell-registry-reconnaissance-via-script-block-queries-windows-064060aa 2026-07-30T03:46:13.728Z weekly 0.8 https://huntrule.com/rules/powershell-smb-share-mapping-over-quic-new-smbmapping-6df07c3b 2026-07-30T03:46:12.212Z weekly 0.8 https://huntrule.com/rules/powershell-scriptblock-adds-windows-firewall-allow-rule-via-new-netfirewallrule-8d31dd2e 2026-07-30T03:46:10.497Z weekly 0.8 https://huntrule.com/rules/windows-powershell-script-access-to-windows-mailapp-mailbox-data-paths-4e485d01 2026-07-30T03:46:08.261Z weekly 0.8 https://huntrule.com/rules/exchangepowershell-inbox-rule-creation-or-update-via-new-inboxrule-set-inboxrule-04580eed 2026-07-30T03:46:06.261Z weekly 0.8 https://huntrule.com/rules/suspicious-mail-forwarding-redirecting-via-exchangepowershell-cmdlets-on-windows-0c7686d5 2026-07-30T03:46:04.633Z weekly 0.8 https://huntrule.com/rules/powershell-compress-archive-cmdlet-execution-for-data-compression-6dc5d284 2026-07-30T03:46:02.762Z weekly 0.8 https://huntrule.com/rules/powershell-local-firewall-rule-enumeration-using-get-netfirewallrule-show-netfir-ea207a23 2026-07-30T03:46:01.174Z weekly 0.8 https://huntrule.com/rules/powershell-classic-detect-bxor-operator-in-consolehost-command-line-812837bb 2026-07-30T03:45:59.592Z weekly 0.8 https://huntrule.com/rules/windows-powershell-uncommon-hostapplication-values-in-ps-classic-start-telemetry-d7326048 2026-07-30T03:45:57.708Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-psexec-default-pipe-psexesvc-f3f3a972 2026-07-30T03:45:56.012Z weekly 0.8 https://huntrule.com/rules/windows-network-connection-from-process-in-c-users-public-folder-bcb03938 2026-07-30T03:45:54.382Z weekly 0.8 https://huntrule.com/rules/windows-network-connections-to-azurefd-net-excluding-common-browsers-and-known-f-8cb4d14e 2026-07-30T03:45:52.854Z weekly 0.8 https://huntrule.com/rules/windows-powershell-initiated-network-connections-1f21ec3f 2026-07-30T03:45:51.005Z weekly 0.8 https://huntrule.com/rules/windows-msiexec-exe-initiated-outbound-http-s-connection-on-ports-80-443-8e5e38e4 2026-07-30T03:45:49.194Z weekly 0.8 https://huntrule.com/rules/windows-hh-exe-initiates-http-s-network-connections-468a8cea 2026-07-30T03:45:47.638Z weekly 0.8 https://huntrule.com/rules/windows-dllhost-exe-network-connection-to-non-local-ip-address-cfed2f44 2026-07-30T03:45:46.134Z weekly 0.8 https://huntrule.com/rules/dfsvc-exe-initiated-network-connection-on-uncommon-destination-ports-windows-4c5fba4a 2026-07-30T03:45:44.474Z weekly 0.8 https://huntrule.com/rules/dfsvc-exe-initiated-network-connections-to-non-local-ip-addresses-on-windows-3c21219b 2026-07-30T03:45:42.714Z weekly 0.8 https://huntrule.com/rules/windows-wmi-dll-modules-loaded-by-uncommon-image-paths-671bb7e3 2026-07-30T03:45:41.079Z weekly 0.8 https://huntrule.com/rules/werfaultsecure-loads-dbgcore-dll-or-dbghelp-dll-windows-image-load-8a2f4b1c 2026-07-30T03:45:38.393Z weekly 0.8 https://huntrule.com/rules/windows-microsoft-word-loads-wll-add-in-files-1337afba 2026-07-30T03:45:34.870Z weekly 0.8 https://huntrule.com/rules/windows-excel-loads-an-xll-add-in-via-excel-exe-image-load-c5f4b5cb 2026-07-30T03:45:33.369Z weekly 0.8 https://huntrule.com/rules/windows-task-scheduler-dll-taskschd-dll-loaded-from-uncommon-paths-by-a-process-3b92a1d0 2026-07-30T03:45:31.837Z weekly 0.8 https://huntrule.com/rules/windows-process-loads-system-drawing-ni-dll-666ecfc7 2026-07-30T03:45:29.894Z weekly 0.8 https://huntrule.com/rules/windows-uncommon-process-loads-bitsproxy-dll-via-image-load-e700ff14 2026-07-30T03:45:26.187Z weekly 0.8 https://huntrule.com/rules/windows-image-load-amsi-dll-loaded-by-uncommon-process-facd1549 2026-07-30T03:45:24.587Z weekly 0.8 https://huntrule.com/rules/windows-file-events-webdav-temporary-files-created-with-suspicious-extensions-4c55738d 2026-07-30T03:45:20.978Z weekly 0.8 https://huntrule.com/rules/windows-file-create-of-code-tunnel-json-indicates-vs-code-tunneling-usage-9661ec9d 2026-07-30T03:45:17.572Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-txt-creation-in-user-desktop-via-cmd-exe-caf02a0a 2026-07-30T03:45:16.023Z weekly 0.8 https://huntrule.com/rules/windows-executable-file-creation-where-a-parent-executable-writes-another-exe-297afac9 2026-07-30T03:45:14.310Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-created-via-file-creation-in-system-task-directories-a762e74f 2026-07-30T03:45:12.585Z weekly 0.8 https://huntrule.com/rules/windows-creation-of-python-pth-path-configuration-files-in-site-packages-e3652ba3 2026-07-30T03:45:10.944Z weekly 0.8 https://huntrule.com/rules/windows-pfx-file-creation-via-file-write-events-dca1b3e8 2026-07-30T03:45:08.845Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-dmp-hdmp-memory-dump-files-3a525307 2026-07-30T03:45:07.348Z weekly 0.8 https://huntrule.com/rules/windows-deletion-of-zone-identifier-alternate-data-stream-7eac0a16 2026-07-30T03:45:05.870Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-time-changed-to-an-earlier-year-possible-timestomping-558eebe5 2026-07-30T03:45:04.422Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-unattend-xml-in-panther-directory-76a26006 2026-07-30T03:45:02.449Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-hive-and-reg-backups-by-uncommon-applications-337a31c6 2026-07-30T03:45:00.920Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-outlook-unistore-data-by-uncommon-processes-fc3e237f 2026-07-30T03:44:56.269Z weekly 0.8 https://huntrule.com/rules/windows-file-access-to-browser-credential-stores-by-uncommon-processes-91cb43db 2026-07-30T03:44:54.489Z weekly 0.8 https://huntrule.com/rules/windows-uncommon-processes-access-chromium-browser-cookie-and-history-files-c5f37810 2026-07-30T03:44:52.386Z weekly 0.8 https://huntrule.com/rules/remote-thread-creation-via-cmd-exe-or-powershell-exe-windows-a9d4d3fa 2026-07-30T03:44:50.599Z weekly 0.8 https://huntrule.com/rules/windows-powershell-remote-thread-creation-via-createremotethread-eeb2e3dc 2026-07-30T03:44:48.958Z weekly 0.8 https://huntrule.com/rules/windows-createremotethread-with-loadlibrarya-for-dll-injection-052ec6f6 2026-07-30T03:44:47.081Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4699-scheduled-task-deletion-detection-4f86b304 2026-07-30T03:44:45.587Z weekly 0.8 https://huntrule.com/rules/windows-security-access-to-browser-credential-files-by-uncommon-processes-4b60e527 2026-07-30T03:44:44.208Z weekly 0.8 https://huntrule.com/rules/windows-security-remote-wmi-activescripteventconsumers-via-scrcons-exe-event-id--9599c180 2026-07-30T03:44:42.321Z weekly 0.8 https://huntrule.com/rules/windows-firewall-exception-rule-modified-event-ids-2005-2073-5570c4d9 2026-07-30T03:44:40.553Z weekly 0.8 https://huntrule.com/rules/windows-successful-msix-appx-package-installation-via-event-id-854-appxdeploymen-289dfa9e 2026-07-30T03:44:38.743Z weekly 0.8 https://huntrule.com/rules/proxy-requests-for-class-uri-extensions-53c15703 2026-07-30T03:44:37.209Z weekly 0.8 https://huntrule.com/rules/dns-queries-to-low-reputation-etlds-alphasoc-list-cf5ee356 2026-07-30T03:44:35.754Z weekly 0.8 https://huntrule.com/rules/macos-clipboard-data-collection-via-pbpaste-command-execution-d8af0da1 2026-07-30T03:44:34.250Z weekly 0.8 https://huntrule.com/rules/macos-python-pth-file-creation-in-site-packages-path-4f394635 2026-07-30T03:44:32.379Z weekly 0.8 https://huntrule.com/rules/linux-process-discovery-via-common-cli-enumeration-tools-4e2f5868 2026-07-30T03:44:30.625Z weekly 0.8 https://huntrule.com/rules/linux-process-termination-via-kill-pkill-killall-commands-64c41342 2026-07-30T03:44:28.998Z weekly 0.8 https://huntrule.com/rules/linux-file-creation-long-filename-pattern-100-chars-excluding-known-system-paths-11629c4d 2026-07-30T03:44:27.265Z weekly 0.8 https://huntrule.com/rules/linux-python-pth-file-creation-in-site-packages-fb96c26c 2026-07-30T03:44:25.708Z weekly 0.8 https://huntrule.com/rules/okta-password-health-report-endpoint-accessed-via-reports-password-health-0d58814b 2026-07-30T03:44:24.074Z weekly 0.8 https://huntrule.com/rules/microsoft-365-audit-inbox-rule-creation-or-update-with-email-hiding-actions-d3577be1 2026-07-30T03:44:22.389Z weekly 0.8 https://huntrule.com/rules/o365-audit-detect-mail-forwarding-and-redirect-rule-changes-c726e007 2026-07-30T03:44:20.543Z weekly 0.8 https://huntrule.com/rules/azure-entra-id-sign-in-using-axios-user-agent-ea1a07f0 2026-07-30T03:44:18.769Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-indicators-of-litellm-supply-chain-backdoor-activity-lite-36603778 2026-07-30T03:44:17.022Z weekly 0.8 https://huntrule.com/rules/linux-persistence-file-creation-via-python3-paths-for-sysmon-py-and-systemd-user-81c0b7f5 2026-07-30T03:44:15.090Z weekly 0.8 https://huntrule.com/rules/windows-execution-of-tanstack-runner-js-via-bun-exe-run-9b4f3d2e 2026-07-30T03:44:13.045Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-execution-of-bun-runner-for-tanstack-supply-chain-comprom-3c6f5e4a 2026-07-30T03:44:11.541Z weekly 0.8 https://huntrule.com/rules/windows-detect-file-creation-of-tanstack-runner-and-router-init-persistence-arti-8a3f2c1e 2026-07-30T03:44:09.623Z weekly 0.8 https://huntrule.com/rules/linux-file-creation-indicators-for-tanstack-related-supply-chain-runner-and-pers-2b5e4d3f 