Rule Library

Sigma Rules

3,332 rules found

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionlowtest

Remote Access Tool - ScreenConnect Command Execution

Detects command execution via ScreenConnect RMM

Windowsapplication
TA0002 · ExecutionT1059.003 · Windows Command Shell
Ali AlwashaliTue Oct 10windows
Detectionlowtest

Remote Access Tool - ScreenConnect File Transfer

Detects file being transferred via ScreenConnect RMM

Windowsapplication
TA0002 · ExecutionT1059.003 · Windows Command Shell
Ali AlwashaliTue Oct 10windows
Detectionhightest

Microsoft Malware Protection Engine Crash - WER

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Windowsapplication
TA0005 · Defense EvasionT1211 · Exploitation for Defense EvasionT1562.001 · Disable or Modify Tools
Florian Roth (Nextron Systems)Tue May 09windows
Detectionmediumtest

AppLocker Prevented Application or Script from Running

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Windowsapplocker
TA0002 · ExecutionT1204.002 · Malicious FileT1059.001 · PowerShellT1059.003 · Windows Command Shell+3
Pushkarev DmitrySun Jun 28windows
Detectionlowtest

Sysinternals Tools AppX Versions Execution

Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths.

Windowsappmodel-runtime
TA0005 · Defense EvasionTA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectionmediumtest

Deployment AppX Package Was Blocked By AppLocker

Detects an appx package deployment that was blocked by AppLocker policy.

Windowsappxdeployment-server
TA0005 · Defense Evasion
François HubautWed Jan 11windows
Detectionhightest

Remote AppX Package Downloaded from File Sharing or CDN Domain

Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.

Windowsappxdeployment-server
TA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionmediumtest

AppX Package Deployment Failed Due to Signing Requirements

Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.

Windowsappxdeployment-server
TA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionhightest

AppX Located in Known Staging Directory Added to Deployment Pipeline

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.

Windowsappxdeployment-server
TA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionmediumtest

Potential Malicious AppX Package Installation Attempts

Detects potential installation or installation attempts of known malicious appx packages

Windowsappxdeployment-server
TA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionmediumtest

Deployment Of The AppX Package Was Blocked By The Policy

Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.

Windowsappxdeployment-server
TA0005 · Defense Evasion
François HubautWed Jan 11windows
Detectionmediumtest

AppX Located in Uncommon Directory Added to Deployment Pipeline

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.

Windowsappxdeployment-server
TA0005 · Defense Evasion
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionmediumtest

Suspicious Digital Signature Of AppX Package

Detects execution of AppX packages with known suspicious or malicious signature

Windowsappxpackaging-om
TA0005 · Defense EvasionTA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectionlowtest

New BITS Job Created Via Bitsadmin

Detects the creation of a new bits job by Bitsadmin

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
François HubautTue Mar 01windows
Detectionlowtest

New BITS Job Created Via PowerShell

Detects the creation of a new bits job by PowerShell

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
François HubautTue Mar 01windows
Detectionmediumtest

BITS Transfer Job Downloading File Potential Suspicious Extension

Detects new BITS transfer job saving local files with potential suspicious extensions

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
François HubautTue Mar 01windows
Detectionhightest

BITS Transfer Job Download From File Sharing Domains

Detects BITS transfer job downloading files from a file sharing domain.

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
Florian Roth (Nextron Systems)Tue Jun 28windows
Detectionhightest

BITS Transfer Job Download From Direct IP

Detects a BITS transfer job downloading file(s) from a direct IP address.

