sigma-rules/hunting/index.md

List of Available Queries

Here are the queries currently available:

aws

• AWS IAM Customer-Managed Policy Attachment to Existing Roles (ES|QL)
• AWS IAM Unusual AWS Access Key Usage for User (ES|QL)
• EC2 Modify Instance Attribute User Data (ES|QL)
• EC2 Suspicious Get User Password Request (ES|QL)
• High EC2 Instance Deployment Count Attempts by Single User or Role (ES|QL)
• High Frequency of EC2 Multi-Region DescribeInstances API Calls (ES|QL)
• High Frequency of Service Quotas Multi-Region GetServiceQuota API Calls (ES|QL)
• IAM Assume Role Creation with Attached Policy (ES|QL)
• IAM Unusual Default Aviatrix Role Activity (ES|QL)
• IAM User Activity with No MFA Session (ES|QL)
• Lambda Add Permissions for Write Actions to Function (ES|QL)
• Multiple Service Logging Deleted or Stopped (ES|QL)
• S3 Public Bucket Rapid Object Access Attempts (ES|QL)
• SNS Direct-to-Phone Messaging Spike (ES|QL)
• SNS Topic Created by Rare User (ES|QL)
• SNS Topic Message Published by Rare User (ES|QL)
• SNS Topic Subscription with Email by Rare User (ES|QL)
• SSM Rare SendCommand Code Execution by EC2 Instance (ES|QL)
• SSM SendCommand API Used by EC2 Instance (ES|QL)
• SSM Start Remote Session to EC2 Instance (ES|QL)
• STS Suspicious Federated Temporary Credential Request (ES|QL)
• Secrets Manager High Frequency of Programmatic GetSecretValue API Calls (ES|QL)
• Signin Single Factor Console Login via Federated Session (ES|QL)
• User Creation with Administrator Policy Assigned (ES|QL)

azure

• Azure Entra Authentication Attempts from Abused Hosting Service Providers (ES|QL)
• Azure Entra Device Code Authentication from Unusual Principal (ES|QL)
• Azure Entra Excessive Single-Factor Non-Interactive Sign-Ins (ES|QL)
• Azure Entra Unusual Client App Authentication Requests on Behalf of Principal Users (ES|QL)
• Azure Entra Unusual Failed Authentication Attempts Behind Rare User Agents (ES|QL)
• Microsoft Entra ID Rare Service Principal Activity from Multiple IPs (ES|QL)
• Microsoft Entra ID Uncommon IP Adding Credentials to Service Principal (ES|QL)
• Microsoft Entra Infrequent Suspicious OData Client Requests (ES|QL)

cross-platform

• Potential Spoofed microsoftonline.com via Fuzzy Match (ES|QL)

linux

• Defense Evasion via Capitalized Process Execution (ES|QL)
• Drivers Load with Low Occurrence Frequency (ES|QL)
• Excessive SSH Network Activity to Unique Destinations (ES|QL)
• General Kernel Manipulation (ES|QL)
• Git Hook/Pager Persistence (ES|QL)
• Hidden Process Execution (ES|QL)
• Logon Activity by Source IP (ES|QL)
• Low Volume External Network Connections from Process by Unique Agent (ES|QL)
• Low Volume GTFOBins External Network Connections (ES|QL)
• Low Volume Modifications to Critical System Binaries by Unique Host (ES|QL)
• Low Volume Process Injection-Related Syscalls by Process Executable (ES|QL)
• Network Connections with Low Occurrence Frequency for Unique Agent ID (ES|QL)
• OSQuery SUID Hunting (ES|QL)
• Persistence Through Reverse/Bind Shells (ES|QL)
• Persistence via Cron (ES|QL)
• Persistence via DPKG/RPM Package (ES|QL)
• Persistence via Desktop Bus (D-Bus) (ES|QL)
• Persistence via Docker Container (ES|QL)
• Persistence via Dynamic Linker Hijacking (ES|QL)
• Persistence via GRUB Bootloader (ES|QL)
• Persistence via Initramfs (ES|QL)
• Persistence via Loadable Kernel Modules (ES|QL)
• Persistence via Message-of-the-Day (ES|QL)
• Persistence via NetworkManager Dispatcher Script (ES|QL)
• Persistence via Package Manager (ES|QL)
• Persistence via Pluggable Authentication Modules (PAM) (ES|QL)
• Persistence via PolicyKit (ES|QL)
• Persistence via SSH Configurations and/or Keys (ES|QL)
• Persistence via System V Init (ES|QL)
• Persistence via Systemd (Timers) (ES|QL)
• Persistence via Udev (ES|QL)
• Persistence via Web Shell (ES|QL)
• Persistence via rc.local/rc.common (ES|QL)
• Potential Defense Evasion via Multi-Dot Process Execution (ES|QL)
• Privilege Escalation Identification via Existing Sudoers File (ES|QL)
• Privilege Escalation/Persistence via User/Group Creation and/or Modification (ES|QL)
• Process Capability Hunting (ES|QL)
• Segmentation Fault & Potential Buffer Overflow Hunting (ES|QL)
• Shell Modification Persistence (ES|QL)
• Uncommon Process Execution from Suspicious Directory (ES|QL)
• Unusual File Downloads from Source Addresses (ES|QL)
• Unusual System Binary Parent (Potential System Binary Hijacking Attempt) (ES|QL)
• XDG Persistence (ES|QL)