2026-07-30T03:44:07.668Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-to-git-tanstack-com-and-filev2-getsession-org-for-tanstack-s-ac5a4e3f 2026-07-30T03:44:05.794Z weekly 0.8 https://huntrule.com/rules/webserver-detection-of-libredtail-http-user-agent-inbound-requests-6fd25dd1 2026-07-30T03:44:04.127Z weekly 0.8 https://huntrule.com/rules/proxy-outbound-request-to-eviltokens-phaas-phishing-infrastructure-cloudflare-wo-e0e121d0 2026-07-30T03:44:02.522Z weekly 0.8 https://huntrule.com/rules/windows-process-chain-for-axios-npm-compromise-cscript-vbs-temp-deletion-curl-c2-f6c27ecc 2026-07-30T03:44:00.909Z weekly 0.8 https://huntrule.com/rules/macos-detects-axios-npm-compromise-process-chain-using-osascript-curl-download-a-a09ee860 2026-07-30T03:43:58.430Z weekly 0.8 https://huntrule.com/rules/linux-axios-npm-plain-crypto-js-compromise-chain-via-curl-nohup-and-python3-0a23a62d 2026-07-30T03:43:56.402Z weekly 0.8 https://huntrule.com/rules/detect-suspicious-dns-queries-to-axios-supply-chain-c2-domains-73e5d24f 2026-07-30T03:43:54.615Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-indicators-for-axios-npm-compromise-drops-node-exe-powersh-cd6386fa 2026-07-30T03:43:52.870Z weekly 0.8 https://huntrule.com/rules/macos-file-creation-indicators-for-axios-npm-supply-chain-compromise-2db0458c 2026-07-30T03:43:50.826Z weekly 0.8 https://huntrule.com/rules/linux-file-drop-indicator-for-axios-npm-supply-chain-compromise-curl-to-tmp-ld-p-b7cb840c 2026-07-30T03:43:49.139Z weekly 0.8 https://huntrule.com/rules/windows-defender-windefend-flags-tieringengineservice-exe-eicar-test-staging-by--a7c3e5f2 2026-07-30T03:43:47.598Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-created-redsun-redsun-9b4e7c2a 2026-07-30T03:43:42.416Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-tieringengineservice-exe-in-rs-prefixed-temp-directory-f2e4b7d9 2026-07-30T03:43:40.754Z weekly 0.8 https://huntrule.com/rules/webserver-user-agent-wp2shell-indicates-wp2shell-poc-activity-a7c4e2f9 2026-07-30T03:43:38.930Z weekly 0.8 https://huntrule.com/rules/wordpress-wp2shell-webshell-plugin-path-access-webserver-c9e6f412 2026-07-30T03:43:37.281Z weekly 0.8 https://huntrule.com/rules/wordpress-rest-batch-endpoint-wp2shell-exploitation-via-post-with-rest-route-bat-b8d5f301 2026-07-30T03:43:35.599Z weekly 0.8 https://huntrule.com/rules/windows-lsass-crash-with-netlogon-dll-fault-and-status-stack-buffer-overrun-f8a66a02 2026-07-30T03:43:33.885Z weekly 0.8 https://huntrule.com/rules/linux-detect-authencesn-crypto-module-load-via-modprobe-cve-2026-31431-indicator-474b415a 2026-07-30T03:43:29.455Z weekly 0.8 https://huntrule.com/rules/linux-auditd-af-alg-address-family-38-socket-syscall-creation-474b415a 2026-07-30T03:43:27.359Z weekly 0.8 https://huntrule.com/rules/windows-curl-exe-execution-using-tor-socks-proxy-socks-and-onion-in-command-line-e99375eb 2026-07-30T03:43:25.445Z weekly 0.8 https://huntrule.com/rules/windows-detect-creation-of-funksec-files-used-as-funklocker-ransomware-extension-2c76a22b 2026-07-30T03:43:23.417Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-command-line-npm-install-of-known-malicious-packages-sh-bae7c70b 2026-07-30T03:43:21.657Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-bun-environment-js-executed-via-bun-exe-from-node-exe-5299fadf 2026-07-30T03:43:19.142Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-matching-shai-hulud-command-line-indicators-540703fb 2026-07-30T03:43:17.303Z weekly 0.8 https://huntrule.com/rules/linux-curl-data-exfiltration-attempt-from-npm-package-to-webhook-site-efd2eb09 2026-07-30T03:43:15.823Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-npm-installs-known-shai-hulud-2-0-malicious-packages-and--514f533b 2026-07-30T03:43:13.885Z weekly 0.8 https://huntrule.com/rules/linux-bun-runtime-execution-of-bun-environment-js-from-node-parent-process-eb827bbd 2026-07-30T03:43:11.443Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-shai-hulud-and-sha1hulud-command-line-indicators-11bb9b26 2026-07-30T03:43:09.835Z weekly 0.8 https://huntrule.com/rules/linux-file-creation-of-malicious-github-workflows-shai-hulud-workflow-yamls-0aba5685 2026-07-30T03:43:08.250Z weekly 0.8 https://huntrule.com/rules/zeek-http-connections-with-suspicious-user-agent-containing-katz-ontop-834c6d2f 2026-07-30T03:43:06.356Z weekly 0.8 https://huntrule.com/rules/dns-queries-to-katz-stealer-associated-domains-6b0c762f 2026-07-30T03:43:04.588Z weekly 0.8 https://huntrule.com/rules/windows-image-load-of-katz-stealer-dlls-e6c7ab7c 2026-07-30T03:43:03.080Z weekly 0.8 https://huntrule.com/rules/windows-dns-queries-to-known-katz-stealer-domains-9c3d6e32 2026-07-30T03:43:01.365Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-grixba-reconnaissance-tool-command-line-parameter-combo-af688c76 2026-07-30T03:42:59.683Z weekly 0.8 https://huntrule.com/rules/macos-process-creation-filegrabber-or-curl-post-exfiltration-indicators-for-amos-e710a880 2026-07-30T03:42:57.928Z weekly 0.8 https://huntrule.com/rules/macos-file-persistence-indicators-for-atomic-macos-stealer-artifacts-e710a880 2026-07-30T03:42:55.986Z weekly 0.8 https://huntrule.com/rules/linux-process-attempts-to-enable-suid-core-dumps-via-proc-sys-fs-suid-dumpable-33b3cfb1 2026-07-30T03:42:54.343Z weekly 0.8 https://huntrule.com/rules/windows-application-logs-wsus-deserialization-exploitation-indicators-for-cve-20-e5f66e87 2026-07-30T03:42:52.562Z weekly 0.8 https://huntrule.com/rules/suspicious-cmd-exe-and-powershell-child-processes-of-wsus-wsusservice-exe-on-win-43259cc4 2026-07-30T03:42:50.719Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-commvault-qlogin-argument-injection-hints-for-localadmi-ff0225a0 2026-07-30T03:42:48.754Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-commvault-qoperation-exe-webshell-drop-via-file-to-jsp--bd3b3fff 2026-07-30T03:42:47.161Z weekly 0.8 https://huntrule.com/rules/windows-commvault-qlogin-exe-targeting-publicsharinguser-with-a-guid-password-917789e1 2026-07-30T03:42:45.456Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-child-process-spawned-by-node-js-parent-react2shell-pattern-c70834fa 2026-07-30T03:42:41.729Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-crushftp-spawns-powershell-cmd-and-lolbins-indicative-o-0fdc7c7f 2026-07-30T03:42:39.711Z weekly 0.8 https://huntrule.com/rules/iis-web-logs-sharepoint-toolpane-and-spinstall0-post-get-indicative-of-cve-2025--48d053db 2026-07-30T03:42:37.680Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-indicators-of-sharepoint-spinstall0-aspx-encoded-comman-7477881c 2026-07-30T03:42:35.904Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-in-sharepoint-web-server-extensions-indicative-of-cve-2025-ba479447 2026-07-30T03:42:18.413Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-regsvr32-use-by-notepad-installer-for-cve-20-933f0bb5 2026-07-30T03:42:16.324Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-child-process-behavior-from-solarwinds-webhelpdesk-webhelpdes-8c7f4a2d 2026-07-30T03:41:57.379Z weekly 0.8 https://huntrule.com/rules/windows-potential-cve-2025-33053-webdav-rce-via-iediagcmd-exe-or-customshellhost-abe06362 2026-07-30T03:41:55.422Z weekly 0.8 https://huntrule.com/rules/windows-process-access-indicating-rce-attempt-via-cve-2025-33053-and-webdav-host-9a2d8b3e 2026-07-30T03:41:53.169Z weekly 0.8 https://huntrule.com/rules/linux-alert-on-nsswitch-conf-creation-outside-standard-paths-10ac0730 2026-07-30T03:41:49.184Z weekly 0.8 https://huntrule.com/rules/webserver-java-webshell-upload-attempts-via-post-to-sap-netviewer-uris-639b893f 2026-07-30T03:41:47.149Z weekly 0.8 https://huntrule.com/rules/webserver-detections-for-sap-netviewer-jsp-webshell-command-execution-via-cmd-pa-94e12f41 2026-07-30T03:41:45.433Z weekly 0.8 https://huntrule.com/rules/suspicious-child-process-of-sap-netweaver-on-windows-using-command-and-script-in-5b304bcb 2026-07-30T03:41:44.020Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-command-child-process-from-sap-netweaver-work-root-directories-69dea60b 2026-07-30T03:41:42.383Z weekly 0.8 https://huntrule.com/rules/windows-file-events-suspicious-sap-netweaver-jsp-java-class-file-creation-86a7c91f 2026-07-30T03:41:40.343Z weekly 0.8 https://huntrule.com/rules/linux-file-events-sap-netweaver-jsp-java-class-webshell-file-creation-5b91409c 2026-07-30T03:41:38.030Z weekly 0.8 https://huntrule.com/rules/crushftp-service-spawning-suspicious-script-and-shell-child-processes-on-windows-459628e3 2026-07-30T03:41:36.404Z weekly 0.8 https://huntrule.com/rules/suspicious-cmd-exe-spawned-by-w3wp-exe-with-centrestack-portal-config-parent-com-2d79e371 2026-07-30T03:41:34.705Z weekly 0.8 https://huntrule.com/rules/windows-library-ms-file-creation-by-7z-winrar-explorer-5a7132c0 2026-07-30T03:41:33.027Z weekly 0.8 https://huntrule.com/rules/suspicious-cisco-asa-webvpn-get-requests-via-proxy-logs-indicating-exploitation--15697955 2026-07-30T03:41:31.192Z weekly 0.8 https://huntrule.com/rules/windows-goanywhere-mft-exploitation-suspicious-powershell-and-cmd-child-process--6c76b3d0 2026-07-30T03:41:29.355Z weekly 0.8 