sigma-rules

createremotethread_by_source_process_with_low_occurrence.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

detect_masquerading_attempts_as_native_windows_binaries.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

detect_rare_dll_sideload_by_occurrence.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

detect_rare_lsass_process_access_attempts.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

domain_names_queried_via_lolbins_and_with_low_occurence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

drivers_load_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

excessive_rdp_network_activity_by_source_host_and_user.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

excessive_smb_network_activity_by_process_id.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

executable_file_creation_by_an_unusual_microsoft_binary.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_remote_services_by_client_address.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_startup_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_windows_scheduled_task_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

execution_via_windows_services_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

high_count_of_network_connection_over_extended_period_by_process.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

libraries_loaded_by_svchost_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

microsoft_office_child_processes_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

network_discovery_via_sensitive_ports_by_unusual_process.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

pe_file_transfer_via_smb_admin_shares_by_agent.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_run_key_with_low_occurrence_frequency.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

persistence_via_startup_with_low_occurrence_frequency.md

[Hunt] Remove Default Namespace from indexes (#4866 )

2025-07-03 11:08:29 -03:00

potential_exfiltration_by_process_total_egress_bytes.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

rundll32_execution_aggregated_by_cmdline.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

scheduled_task_creation_by_action_via_registry.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

scheduled_tasks_creation_for_unique_hosts_by_task_command.md

[Hunt] Remove Default Namespace from indexes (#4866 )

2025-07-03 11:08:29 -03:00

suspicious_base64_encoded_powershell_commands.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

suspicious_dns_txt_record_lookups_by_process.md

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988 )

2024-09-04 10:08:44 -04:00

unique_windows_services_creation_by_servicefilename.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

windows_command_and_scripting_interpreter_from_unusual_parent.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00

windows_logon_activity_by_source_ip.md

[Bug] Normalize Hunting Index Link Generation (#3872 )

2024-07-10 11:01:59 -04:00