llm

• AWS Bedrock LLM Denial-of-Service or Resource Exhaustion (ES|QL)
• AWS Bedrock LLM Ignore Previous Prompt Detection (ES|QL)
• AWS Bedrock LLM Latency Anomalies (ES|QL)
• AWS Bedrock LLM Sensitive Content Refusals (ES|QL)

macos

• Low Occurrence of Suspicious Launch Agent or Launch Daemon (ES|QL)
• Potential Python Stealer Activity (ES|QL)
• Python Library Load and Delete (ES|QL)
• Python Script Drop and Execute (ES|QL)
• Self-Deleted Python Script Accessing Sensitive Files (ES|QL)
• Self-Deleting Python Script (ES|QL)
• Sensitive File Access via Docker (ES|QL)
• Suspicious Executable File Modification via Docker (ES|QL)
• Suspicious Network Connections by Unsigned Mach-O (ES|QL)
• Suspicious Python App Execution via Streamlit (ES|QL)
• Unsigned or Untrusted Binary Execution via Python (ES|QL)
• Unsigned or Untrusted Binary Forked by Python (ES|QL)
• Unusual Library Load via Python (ES|QL)

okta

• Failed OAuth Access Token Retrieval via Public Client App (ES|QL)
• Identify High Average of Failed Daily Authentication Attempts (ES|QL)
• Multi-Factor Authentication (MFA) Push Notification Bombing (ES|QL)
• Multiple Application SSO Authentication from the Same Source (ES|QL)
• OAuth Access Token Granted for Public Client App from Multiple Client Addresses (ES|QL)
• Password Spraying from Repeat Source (ES|QL)
• Rapid MFA Deny Push Notifications (MFA Bombing) (ES|QL)
• Rapid Reset Password Requests for Different Users (ES|QL)
• Rare Occurrence of Domain with User Authentication Events (ES|QL)
• Rare Occurrence of OAuth Access Token Granted to Public Client App (ES|QL)
• Successful Impossible Travel Sign-On Events (ES|QL)

windows

• DLL Hijack via Masquerading as Microsoft Native Libraries (ES|QL)
• DNS Queries via LOLBins with Low Occurence Frequency (ES|QL)
• Egress Network Connections with Total Bytes Greater than Threshold (ES|QL)
• Excessive RDP Network Activity by Host and User (ES|QL)
• Excessive SMB Network Activity by Process ID (ES|QL)
• Executable File Creation by an Unusual Microsoft Binary (ES|QL)
• Execution via Remote Services by Client Address (ES|QL)
• Frequency of Process Execution via Network Logon by Source Address (ES|QL)
• High Count of Network Connection Over Extended Period by Process (ES|QL)
• Libraries Loaded by svchost with Low Occurrence Frequency (ES|QL)
• Low Frequency of Process Execution via WMI by Unique Agent (ES|QL)
• Low Frequency of Process Execution via Windows Scheduled Task by Unique Agent (ES|QL)
• Low Occurence of Process Execution via Windows Services with Unique Agent (ES|QL)
• Low Occurrence Rate of CreateRemoteThread by Source Process (ES|QL)
• Low Occurrence of Drivers Loaded on Unique Hosts (ES|QL)
• Masquerading Attempts as Native Windows Binaries (ES|QL)
• Microsoft Office Child Processes with Low Occurrence Frequency by Unique Agent (ES|QL)
• Network Discovery via Sensitive Ports by Unusual Process (ES|QL)
• PE File Transfer via SMB_Admin Shares by Agent or User (ES|QL)
• Persistence via Run Key with Low Occurrence Frequency (ES|QL)
• Persistence via Startup with Low Occurrence Frequency by Unique Host (ES|QL)
• Rare DLL Side-Loading by Occurrence (ES|QL)
• Rare LSASS Process Access Attempts (ES|QL)
• Rundll32 Execution Aggregated by Command Line (ES|QL)
• Scheduled Tasks Creation for Unique Hosts by Task Command (ES|QL)
• Scheduled tasks Creation by Action via Registry (ES|QL)
• Startup Execution with Low Occurrence Frequency by Unique Host (ES|QL)
• Suspicious Base64 Encoded Powershell Command (ES|QL)
• Suspicious DNS TXT Record Lookups by Process (ES|QL)
• Unique Windows Services Creation by Service File Name (ES|QL)
• Windows Command and Scripting Interpreter from Unusual Parent Process (ES|QL)
• Windows Logon Activity by Source IP (ES|QL)