https://huntrule.com/rules/windows-file-events-screenconnect-slashandgrab-exploitation-dropper-artifacts-05164d17 2026-07-30T03:41:27.755Z weekly 0.8 https://huntrule.com/rules/windows-registry-protocol-handler-clsid-server-dll-set-in-registry-d807056b 2026-07-30T03:41:25.664Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detects-specific-forest-blizzard-tool-execution-via-has-07db928c 2026-07-30T03:41:22.096Z weekly 0.8 https://huntrule.com/rules/windows-file-events-javascript-file-creation-in-driverstore-filerepository-ec7c4e9b 2026-07-30T03:41:20.305Z weekly 0.8 https://huntrule.com/rules/windows-file-events-programdata-suspicious-driver-script-file-creation-pattern-b92d1d19 2026-07-30T03:41:18.713Z weekly 0.8 https://huntrule.com/rules/windows-process-chain-rdpinit-exe-spawning-notepad-that-executes-cmd-exe-6676896b 2026-07-30T03:41:16.602Z weekly 0.8 https://huntrule.com/rules/windows-dns-query-indicators-for-dprk-c2-domains-4d16c9a6 2026-07-30T03:41:14.719Z weekly 0.8 https://huntrule.com/rules/kapeka-backdoor-scheduled-task-creation-on-windows-security-event-4698-6c130acd 2026-07-30T03:41:13.263Z weekly 0.8 https://huntrule.com/rules/windows-registry-seed-value-under-cryptography-providers-path-persistence-cbaa3ef3 2026-07-30T03:41:11.411Z weekly 0.8 https://huntrule.com/rules/kapeka-backdoor-autorun-registry-persistence-on-windows-run-keys-c0c67b21 2026-07-30T03:41:09.552Z weekly 0.8 https://huntrule.com/rules/kapeka-backdoor-execution-via-rundll32-exe-with-ordinal-export-1-and-d-argument--e98f741c 2026-07-30T03:41:07.976Z weekly 0.8 https://huntrule.com/rules/windows-kapeka-backdoor-persistence-via-schtasks-or-run-registry-key-64a871dd 2026-07-30T03:41:06.154Z weekly 0.8 https://huntrule.com/rules/windows-kapeka-backdoor-loaded-via-rundll32-exe-a7e6b1f9 2026-07-30T03:41:04.337Z weekly 0.8 https://huntrule.com/rules/windows-file-drop-indicator-for-kapeka-decrypted-backdoor-wll-in-appdata-common--20228d05 2026-07-30T03:41:02.722Z weekly 0.8 https://huntrule.com/rules/windows-registry-zonemap-proxy-policy-tampering-via-setvaluekeyint-16a4c7b3 2026-07-30T03:41:00.800Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-shell32-control-rundll-execution-of-user-temp-cpl-92020b88 2026-07-30T03:40:59.109Z weekly 0.8 https://huntrule.com/rules/potential-oleview-and-aclui-dll-side-loading-on-windows-0f3a9db2 2026-07-30T03:40:57.190Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-more-com-spawning-vbc-exe-lummac-stealer-behavior-19b3806e 2026-07-30T03:40:55.644Z weekly 0.8 https://huntrule.com/rules/windows-registry-winlogon-shell-modification-using-powershell-like-values-c9b86500 2026-07-30T03:40:54.116Z weekly 0.8 https://huntrule.com/rules/windows-schtasks-exe-weekly-task-creation-with-forced-user-shutdown-command-fe9e8ba9 2026-07-30T03:40:52.403Z weekly 0.8 https://huntrule.com/rules/windows-winword-start-menu-shortcut-via-cmd-exe-launching-a-doc-lnk-24474469 2026-07-30T03:40:50.661Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-targeting-rat-client-config-files-in-roaming-appdata-2f3039c8 2026-07-30T03:40:48.869Z weekly 0.8 https://huntrule.com/rules/windows-file-events-darkgate-loader-drop-and-execute-via-c-temp-autoit-artifacts-df49c691 2026-07-30T03:40:46.926Z weekly 0.8 https://huntrule.com/rules/potential-csharp-streamer-rat-net-image-loaded-from-temp-tmp-path-windows-6f6afac3 2026-07-30T03:40:45.313Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-cmd-exe-and-powershell-encodedcommand-from-c-f007b877 2026-07-30T03:40:43.767Z weekly 0.8 https://huntrule.com/rules/windows-application-error-possible-cve-2024-49113-ldap-nightmare-attempt-lsass-e-3f2c93c7 2026-07-30T03:40:41.937Z weekly 0.8 https://huntrule.com/rules/windows-security-suspicious-updates-to-domain-group-esx-admins-47a1658b 2026-07-30T03:40:39.779Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-net-exe-or-powershell-creates-esx-admins-domain-group-c408acfe 2026-07-30T03:40:38.177Z weekly 0.8 https://huntrule.com/rules/windows-imageload-suspicious-ksproxy-ax-loading-potential-cve-2024-35250-activit-17ce9373 2026-07-30T03:40:36.105Z weekly 0.8 https://huntrule.com/rules/palo-alto-globalprotect-os-command-injection-indicators-via-cve-2024-3400-f130a5f1 2026-07-30T03:40:34.384Z weekly 0.8 https://huntrule.com/rules/palo-alto-globalprotect-file-creation-indicators-of-cve-2024-3400-os-command-inj-bcd95697 2026-07-30T03:40:32.495Z weekly 0.8 https://huntrule.com/rules/linux-suspicious-root-shell-spawned-by-sshd-suggesting-cve-2024-3094-exploitatio-9aa27839 2026-07-30T03:40:30.715Z weekly 0.8 https://huntrule.com/rules/windows-screenconnect-service-modifies-temporary-xml-user-database-files-4109cb6a 2026-07-30T03:40:29.141Z weekly 0.8 https://huntrule.com/rules/webserver-detection-of-screenconnect-setupwizard-authentication-bypass-exploitat-d27eabad 2026-07-30T03:40:27.552Z weekly 0.8 https://huntrule.com/rules/windows-file-modification-of-screenconnect-temporary-xml-user-database-1a821580 2026-07-30T03:40:26.134Z weekly 0.8 https://huntrule.com/rules/progress-kemp-loadmaster-unauthenticated-command-injection-exploitation-via-acce-eafb8bd5 2026-07-30T03:40:20.727Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-of-named-binaries-commonly-used-for-seaspy-deployment-f6a711f3 2026-07-30T03:40:19.073Z weekly 0.8 https://huntrule.com/rules/linux-process-execution-wget-downloading-tar-via-untrusted-ip-with-certificate-b-23835beb 2026-07-30T03:40:17.420Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-wget-downloads-zip-rar-from-temp-sh-60d050c4 2026-07-30T03:40:15.644Z weekly 0.8 https://huntrule.com/rules/linux-openssl-s-client-connection-to-ip-port-for-ssl-certificate-exfiltration-60911c07 2026-07-30T03:40:13.973Z weekly 0.8 https://huntrule.com/rules/linux-file-indicators-matching-suspected-barracuda-esg-exploitation-artifacts-5627c337 2026-07-30T03:40:12.004Z weekly 0.8 https://huntrule.com/rules/linux-file-creation-with-mail-tmp-3-alnum-3-digits-tar-gz-pattern-0785f462 2026-07-30T03:40:10.288Z weekly 0.8 https://huntrule.com/rules/proxy-log-detection-of-get-requests-to-api-core-command-init-restart-paths-b8225208 2026-07-30T03:40:08.676Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-with-specific-suspicious-command-line-string-2e7bbd54 2026-07-30T03:40:07.147Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-child-processes-spawned-by-pc-app-exe-0934ac71 2026-07-30T03:40:05.804Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-powershell-downloads-setup-msi-via-invoke-webrequest-fo-de1bd0b6 2026-07-30T03:40:04.301Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-adfs-inetmgr-exe-path-used-by-onyx-sleet-2fef4fd9 2026-07-30T03:40:02.558Z weekly 0.8 https://huntrule.com/rules/okta-user-created-activated-for-svc-network-backup-account-00a8e92a 2026-07-30T03:40:01.168Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-command-line-used-for-solidpdfcreator-dll-copy-and-run--7806bb49 2026-07-30T03:39:59.696Z weekly 0.8 https://huntrule.com/rules/windows-manageengine-servicedesk-java-parent-spawns-suspicious-powershell-or-cre-58d8341a 2026-07-30T03:39:58.191Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-wstomcatservice-exe-parent-spawning-processes-log4j-wst-7c97c625 2026-07-30T03:39:56.111Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-asperafaspex-parent-spawning-suspicious-powershell-lsas-91048c0d 2026-07-30T03:39:54.553Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-imageloaded-from-programshared-programdata-and-arm-p-24007168 2026-07-30T03:39:52.412Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-sysaid-user-exe-hash-based-malware-loader-execution-745ea50b 2026-07-30T03:39:50.634Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-powershell-downloadstring-used-to-fetch-cobalt-strike-aa5b0a40 2026-07-30T03:39:48.965Z weekly 0.8 https://huntrule.com/rules/windows-powershell-launcher-script-referencing-sysaid-tomcat-paths-and-user-exe--37dc5463 2026-07-30T03:39:47.452Z weekly 0.8 https://huntrule.com/rules/windows-powershell-evidence-cleanup-script-with-cleanll-and-while-1-loop-b377ddab 2026-07-30T03:39:45.597Z weekly 0.8 https://huntrule.com/rules/windows-powershell-script-file-creation-targeting-specific-sysaidserver-user-fil-e94486ea 2026-07-30T03:39:43.934Z weekly 0.8 https://huntrule.com/rules/windows-powershell-scriptblock-execution-matching-powertrash-indicators-4e19528a 2026-07-30T03:39:40.414Z weekly 0.8 https://huntrule.com/rules/windows-powershell-scriptblock-executing-powerhold-like-logic-via-wscript-71c432c4 2026-07-30T03:39:38.906Z weekly 0.8 https://huntrule.com/rules/windows-powershell-script-file-creation-with-64refl-ps1-or-host-ip-ps1-a88d9f45 2026-07-30T03:39:36.991Z weekly 0.8 https://huntrule.com/rules/proxy-traffic-to-suspect-c2-domains-matching-operation-triangulation-beaconing-i-aa03c712 2026-07-30T03:39:35.366Z weekly 0.8 https://huntrule.com/rules/potential-operation-triangulation-dns-c2-beaconing-to-known-domains-7fc30d63 2026-07-30T03:39:33.897Z weekly 0.8 https://huntrule.com/rules/windows-security-event-4698-scheduled-task-creation-for-teamcity-settings-ui-3b8e5084 2026-07-30T03:39:32.337Z weekly 0.8 https://huntrule.com/rules/windows-registry-event-scheduled-taskcache-tree-key-creation-for-teamcity-exploi-9f9f92ba 2026-07-30T03:39:30.554Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detects-command-line-string-utynkfkxhizrx3kj-b5495d8d 2026-07-30T03:39:29.111Z weekly 0.8 https://huntrule.com/rules/windows-dll-sideloading-via-programdata-clip-exe-wsmprovhost-exe-imageload-d1b65d98 2026-07-30T03:39:27.312Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-indicators-for-programdata-payloads-e1212b32 2026-07-30T03:39:25.578Z weekly 0.8 https://huntrule.com/rules/windows-dns-query-detection-for-diamond-sleet-related-domains-fba38e0f 2026-07-30T03:39:24.230Z weekly 0.8 https://huntrule.com/rules/windows-task-scheduler-svr-graphicalproton-known-malicious-scheduled-task-names-2bfc1373 2026-07-30T03:39:22.399Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-creation-using-svr-specific-task-names-8fa65166 2026-07-30T03:39:20.943Z weekly 0.8 https://huntrule.com/rules/windows-imageload-of-svr-graphicalproton-backdoor-dll-names-e64c8ef3 2026-07-30T03:39:19.180Z weekly 0.8 https://huntrule.com/rules/proxy-web-requests-downloading-ico-from-3cxdesktopapp-icon-storage-potential-c2--76bc1601 2026-07-30T03:39:17.513Z weekly 0.8 https://huntrule.com/rules/proxy-logs-potential-beaconing-to-3cx-related-domains-3c4b3bbf 2026-07-30T03:39:15.954Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-3cxdesktopapp-updater-fetching-known-compromised-update-e7581747 2026-07-30T03:39:14.452Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-child-processes-spawned-by-3cxdesktopapp-exe-63f3605b 2026-07-30T03:39:07.334Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-of-known-compromised-3cxdesktopapp-binaries-by-hash-93bbde78 2026-07-30T03:39:05.580Z weekly 0.8 https://huntrule.com/rules/windows-dll-load-triggered-by-known-compromised-3cxdesktopapp-module-hashes-d0b65ad3 2026-07-30T03:38:47.087Z weekly 0.8 https://huntrule.com/rules/windows-wscript-initiated-dns-queries-to-regex-matched-domains-potential-c2-70761fe8 2026-07-30T03:38:27.431Z weekly 0.8 https://huntrule.com/rules/windows-cmd-exe-redirection-to-appdata-temp-bin-during-explorer-initiated-execut-7aaa5739 2026-07-30T03:38:25.892Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-for-werfaultsvc-from-winsxs-werfault-exe-b2e60816 2026-07-30T03:38:24.281Z weekly 0.8 https://huntrule.com/rules/windows-registry-persistence-uncommon-wav-openwithprogids-value-creation-7e163e96 2026-07-30T03:38:22.382Z weekly 0.8 https://huntrule.com/rules/windows-registry-events-targeting-security-policy-secrets-for-snake-malware-pers-d0fa35db 2026-07-30T03:38:20.661Z weekly 0.8 https://huntrule.com/rules/windows-service-werfault-child-process-from-winsxs-path-f7536642 2026-07-30T03:38:19.156Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detect-jpinst-exe-jpsetup-exe-binary-used-in-snake-inst-d91ff53f 2026-07-30T03:38:17.705Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-jpsetup-exe-cli-argument-hash-iv-sequence-indicator-02cbc035 2026-07-30T03:38:14.731Z weekly 0.8 https://huntrule.com/rules/windows-file-event-non-system-creation-of-werfault-exe-in-winsxs-64827580 2026-07-30T03:38:13.136Z weekly 0.8 https://huntrule.com/rules/windows-file-events-snake-malware-installer-filename-indicators-99eccc2b 2026-07-30T03:38:11.580Z weekly 0.8 https://huntrule.com/rules/windows-file-create-write-indicator-for-snake-kernel-driver-comadmin-dat-d6d9d23f 2026-07-30T03:38:10.035Z weekly 0.8 https://huntrule.com/rules/rorschach-ransomware-execution-behavior-on-windows-via-command-line-indicators-0e9e6c63 2026-07-30T03:38:07.877Z weekly 0.8 https://huntrule.com/rules/windows-detect-rundll32-launching-nsis-module-via-nsis-uns-5cdbc2e8 2026-07-30T03:38:05.901Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-of-qakbot-uninstaller-qbotuninstall-exe-bc309b7a 2026-07-30T03:38:04.158Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-rundll32-executed-dll-like-path-without-dll-extension-bfd34392 2026-07-30T03:38:02.401Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-qakbot-like-rundll32-exports-via-script-or-cmd-parent-339ed3d6 2026-07-30T03:38:00.969Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-exe-launched-via-lolbin-chain-from-cmd-cscript-powershell-mshta-cf879ffb 2026-07-30T03:37:59.320Z weekly 0.8 https://huntrule.com/rules/windows-regsvr32-execution-with-s-and-calc-keyword-0033cf83 2026-07-30T03:37:57.255Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-exe-launched-with-non-dll-extension-via-lolbin-parents-1bf0ba65 2026-07-30T03:37:55.800Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-parent-with-select-binary-execution-indicative-of-process-hollo-d8937fe7 2026-07-30T03:37:53.940Z weekly 0.8 https://huntrule.com/rules/windows-process-discovery-commands-triggered-via-rundll32-and-search-host-parent-698d4431 2026-07-30T03:37:52.200Z weekly 0.8 https://huntrule.com/rules/windows-cmd-exe-suspicious-command-chains-indicative-of-pikabot-style-execution-e5144106 2026-07-30T03:37:50.488Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-executes-1-dll-dllregisterserver-via-single-digit-dll-2bd8e100 2026-07-30T03:37:47.171Z weekly 0.8 https://huntrule.com/rules/guloader-activity-injected-browser-parent-spawns-rundll32-exe-on-windows-89e1490f 2026-07-30T03:37:45.377Z weekly 0.8 https://huntrule.com/rules/windows-process-command-line-matches-griffon-malware-execution-pattern-bcc6f179 2026-07-30T03:37:43.252Z weekly 0.8 https://huntrule.com/rules/windows-local-user-creation-via-net-exe-using-darkgate-and-safemode-arguments-bf906d7b 2026-07-30T03:37:41.633Z weekly 0.8 https://huntrule.com/rules/windows-autoit3-exe-execution-with-suspicious-parent-process-f8e9aa1c 2026-07-30T03:37:39.902Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-autoit3-exe-by-curl-exe-or-other-uncommon-parent-proces-1a433e1d 2026-07-30T03:37:38.106Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-via-service-control-manager-7045-with-svchost-exe-image-3ced239c 2026-07-30T03:37:36.235Z weekly 0.8 https://huntrule.com/rules/windows-registry-set-new-user-profile-created-with-anonymous-and-domainuser-mark-95214813 2026-07-30T03:37:34.488Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-svchost-exe-with-specific-k-flags-9f9cd389 2026-07-30T03:37:32.624Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-cleanup-export-execution-from-svchost-msupdate-services-88516f06 2026-07-30T03:37:31.138Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-by-anonymous-user-with-system32-appdata-parent-image-e01b6eb5 2026-07-30T03:37:29.262Z weekly 0.8 https://huntrule.com/rules/windows-svchost-exe-loads-suspicious-dll-from-appdata-roaming-potential-persiste-1d7a57da 2026-07-30T03:37:27.192Z weekly 0.8 https://huntrule.com/rules/windows-persistence-via-appdata-roaming-newdev-dll-file-creation-1fea93a2 2026-07-30T03:37:25.689Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-dllhost-exe-in-public-documents-for-coldsteel-rat-varia-c708a93f 2026-07-30T03:37:24.019Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-potential-pre-auth-rce-exploitation-via-dhcpserver-svch-6d5b8176 2026-07-30T03:37:22.302Z weekly 0.8 https://huntrule.com/rules/webserver-logs-possible-cve-2023-4966-probing-on-citrix-adc-via-long-host-header-a4e068b5 2026-07-30T03:37:19.888Z weekly 0.8 https://huntrule.com/rules/webserver-logs-detect-cve-2023-4966-probing-on-citrix-adc-netscaler-oidc-endpoin-87c83d8e 2026-07-30T03:37:18.050Z weekly 0.8 https://huntrule.com/rules/citrix-adc-proxy-logs-cve-2023-4966-sensitive-info-disclosure-probe-via-oidc-con-ff349b81 2026-07-30T03:37:16.073Z weekly 0.8 https://huntrule.com/rules/citrix-adc-proxy-get-to-oauth-openid-configuration-with-excessive-host-header-le-aee7681f 2026-07-30T03:37:14.342Z weekly 0.8 https://huntrule.com/rules/f5-big-ip-webserver-rce-exploit-indicators-post-mgmt-tm-util-bash-and-tmui-form--e9928831 2026-07-30T03:37:12.391Z weekly 0.8 https://huntrule.com/rules/f5-big-ip-proxy-exploitation-attempt-targeting-mgmt-tm-util-bash-cve-2023-46747-f195b2ff 2026-07-30T03:37:10.685Z weekly 0.8 https://huntrule.com/rules/web-exploitation-attempt-of-cve-2023-46214-against-splunk-enterprise-via-insecur-ba5268de 2026-07-30T03:37:08.821Z weekly 0.8 https://huntrule.com/rules/possible-cve-2023-46214-rce-probe-against-splunk-enterprise-via-xsl-post-request-04017cd5 2026-07-30T03:37:06.838Z weekly 0.8 https://huntrule.com/rules/webserver-access-logs-indicate-potential-cve-2023-43261-exploitation-and-informa-a2bcca38 2026-07-30T03:37:04.507Z weekly 0.8 https://huntrule.com/rules/proxy-get-requests-targeting-lang-log-httpd-log-for-cve-2023-43261-disclosure-f48f5368 2026-07-30T03:37:02.571Z weekly 0.8 https://huntrule.com/rules/windows-winrar-exe-application-error-crash-with-version-below-6-23-e5a29b54 2026-07-30T03:37:00.796Z weekly 0.8 https://huntrule.com/rules/windows-winrar-rev-file-creation-potential-exploitation-cve-2023-40477-c3bd6c55 2026-07-30T03:36:58.910Z weekly 0.8 https://huntrule.com/rules/suspicious-winrar-child-process-execution-attempt-cve-2023-38331-on-windows-ec3a3c2f 2026-07-30T03:36:56.046Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-suspicious-double-extension-filename-with-space-via-winrar-e4556676 2026-07-30T03:36:54.039Z weekly 0.8 https://huntrule.com/rules/windows-file-share-access-mshtml-c7-with-ip-like-naming-pattern-3df95076 2026-07-30T03:36:52.251Z weekly 0.8 https://huntrule.com/rules/http-get-requests-containing-mshtml-c7-url-marker-proxy-e59f71ff 2026-07-30T03:36:50.412Z weekly 0.8 https://huntrule.com/rules/suspicious-proxy-get-requests-for-file-download-paths-indicative-of-cve-2023-368-6af1617f 2026-07-30T03:36:48.773Z weekly 0.8 https://huntrule.com/rules/detects-suspicious-proxy-get-requests-targeting-ip-parameters-in-url-query-strin-d9365e39 2026-07-30T03:36:46.850Z weekly 0.8 https://huntrule.com/rules/proxy-detection-of-get-requests-targeting-mshtml-c7-with-ip-parameter-0066d244 2026-07-30T03:36:45.055Z weekly 0.8 https://huntrule.com/rules/windows-office-recent-folder-file-drop-c-users-recent-file001-url-8023d3a2 2026-07-30T03:36:36.743Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-renamed-cmd-powershell-powershell-ise-as-wermgr-exe-50dbc08b 2026-07-30T03:36:35.023Z weekly 0.8 https://huntrule.com/rules/windows-detect-creation-of-fake-wermgr-exe-in-uncommon-directories-ad0960eb 2026-07-30T03:36:33.321Z weekly 0.8 https://huntrule.com/rules/windows-wer-report-wer-creation-in-uncommon-reportarchive-subfolders-possible-cv-92389a99 2026-07-30T03:36:31.570Z weekly 0.8 https://huntrule.com/rules/webserver-get-requests-to-moveit-human2-aspx-paths-indicating-cve-2023-34362-exp-435e41f2 2026-07-30T03:36:29.720Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-csc-exe-launched-by-w3wp-exe-for-moveit-pool-39ac1fb0 2026-07-30T03:36:28.169Z weekly 0.8 https://huntrule.com/rules/windows-file-event-indicators-of-moveit-transfer-cve-2023-34362-exploitation-art-c3b2a774 2026-07-30T03:36:26.355Z weekly 0.8 https://huntrule.com/rules/fortigate-web-logs-indicators-of-cve-2023-27997-exploitation-attempt-31e4e649 2026-07-30T03:36:24.361Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-hta-file-creation-in-startup-folder-by-foxitpdfreader-exe-9cae055f 2026-07-30T03:36:22.400Z weekly 0.8 https://huntrule.com/rules/ruckus-wireless-admin-http-get-injection-attempt-likely-targeting-cve-2023-25717-043c1609 2026-07-30T03:36:20.870Z weekly 0.8 https://huntrule.com/rules/potential-geoserver-sql-injection-exploitation-attempt-via-ows-cql-filter-c0341543 2026-07-30T03:36:19.160Z weekly 0.8 https://huntrule.com/rules/joomla-web-endpoint-get-requests-matching-cve-2023-23752-exploitation-parameters-0e1ebc5a 2026-07-30T03:36:17.424Z weekly 0.8 https://huntrule.com/rules/windows-smb-client-failed-smb-session-network-connections-to-internet-facing-ser-de96b824 2026-07-30T03:36:15.893Z weekly 0.8 https://huntrule.com/rules/windows-outlook-exe-registry-query-for-webclient-lanmanworkstation-network-provi-73c59189 2026-07-30T03:36:14.248Z weekly 0.8 https://huntrule.com/rules/windows-registry-changes-for-outlook-task-note-reminder-trigger-fc06e655 2026-07-30T03:36:12.393Z weekly 0.8 https://huntrule.com/rules/linux-sshd-flag-failed-curve25519-key-generation-suggesting-libssh-authenticatio-8b244735 2026-07-30T03:36:10.719Z weekly 0.8 https://huntrule.com/rules/confluence-webserver-cve-2023-22518-post-requests-to-vulnerable-setup-restore-en-a902d249 2026-07-30T03:36:08.823Z weekly 0.8 https://huntrule.com/rules/proxy-http-post-to-confluence-setup-and-admin-json-endpoints-cve-2023-22518-27d2cdde 2026-07-30T03:36:06.835Z weekly 0.8 https://huntrule.com/rules/suspicious-confluence-child-process-spawning-cmd-exe-or-powershell-on-windows-1ddaa9a4 2026-07-30T03:36:04.995Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-indicators-for-cve-2023-22518-confluence-exploitation-via-f8987c03 2026-07-30T03:36:03.257Z weekly 0.8 https://huntrule.com/rules/windows-msmq-corrupted-packet-detected-event-id-2027-ae94b10d 2026-07-30T03:36:01.217Z weekly 0.8 https://huntrule.com/rules/cisco-ios-xe-web-ui-exploitation-indicators-for-cve-2023-20198-2ece8816 2026-07-30T03:35:59.580Z weekly 0.8 https://huntrule.com/rules/potential-unauthenticated-command-injection-attempts-via-tp-link-archer-ax21-cgi-6c7defa9 2026-07-30T03:35:57.783Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detects-suspicious-powershell-command-line-for-mercury--a62298a3 2026-07-30T03:35:56.134Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-scheduled-task-persistence-via-schtasks-create-and-vbsc-e1118a8f 2026-07-30T03:35:54.437Z weekly 0.8 https://huntrule.com/rules/windows-mssql-extended-stored-procedure-execution-with-providername-mssqlserver--711ab2fe 2026-07-30T03:35:52.590Z weekly 0.8 https://huntrule.com/rules/windows-socgholish-fakeupdates-execution-via-wscript-launching-cmd-or-powershell-97805087 2026-07-30T03:35:50.841Z weekly 0.8 https://huntrule.com/rules/windows-scheduled-task-payload-execution-via-cmd-powershell-system-eventid-wrapp-d5eb7432 2026-07-30T03:35:48.913Z weekly 0.8 https://huntrule.com/rules/windows-process-command-lines-referencing-dot-suffixed-file-paths-a35c97c8 2026-07-30T03:35:47.188Z weekly 0.8 https://huntrule.com/rules/windows-process-raspberry-robin-initial-execution-via-cmd-exe-launching-msiexec--2c6bea3a 2026-07-30T03:35:45.624Z weekly 0.8 https://huntrule.com/rules/windows-raspberry-robin-command-execution-via-fodhelper-rundll32-and-regsvr32-d52d2e87 2026-07-30T03:35:43.418Z weekly 0.8 https://huntrule.com/rules/windows-process-patterns-indicating-hermetic-wiper-style-execution-and-powershel-2f974656 2026-07-30T03:35:41.387Z weekly 0.8 https://huntrule.com/rules/windows-lnk-emotet-loader-execution-via-cmd-powershell-process-creation-1f32d820 2026-07-30T03:35:39.799Z weekly 0.8 https://huntrule.com/rules/windows-chromeloader-execution-via-scheduled-task-and-chrome-extension-loading-0a74c5a9 2026-07-30T03:35:38.017Z weekly 0.8 https://huntrule.com/rules/windows-remote-thread-creation-via-rundll32-exe-from-wabmig-exe-or-wab-exe-994cac2b 2026-07-30T03:35:36.137Z weekly 0.8 https://huntrule.com/rules/windows-access-to-bluesky-files-and-shares-used-in-bluesky-ransomware-artifacts-eee8311f 2026-07-30T03:35:34.492Z weekly 0.8 https://huntrule.com/rules/detects-web-exploitation-attempts-against-cacti-remote-agent-php-cve-2022-46169--738cb115 2026-07-30T03:35:32.361Z weekly 0.8 https://huntrule.com/rules/possible-centos-web-panel-7-rce-probe-via-post-login-index-php-1b2eeb27 2026-07-30T03:35:30.573Z weekly 0.8 https://huntrule.com/rules/fortios-sslvpnd-cve-2022-42475-exploitation-indicators-via-sensitive-file-paths-293ccb8c 2026-07-30T03:35:28.873Z weekly 0.8 https://huntrule.com/rules/windows-sysmon-process-creation-where-sysmon-spawned-a-child-process-6d1058a4 2026-07-30T03:35:27.247Z weekly 0.8 https://huntrule.com/rules/owa-ssrf-exploitation-attempt-via-webserver-post-to-owa-mastermailbox-and-powers-92d78c63 2026-07-30T03:35:25.549Z weekly 0.8 https://huntrule.com/rules/possible-owassrf-exploitation-attempt-via-exchange-owa-backend-webserver-181f49fa 2026-07-30T03:35:23.835Z weekly 0.8 https://huntrule.com/rules/owa-ssrf-exploitation-attempt-via-proxy-to-owa-mastermailbox-and-powershell-fdd7e904 2026-07-30T03:35:22.045Z weekly 0.8 https://huntrule.com/rules/proxy-http-post-to-owa-powershell-backend-with-encoded-user-info-owassrf-1ddf4596 2026-07-30T03:35:20.058Z weekly 0.8 https://huntrule.com/rules/windows-system-event-42-kerberos-kdc-rc4-hmac-downgrade-exploit-activity-cve-202-e6f81941 2026-07-30T03:35:18.344Z weekly 0.8 https://huntrule.com/rules/atlassian-bitbucket-archive-api-command-injection-attempt-cve-2022-36804-in-web--65c0a0ab 2026-07-30T03:35:16.340Z weekly 0.8 https://huntrule.com/rules/apache-spark-shell-command-injection-attempt-in-web-server-logs-doas-1a9a04fd 2026-07-30T03:35:14.719Z weekly 0.8 https://huntrule.com/rules/linux-processcreation-apache-spark-shell-command-injection-indicators-via-id-gn-c8a5f584 2026-07-30T03:35:12.999Z weekly 0.8 https://huntrule.com/rules/potential-cve-2022-31659-rce-activity-via-post-to-workspace-one-access-tenant-mi-efdb2003 2026-07-30T03:35:11.350Z weekly 0.8 https://huntrule.com/rules/webserver-attempts-exploiting-cve-2022-31656-in-vmware-workspace-one-access-fcf1101d 2026-07-30T03:35:09.628Z weekly 0.8 https://huntrule.com/rules/windows-registry-suspicious-hkcr-ms-msdt-setvalue-for-msdt-protocol-2d9403d5 2026-07-30T03:35:07.958Z weekly 0.8 https://huntrule.com/rules/linux-nimbuspwn-path-traversal-attempts-targeting-networkd-dispatcher-7ba05b43 2026-07-30T03:35:06.094Z weekly 0.8 https://huntrule.com/rules/windows-suspicious-command-execution-spawned-by-7zfm-exe-for-cve-2022-29072-9a4ccd1a 2026-07-30T03:35:04.384Z weekly 0.8 https://huntrule.com/rules/zimbra-webmail-server-unauthenticated-post-to-mboximport-backup-servlet-leading--dd218fb6 2026-07-30T03:35:02.582Z weekly 0.8 https://huntrule.com/rules/windows-svchost-rpcss-service-spawns-suspicious-child-process-attempt-a7cd7306 2026-07-30T03:35:00.832Z weekly 0.8 https://huntrule.com/rules/linux-process-creation-atlassian-confluence-spawning-shell-utility-child-process-7fb14105 2026-07-30T03:34:58.826Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-webadministration-psm1-during-cve-2022-24527-lpe-attemp-e0a41412 2026-07-30T03:34:56.796Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-rule-for-powershell-cmd-spawned-by-prunsrv-exe-vmware-w-5660d8db 2026-07-30T03:34:54.916Z weekly 0.8 https://huntrule.com/rules/windows-user-profiles-service-events-1511-indicating-possible-lpe-attempts-tied--52a85084 2026-07-30T03:34:52.474Z weekly 0.8 https://huntrule.com/rules/webserver-detect-post-attempts-to-oracle-e-business-suite-uueupload-endpoints-cv-d033cb8a 2026-07-30T03:34:50.668Z weekly 0.8 https://huntrule.com/rules/windows-queuejumper-exploitation-attempt-via-mqsvc-exe-spawning-scripting-and-ut-53207cc2 2026-07-30T03:34:48.911Z weekly 0.8 https://huntrule.com/rules/dewmode-webshell-access-via-uri-parameters-webserver-fdf96c90 2026-07-30T03:34:47.283Z weekly 0.8 https://huntrule.com/rules/windows-process-and-registry-changes-associated-with-sourgum-actor-behaviors-7ba08e95 2026-07-30T03:34:45.714Z weekly 0.8 https://huntrule.com/rules/windows-privatelog-image-load-svchost-exe-loading-clfsw32-dll-33a2d1dd 2026-07-30T03:34:43.940Z weekly 0.8 https://huntrule.com/rules/detects-suspicious-post-requests-targeting-microsoft-exchange-owa-ecp-paths-67bce556 2026-07-30T03:34:40.925Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspected-exchange-server-exploitation-via-file-temp-du-bbb2dedd 2026-07-30T03:34:39.193Z weekly 0.8 https://huntrule.com/rules/windows-registry-run-key-persistence-with-small-sieve-typos-in-value-data-65c6e3c1 2026-07-30T03:34:37.525Z weekly 0.8 https://huntrule.com/rules/proxy-http-get-to-telegram-api-with-small-sieve-indicators-potential-c2-b0422664 2026-07-30T03:34:35.775Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-commandline-ends-with-exe-platypus-indicator-21117127 2026-07-30T03:34:34.181Z weekly 0.8 https://huntrule.com/rules/windows-file-events-detect-small-sieve-typo-based-filename-indicators-and-outloo-39466c42 2026-07-30T03:34:32.131Z weekly 0.8 https://huntrule.com/rules/windows-pingback-backdoor-process-execution-via-updata-exe-with-msdtc-config-sta-b2400ffb 2026-07-30T03:34:30.393Z weekly 0.8 https://huntrule.com/rules/windows-dll-load-of-oci-dll-by-msdtc-exe-for-pingback-backdoor-icmp-tunneling-35a7dc42 2026-07-30T03:34:28.752Z weekly 0.8 https://huntrule.com/rules/windows-file-drop-indicators-for-pingback-backdoor-updata-exe-to-oci-dll-2bd63d53 2026-07-30T03:34:27.085Z weekly 0.8 https://huntrule.com/rules/windows-registry-persistence-indicators-for-netwire-related-keys-1d218616 2026-07-30T03:34:25.529Z weekly 0.8 https://huntrule.com/rules/windows-detect-creation-of-moriyastreamwatchmen-sys-driver-file-a1507d71 2026-07-30T03:34:24.021Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-for-goofy-guineapig-backdoor-persistence-via-rundll32-8c15dd74 2026-07-30T03:34:22.286Z weekly 0.8 https://huntrule.com/rules/proxy-web-requests-to-static-tcplog-com-using-chrome-like-user-agent-for-possibl-4f573bb6 2026-07-30T03:34:20.646Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-googleupdate-exe-self-spawn-from-uncommon-path-bdbab15a 2026-07-30T03:34:19.021Z weekly 0.8 https://huntrule.com/rules/windows-process-commandline-matching-choice-t-d-d-y-n-nul-for-potential-backdoor-477a5ed3 2026-07-30T03:34:17.328Z weekly 0.8 https://huntrule.com/rules/windows-file-ioc-match-for-goofy-guineapig-backdoor-indicators-f0bafe60 2026-07-30T03:34:15.852Z weekly 0.8 https://huntrule.com/rules/windows-foggyweb-backdoor-dll-hijacking-via-loading-version-dll-640dc51c 2026-07-30T03:34:14.222Z weekly 0.8 https://huntrule.com/rules/windows-process-recon-via-wscript-cmd-redirection-to-appdata-devil-bait-e8954be4 2026-07-30T03:34:11.258Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-by-uncommon-processes-in-appdata-roaming-microsoft-txt-xml-93d5f1b4 2026-07-30T03:34:09.249Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-darkside-ransomware-helper-command-line-pattern-965fff6c 2026-07-30T03:34:07.698Z weekly 0.8 https://huntrule.com/rules/windows-sqlcmd-database-dumping-commands-indicative-of-ransomware-activity-2f47f1fd 2026-07-30T03:34:05.865Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detects-vss-shadow-copy-listing-via-vssadmin-7b30e0a7 2026-07-30T03:34:00.384Z weekly 0.8 https://huntrule.com/rules/blackbyte-ransomware-registry-modifications-on-windows-83314318 2026-07-30T03:33:58.760Z weekly 0.8 https://huntrule.com/rules/windows-command-line-indicators-of-blackbyte-ransomware-activity-999e8307 2026-07-30T03:33:57.136Z weekly 0.8 https://huntrule.com/rules/sonicwall-ssl-vpn-jarrewrite-exploit-attempts-via-suspicious-http-query-and-user-6f55f047 2026-07-30T03:33:55.518Z weekly 0.8 https://huntrule.com/rules/windows-systemnightmare-exploitation-attempt-via-printnightmare-cli-indicators-c01f7bd6 2026-07-30T03:33:53.866Z weekly 0.8 https://huntrule.com/rules/windows-process-razerinstaller-explorer-subprocess-with-system-integrity-level-a4eaf250 2026-07-30T03:33:52.234Z weekly 0.8 https://huntrule.com/rules/webserver-activity-indicating-successful-proxyshell-exploit-targeting-exchange-992be1eb 2026-07-30T03:33:50.850Z weekly 0.8 https://huntrule.com/rules/exchange-proxyshell-url-probing-via-autodiscover-json-and-powershell-related-pat-23eee45e 2026-07-30T03:33:48.982Z weekly 0.8 https://huntrule.com/rules/webserver-log-detection-of-log4j-cve-2021-44228-jndi-strings-in-user-agent-uri-q-9be472ed 2026-07-30T03:33:46.832Z weekly 0.8 https://huntrule.com/rules/webserver-detections-for-log4shell-cve-2021-44228-jndi-injection-exploit-strings-5ea8faa8 2026-07-30T03:33:44.839Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-vmware-horizon-tomcat-service-spawning-cmd-exe-or-power-3eb91f0a 2026-07-30T03:33:43.140Z weekly 0.8 https://huntrule.com/rules/windows-file-creation-of-msiexec-exe-under-manageengine-supportcenter-plus-bin-7b501acf 2026-07-30T03:33:41.254Z weekly 0.8 https://huntrule.com/rules/grafana-webserver-path-traversal-exploitation-cve-2021-43798-via-uri-query-7b72b328 2026-07-30T03:33:39.579Z weekly 0.8 https://huntrule.com/rules/windows-msexchange-management-indicators-of-exchange-rce-attempt-for-cve-2021-42-c92f1896 2026-07-30T03:33:37.766Z weekly 0.8 https://huntrule.com/rules/windows-directory-services-sam-account-name-validation-failures-indicative-of-cv-e80a0fee 2026-07-30T03:33:35.622Z weekly 0.8 https://huntrule.com/rules/windows-security-detect-computer-account-renamed-to-missing-suffix-45eb2ae2 2026-07-30T03:33:33.834Z weekly 0.8 https://huntrule.com/rules/windows-kerberos-kdc-pac-requestor-anomaly-cve-2021-42278-exploitation-attempts-44bbff3e 2026-07-30T03:33:31.747Z weekly 0.8 https://huntrule.com/rules/sitecore-pre-auth-rce-exploitation-attempts-via-report-ashx-cve-2021-42237-on-we-20c6ed1c 2026-07-30T03:33:29.913Z weekly 0.8 https://huntrule.com/rules/apache-webserver-path-traversal-attempt-for-cve-2021-41773-patterns-3007fec6 2026-07-30T03:33:28.284Z weekly 0.8 https://huntrule.com/rules/windows-msi-installer-event-logs-for-poc-strings-indicating-cve-2021-41379-explo-7dbb86de 2026-07-30T03:33:26.565Z weekly 0.8 https://huntrule.com/rules/windows-potential-cve-2021-41379-installerfiletakeover-privilege-escalation-atte-af8bbce4 2026-07-30T03:33:24.667Z weekly 0.8 https://huntrule.com/rules/windows-file-create-msiexec-creating-elevation-service-exe-under-edge-applicatio-3be82d5d 2026-07-30T03:33:22.795Z weekly 0.8 https://huntrule.com/rules/detects-cve-2021-40539-zoho-manageengine-adselfservice-plus-rest-api-auth-bypass-fcbb4a77 2026-07-30T03:33:20.999Z weekly 0.8 https://huntrule.com/rules/adselfservice-exploitation-attempts-via-suspicious-web-url-paths-cve-2021-40539-6702b13c 2026-07-30T03:33:19.227Z weekly 0.8 https://huntrule.com/rules/windows-office-applications-spawning-child-processes-with-directory-traversal-st-868955d9 2026-07-30T03:33:17.779Z weekly 0.8 https://huntrule.com/rules/windows-cve-2021-40444-control-exe-and-office-parent-process-exploitation-attemp-894397c6 2026-07-30T03:33:16.216Z weekly 0.8 https://huntrule.com/rules/windows-winword-creates-inetcache-cab-and-temp-inf-files-60c0a111 2026-07-30T03:33:14.133Z weekly 0.8 https://huntrule.com/rules/linux-auth-logs-keyword-match-for-pwnkit-cve-2021-4034-pkexec-exploitation-indic-0506a799 2026-07-30T03:33:12.472Z weekly 0.8 https://huntrule.com/rules/zeek-http-post-to-wsman-without-authorization-header-indicates-omigod-rce-attemp-ab6b1a39 2026-07-30T03:33:10.740Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-serv-u-cve-2021-35211-exploitation-via-whoami-and-clien-75578840 2026-07-30T03:33:08.647Z weekly 0.8 https://huntrule.com/rules/windows-registry-inprocserver32-clsid-targets-indicative-of-cve-2021-31979-33771-32b5db62 2026-07-30T03:33:06.784Z weekly 0.8 https://huntrule.com/rules/windows-file-access-indicators-tied-to-cve-2021-31979-and-cve-2021-33771-exploit-ad7085ac 2026-07-30T03:33:04.849Z weekly 0.8 https://huntrule.com/rules/webserver-telemetry-detects-exchange-proxytoken-exploitation-attempts-targeting--56973b50 2026-07-30T03:33:02.908Z weekly 0.8 https://huntrule.com/rules/microsoft-exchange-exploitation-attempt-behavior-for-cve-2021-28480-via-owa-cale-a2a9d722 2026-07-30T03:33:00.878Z weekly 0.8 https://huntrule.com/rules/potential-cve-2021-27905-exploitation-attempt-against-apache-solr-via-specific-h-0bbcd74b 2026-07-30T03:32:58.765Z weekly 0.8 https://huntrule.com/rules/iis-webserver-ssrf-proxylogon-reset-virtual-directory-via-ecp-setobject-post-effee1f6 2026-07-30T03:32:56.742Z weekly 0.8 https://huntrule.com/rules/windows-exchange-unified-messaging-process-drops-suspicious-files-indicating-cve-b06335b3 2026-07-30T03:32:54.302Z weekly 0.8 https://huntrule.com/rules/windows-exchange-umworkerprocess-subprocess-launching-indicative-of-cve-2021-268-cd479ccc 2026-07-30T03:32:52.435Z weekly 0.8 https://huntrule.com/rules/wazuh-rce-exploitation-attempt-via-traversal-in-manager-files-path-parameter-b9888738 2026-07-30T03:32:50.447Z weekly 0.8 https://huntrule.com/rules/webserver-detects-potential-ognl-injection-exploitation-of-confluence-cve-2021-2-38825179 2026-07-30T03:32:48.901Z weekly 0.8 https://huntrule.com/rules/windows-detect-atlassian-confluence-java-spawning-suspicious-child-processes-cve-245f92e3 2026-07-30T03:32:46.457Z weekly 0.8 https://huntrule.com/rules/pulse-connect-secure-web-exploitation-attempts-matching-cve-2021-22893-uri-patte-5525edac 2026-07-30T03:32:44.495Z weekly 0.8 https://huntrule.com/rules/webserver-rule-fortinet-waf-cve-2021-22123-exploitation-attempt-via-post-to-saml-f425637f 2026-07-30T03:32:42.915Z weekly 0.8 https://huntrule.com/rules/vmware-vcenter-server-file-upload-exploitation-attempt-cve-2021-22005-via-web-po-b014ea07 2026-07-30T03:32:40.811Z weekly 0.8 https://huntrule.com/rules/webserver-post-to-vmware-view-planner-logupload-endpoint-with-cve-2021-21978-pro-77586a7f 2026-07-30T03:32:38.948Z weekly 0.8 https://huntrule.com/rules/webserver-post-to-ui-vropspluginui-rest-services-uploadova-indicates-cve-2021-21-179ed852 2026-07-30T03:32:37.275Z weekly 0.8 https://huntrule.com/rules/webserver-detection-weblogic-jndibindinghandle-ldap-probe-cve-2021-2109-687f6504 2026-07-30T03:32:35.620Z weekly 0.8 https://huntrule.com/rules/arcadyan-router-exploit-attempts-via-web-path-traversal-and-unauthenticated-conf-f0500377 2026-07-30T03:32:33.954Z weekly 0.8 https://huntrule.com/rules/zeek-dce-rpc-remote-printer-driver-and-print-processor-installation-activity-pri-7b33baef 2026-07-30T03:32:31.407Z weekly 0.8 https://huntrule.com/rules/windows-print-spooler-exploitation-unidrv-mimispool-driver-load-in-event-id-316-f34d942d 2026-07-30T03:32:28.158Z weekly 0.8 https://huntrule.com/rules/windows-print-spooler-module-load-failures-indicating-possible-cve-2021-1675-exp-4e64668a 2026-07-30T03:32:26.318Z weekly 0.8 https://huntrule.com/rules/windows-registry-monitoring-for-print-driver-path-names-used-by-mimikatz-ba6b9e43 2026-07-30T03:32:23.740Z weekly 0.8 https://huntrule.com/rules/windows-spooler-spoolsv-exe-loads-dll-from-spool-drivers-subdirectories-02fb90de 2026-07-30T03:32:21.906Z weekly 0.8 https://huntrule.com/rules/windows-file-events-detect-poc-style-print-spooler-filename-targeting-cve-2021-1-2131cfb3 2026-07-30T03:32:19.650Z weekly 0.8 https://huntrule.com/rules/windows-file-deletion-monitoring-for-spooler-driver-folder-dll-removal-5b2bbc47 2026-07-30T03:32:17.742Z weekly 0.8 https://huntrule.com/rules/windows-printernightmare-exploit-file-drop-via-antivirus-detection-6fe1719e 2026-07-30T03:32:16.091Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-winnti-pipemon-setup-exe-command-line-flags-73d70463 2026-07-30T03:32:14.434Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-rule-for-winnti-related-hk-university-campaign-dropped--3121461b 2026-07-30T03:32:12.857Z weekly 0.8 https://huntrule.com/rules/windows-identify-taidoor-rat-dll-load-via-rundll32-command-line-patterns-d1aa3382 2026-07-30T03:32:11.238Z weekly 0.8 https://huntrule.com/rules/solarwinds-supernova-webshell-access-via-logoimagehandler-ashx-requests-a2cee20b 2026-07-30T03:32:09.498Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-inline-vbscript-unc2452-un2452-pattern-20c3f09d 2026-07-30T03:32:07.765Z weekly 0.8 https://huntrule.com/rules/windows-powershell-command-line-pattern-using-wmi-to-launch-rundll32-b7155193 2026-07-30T03:32:06.074Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-7z-archive-with-specific-extensions-via-wscript-and-run-9be34ad0 2026-07-30T03:32:04.255Z weekly 0.8 https://huntrule.com/rules/windows-registry-key-activity-for-run-ntkd-persistence-path-70d43542 2026-07-30T03:32:02.441Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-command-line-patterns-used-in-lazarus-activity-tests-24c4d154 2026-07-30T03:32:00.801Z weekly 0.8 https://huntrule.com/rules/windows-process-executions-associated-with-greenbug-style-powershell-and-reverse-3711eee4 2026-07-30T03:31:59.228Z weekly 0.8 https://huntrule.com/rules/windows-dns-server-analytics-detects-gallium-linked-suspicious-qnames-eventid-25-3db10f25 2026-07-30T03:31:57.564Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-ioc-matching-for-gallium-cyber-espionage-indicators-440a56bf 2026-07-30T03:31:55.617Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-regsvr32-silent-ocx-execution-from-appdata-roaming-8acf3cfa 2026-07-30T03:31:53.899Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-rundll32-exe-launching-wermgr-exe-via-dllregisterserver-58bf96d9 2026-07-30T03:31:51.717Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-indicative-of-maze-ransomware-word-droppers-29fd07fc 2026-07-30T03:31:49.977Z weekly 0.8 https://huntrule.com/rules/windows-registry-hardening-changes-via-process-command-line-indicative-of-ke3cha-7b544661 2026-07-30T03:31:48.168Z weekly 0.8 https://huntrule.com/rules/windows-registry-markers-in-hardware-keys-and-printresponsor-path-5118765f 2026-07-30T03:31:46.297Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-exe-executions-ending-with-rundll-or-control-rundll-54e57ce3 2026-07-30T03:31:44.866Z weekly 0.8 https://huntrule.com/rules/turla-comrat-proxy-http-requests-to-index-php-h-7857f021 2026-07-30T03:31:43.133Z weekly 0.8 https://huntrule.com/rules/windows-registry-change-servicedll-path-ending-in-currentcontrolset-services-wer-92b0b372 2026-07-30T03:31:41.537Z weekly 0.8 https://huntrule.com/rules/windows-service-com-hijack-attempts-via-sc-exe-and-wmic-exe-blue-mockingbird-c3198a27 2026-07-30T03:31:39.799Z weekly 0.8 https://huntrule.com/rules/citrix-adc-netscaler-web-exploitation-indicators-for-cve-2020-8193-and-cve-2020--0d0d9a8a 2026-07-30T03:31:38.190Z weekly 0.8 https://huntrule.com/rules/web-exploit-attempt-f5-big-ip-cve-2020-5902-uri-pattern-44b53b1c 2026-07-30T03:31:36.409Z weekly 0.8 https://huntrule.com/rules/cisco-asa-ftd-web-exploitation-of-cve-2020-3452-http-200-aba47adc 2026-07-30T03:31:34.514Z weekly 0.8 https://huntrule.com/rules/terramaster-tos-cve-2020-28188-web-exploit-attempt-via-suspicious-makecvs-php-ge-15c312b9 2026-07-30T03:31:32.900Z weekly 0.8 https://huntrule.com/rules/oracle-weblogic-exploitation-attempts-via-crafted-console-url-parameters-cve-202-85d466b0 2026-07-30T03:31:31.139Z weekly 0.8 https://huntrule.com/rules/windows-zerologon-poc-execution-via-cmd-exe-launching-cool-exe-or-zero-exe-dcc6a01e 2026-07-30T03:31:29.430Z weekly 0.8 https://huntrule.com/rules/windows-dns-service-dns-exe-process-anomalies-indicating-cve-2020-1350-rce-explo-b5281f31 2026-07-30T03:31:27.550Z weekly 0.8 https://huntrule.com/rules/windows-registry-change-new-print-port-entries-with-executable-script-extensions-7ec912f2 2026-07-30T03:31:25.520Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-add-printerport-commands-with-executable-dll-bat-paths-cc08d590 2026-07-30T03:31:23.646Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-java-deserialization-exploitation-via-desktopcentral-se-846b866e 2026-07-30T03:31:21.805Z weekly 0.8 https://huntrule.com/rules/solarwinds-orion-api-auth-bypass-probing-via-suspicious-webresource-axd-and-i18n-5a35116f 2026-07-30T03:31:19.776Z weekly 0.8 https://huntrule.com/rules/windows-microsoft-exchange-control-panel-error-with-viewstate-parameter-indicati-d6266bf5 2026-07-30T03:31:17.074Z weekly 0.8 https://huntrule.com/rules/microsoft-exchange-exploitation-web-requests-using-ecp-owa-and-viewstate-http-ge-fce2c2e2 2026-07-30T03:31:15.338Z weekly 0.8 https://huntrule.com/rules/webserver-http-request-indicators-for-cve-2020-0688-exploitation-attempts-7c64e577 2026-07-30T03:31:13.790Z weekly 0.8 https://huntrule.com/rules/windows-security-4799-checkadmin-exe-targeting-administrators-during-operation-w-74ad4314 2026-07-30T03:31:11.408Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-wtaks-exe-winwsh-exe-parameters-resembling-mustang-pand-2d87d610 2026-07-30T03:31:07.877Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-export-dll-u-or-trailing-dll-u-in-commandline-d465d1d8 2026-07-30T03:31:05.853Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-jscript-execution-via-temp-errors-bat-10152a7b 2026-07-30T03:31:04.006Z weekly 0.8 https://huntrule.com/rules/proxy-detection-suspicious-chrome-36-user-agent-to-api-dropbox-com-5ba715b6 2026-07-30T03:31:00.405Z weekly 0.8 https://huntrule.com/rules/windows-regsvr32-launches-appdata-local-dlls-referencing-dllentry-bd70d3f8 2026-07-30T03:30:57.162Z weekly 0.8 https://huntrule.com/rules/ursnif-related-registry-key-creation-indicators-on-windows-21f17060 2026-07-30T03:30:55.570Z weekly 0.8 https://huntrule.com/rules/ursnif-dropper-download-url-pattern-via-proxy-php-query-leading-to-cab-with-http-a36ce77e 2026-07-30T03:30:53.959Z weekly 0.8 https://huntrule.com/rules/ursnif-c2-traffic-via-proxy-url-base64-encoded-path-with-avi-image-pattern-932ac737 2026-07-30T03:30:52.009Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-snatch-ransomware-dropper-safe-mode-reboot-indicators-5325945e 2026-07-30T03:30:49.686Z weekly 0.8 https://huntrule.com/rules/windows-process-command-lines-indicative-of-ryuk-style-ransomware-staging-c37510b8 2026-07-30T03:30:47.721Z weekly 0.8 https://huntrule.com/rules/potential-qbot-execution-on-windows-via-wscript-winrar-parent-ping-type-and-regs-4fcac6eb 2026-07-30T03:30:45.948Z weekly 0.8 https://huntrule.com/rules/lockergoga-ransomware-command-line-pattern-windows-process-creation-74db3488 2026-07-30T03:30:44.131Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-formbook-style-exe-command-lines-deleting-dropper-from--032f5fb3 2026-07-30T03:30:42.689Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-emotet-like-powershell-wmi-command-line-indicators-d02e8cf5 2026-07-30T03:30:40.929Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-indicator-for-dtrack-rat-recon-commands-f1531fa4 2026-07-30T03:30:39.192Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-dridex-linked-svchost-and-regsvr32-execution-e6eb5a96 2026-07-30T03:30:37.231Z weekly 0.8 https://huntrule.com/rules/chafer-malware-c2-http-requests-matching-asp-asp-ui-pattern-fb502828 2026-07-30T03:30:35.284Z weekly 0.8 https://huntrule.com/rules/windows-powershell-mshta-command-line-indicators-of-baby-shark-malware-activity-2b30fa36 2026-07-30T03:30:33.852Z weekly 0.8 https://huntrule.com/rules/confluence-web-exploit-attempt-via-path-traversal-in-post-upload-action-cve-2019-e9bc39ae 2026-07-30T03:30:31.871Z weekly 0.8 https://huntrule.com/rules/citrix-netscaler-directory-traversal-attempts-targeting-vpns-portal-scripts-and--ac5a6409 2026-07-30T03:30:30.268Z weekly 0.8 https://huntrule.com/rules/linux-sudo-privilege-escalation-attempt-matching-cve-2019-14287-command-line-pat-f74107df 2026-07-30T03:30:28.319Z weekly 0.8 https://huntrule.com/rules/linux-sudo-cve-2019-14287-exploit-attempt-via-suspicious-user-value-patterns-7fcc54cb 2026-07-30T03:30:26.512Z weekly 0.8 https://huntrule.com/rules/windows-cve-2019-1388-privilege-escalation-via-uac-consent-spawning-internet-exp-02e0b2ea 2026-07-30T03:30:24.999Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-setupcomplete-cmd-partnersetupcomplete-cmd-e-1c373b6d 2026-07-30T03:30:23.138Z weekly 0.8 https://huntrule.com/rules/pulse-secure-exploitation-attempt-cve-2019-11510-via-guacamole-uri-pattern-2dbc10d7 2026-07-30T03:30:21.346Z weekly 0.8 https://huntrule.com/rules/windows-rdp-termdd-error-events-indicating-possible-cve-2019-0708-exploitation-aaa5b30d 2026-07-30T03:30:19.720Z weekly 0.8 https://huntrule.com/rules/windows-security-log-detects-4625-rdp-failure-pattern-from-scanner-poc-for-bluek-8400629e 2026-07-30T03:30:16.733Z weekly 0.8 https://huntrule.com/rules/windows-task-scheduler-schtasks-exe-change-tn-ru-rp-seen-indicating-bearlpe-atte-931b6802 2026-07-30T03:30:14.874Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-commandline-match-for-tropictrooper-campaign-indicators-8c7090c3 2026-07-30T03:30:13.063Z weekly 0.8 https://huntrule.com/rules/windows-security-disabling-scheduled-defrag-task-via-event-id-4701-c5a178bf 2026-07-30T03:30:11.547Z weekly 0.8 https://huntrule.com/rules/windows-schtasks-deletion-modification-of-scheduleddefrag-task-958d81aa 2026-07-30T03:30:09.750Z weekly 0.8 https://huntrule.com/rules/windows-system-service-creation-for-scheduled-scan-and-updatmachine-53ba33fd 2026-07-30T03:30:08.057Z weekly 0.8 https://huntrule.com/rules/windows-security-scheduled-task-persistence-via-4698-for-sc-scheduled-scan-and-u-c0580559 2026-07-30T03:30:06.581Z weekly 0.8 https://huntrule.com/rules/windows-registry-event-oilrig-style-run-key-persistence-via-ume-ut-subkeys-7bdf2a7c 2026-07-30T03:30:04.878Z weekly 0.8 https://huntrule.com/rules/windows-detect-scheduled-task-and-autoit3-exe-activity-consistent-with-oilrig-ma-ce6e34ca 2026-07-30T03:30:03.182Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-mshta-powershell-and-system-survey-behavior-36222790 2026-07-30T03:30:01.091Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-match-commandline-indicators-of-cozy-bear-2018-phishing-7453575c 2026-07-30T03:29:42.616Z weekly 0.8 https://huntrule.com/rules/windows-file-event-indicators-for-ds7002-lnk-ds7002-pdf-and-ds7002-zip-3a3f81ca 2026-07-30T03:29:40.947Z weekly 0.8 https://huntrule.com/rules/windows-rundll32-trojan-loader-command-line-with-appdata-path-ba778144 2026-07-30T03:29:39.131Z weekly 0.8 https://huntrule.com/rules/windows-dll-side-loading-svchost-exe-launched-from-appdata-by-sllauncher-exe-9aa01d62 2026-07-30T03:29:37.403Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-elise-backdoor-related-dll-deletion-and-execution-via-s-e507feb7 2026-07-30T03:29:35.662Z weekly 0.8 https://huntrule.com/rules/webserver-access-to-webshell-in-weblogic-keystore-folder-37e8369b 2026-07-30T03:29:33.784Z weekly 0.8 https://huntrule.com/rules/linux-sshd-buffer-parsing-error-indicative-of-cve-2018-15473-exploit-attempts-4c9d903d 2026-07-30T03:29:32.201Z weekly 0.8 https://huntrule.com/rules/webserver-request-indicates-fortinet-ssl-vpn-path-traversal-attempt-cve-2018-133-a2e97350 2026-07-30T03:29:30.470Z weekly 0.8 https://huntrule.com/rules/windows-service-creation-werfaultsvc-scm-event-7045-for-turla-png-dropper-indica-1228f8e2 2026-07-30T03:29:28.816Z weekly 0.8 https://huntrule.com/rules/windows-service-install-system-event-7045-for-turla-associated-service-names-1df8b3da 2026-07-30T03:29:27.010Z weekly 0.8 https://huntrule.com/rules/windows-named-pipe-creation-matching-turla-associated-pipe-names-739915e4 2026-07-30T03:29:25.337Z weekly 0.8 https://huntrule.com/rules/windows-registry-event-implant-service-key-under-currentcontrolset-services-null-47e0852a 2026-07-30T03:29:23.789Z weekly 0.8 https://huntrule.com/rules/windows-masqueraded-system-binaries-executed-from-non-default-paths-msdtc-exe-gp-3f7f5b0b 2026-07-30T03:29:22.102Z weekly 0.8 https://huntrule.com/rules/firewall-alerts-for-equation-group-c2-ip-communications-881834a4 2026-07-30T03:29:20.462Z weekly 0.8 https://huntrule.com/rules/windows-ps-exe-commandline-renaming-of-sysinternals-pstool-execution-18da1007 2026-07-30T03:29:19.188Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-indicating-cscript-vbscript-and-csvde-web-shell-droppi-966e4016 2026-07-30T03:29:17.563Z weekly 0.8 https://huntrule.com/rules/windows-wannacry-ransomware-process-execution-indicators-41d40bff 2026-07-30T03:29:15.985Z weekly 0.8 https://huntrule.com/rules/windows-service-install-ntssrv-via-service-control-manager-7045-9e987c6c 2026-07-30T03:29:13.196Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-suspicious-plugx-side-loading-executables-from-uncommon-aeab5ec5 2026-07-30T03:29:11.493Z weekly 0.8 https://huntrule.com/rules/windows-notpetya-activity-wevtutil-log-clearing-and-drive-c-usn-delete-via-fsuti-79aeeb41 2026-07-30T03:29:09.897Z weekly 0.8 https://huntrule.com/rules/windows-process-access-verclsid-exe-receiving-shellcode-injection-from-microsoft-b7967e22 2026-07-30T03:29:07.937Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-rundll32-exe-installarchersvc-execution-3d4aebe0 2026-07-30T03:29:06.379Z weekly 0.8 https://huntrule.com/rules/windows-detect-installation-of-javamtsup-service-via-security-event-4697-cb062102 2026-07-30T03:29:04.699Z weekly 0.8 https://huntrule.com/rules/windows-process-execution-javaw-exe-in-appdata-roaming-oracle-path-adwind-jrat-p-1fac1481 2026-07-30T03:29:02.179Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-winword-spawning-csc-exe-sub-process-fdd84c68 2026-07-30T03:29:00.550Z weekly 0.8 https://huntrule.com/rules/windows-cve-2017-11882-droppers-launching-eqnedt32-exe-and-child-processes-678eb5f4 2026-07-30T03:28:58.761Z weekly 0.8 https://huntrule.com/rules/windows-winword-launches-fltldr-exe-for-cve-2017-0261-style-exploitation-864403a1 2026-07-30T03:28:56.568Z weekly 0.8 https://huntrule.com/rules/windows-winword-launching-microscmgmt-exe-for-cve-2015-1641-exploitation-7993792c 2026-07-30T03:28:54.988Z weekly 0.8 https://huntrule.com/rules/windows-process-creation-detect-suspicious-turla-related-command-lines-may-2020-9e2e51c5 2026-07-30T03:28:52.743Z weekly 0.8 https://huntrule.com/rules/windows-zxshell-activity-via-rundll32-exe-using-zxfunction-and-remotediskxxxxx-f0b70adb 2026-07-30T03:28:49.249Z weekly 0.8 https://huntrule.com/rules/rejetto-hfs-exploit-attempt-http-search-query-probing-for-command-or-script-exec-a133193c 2026-07-30T03:28:47.571Z weekly 0.8 https://huntrule.com/rules/web-exploitation-attempt-modx-manager-lfi-traversal-in-tvs-php-class-key-cve-201-a4a899e8 2026-07-30T03:28:45.733Z weekly 0.8 https://huntrule.com/rules/qualys-scan-indicates-firewall-product-not-detected-6b2066c8 2026-07-30T03:28:43.814Z weekly 0.8 https://huntrule.com/rules/qualys-vulnerability-scan-flags-default-credentials-findings-1a395cbc 2026-07-30T03:28:41.987Z weekly 0.8 https://huntrule.com/rules/cleartext-protocol-traffic-on-netflow-ports-indicative-of-credential-exposure-7e4bfe58 2026-07-30T03:28:40.615Z weekly 0.8