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
Nasreddine Bencherchali (Nextron Systems)Wed Jan 11windows
Detectionmediumtest

BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
Florian Roth (Nextron Systems)Fri Jun 10windows
Detectionhightest

BITS Transfer Job Download To Potential Suspicious Folder

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Windowsbits-client
TA0005 · Defense EvasionTA0003 · PersistenceT1197 · BITS Jobs
Florian Roth (Nextron Systems)Tue Jun 28windows
Detectionmediumtest

Certificate Private Key Acquired

Detects when an application acquires a certificate private key

Windowscapi2
TA0006 · Credential AccessT1649 · Steal or Forge Authentication Certificates
Zach MathisSat May 13windows
Detectionmediumtest

Certificate Exported From Local Certificate Store

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Windowscertificateservicesclient-lifecycle-system
TA0006 · Credential AccessT1649 · Steal or Forge Authentication Certificates
Zach MathisSat May 13windows
Detectionhightest

CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Detects block events for files that are disallowed by code integrity for protected processes

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Windowscodeintegrity-operational
TA0003 · PersistenceTA0004 · Privilege EscalationT1543 · Create or Modify System Process
Nasreddine Bencherchali (Nextron Systems)Thu Nov 10windows
Detectionhightest

CodeIntegrity - Blocked Driver Load With Revoked Certificate

Detects blocked load attempts of revoked drivers

Windowscodeintegrity-operational
TA0003 · PersistenceTA0004 · Privilege EscalationT1543 · Create or Modify System Process
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Revoked Kernel Driver Loaded

Detects the load of a revoked kernel driver

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Blocked Image Load With Revoked Certificate

Detects blocked image load events with revoked certificates by code integrity.

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Revoked Image Loaded

Detects image load events with revoked certificates by code integrity.

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Unsigned Kernel Module Loaded

Detects the presence of a loaded unsigned kernel module on the system.

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Unsigned Image Loaded

Detects loaded unsigned image on the system

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Detects loaded kernel modules that did not meet the WHQL signing requirements.

Windowscodeintegrity-operational
TA0004 · Privilege Escalation
Nasreddine Bencherchali (Nextron Systems)Tue Jun 06windows
Detectionhightest

Loading Diagcab Package From Remote Path

Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Windowsdiagnosis-scripted
TA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)Sun Aug 14windows
Detectionhightest

DNS Query for Anonfiles.com Domain - DNS Client

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Windowsdns-client
TA0010 · ExfiltrationT1567.002 · Exfiltration to Cloud Storage
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectioncriticaltest

Suspicious Cobalt Strike DNS Beaconing - DNS Client

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Windowsdns-client
T1071.004 · DNSTA0011 · Command and Control
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectionmediumtest

DNS Query To MEGA Hosting Website - DNS Client

Detects DNS queries for subdomains related to MEGA sharing website

Windowsdns-client
TA0010 · ExfiltrationT1567.002 · Exfiltration to Cloud Storage
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectionmediumtest

DNS Query To Put.io - DNS Client

Detects DNS queries for subdomains related to "Put.io" sharing website.

Windowsdns-client
TA0011 · Command and Control
Omar KhaledFri Aug 23windows
Detectionhightest

Query Tor Onion Address - DNS Client

Detects DNS resolution of an .onion address related to Tor routing networks

Windowsdns-client
TA0011 · Command and ControlT1090.003 · Multi-hop Proxy
Nasreddine Bencherchali (Nextron Systems)Sun Feb 20windows
Detectionlowtest

DNS Query To Ufile.io - DNS Client

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Windowsdns-client
TA0010 · ExfiltrationT1567.002 · Exfiltration to Cloud Storage
Nasreddine Bencherchali (Nextron Systems)Mon Jan 16windows
Detectionmediumtest

Failed DNS Zone Transfer

Detects when a DNS zone transfer failed.

Windowsdns-server
TA0043 · ReconnaissanceT1590.002 · DNS
Zach MathisWed May 24windows
Detectionhightest

DNS Server Error Failed Loading the ServerLevelPluginDLL

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Windowsdns-server
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionT1574.001 · DLL Search Order Hijacking
Florian Roth (Nextron Systems)Mon May 08windows
Detectionlowtest

USB Device Plugged

Detects plugged/unplugged USB devices

Windowsdriver-framework
TA0001 · Initial AccessT1200 · Hardware Additions
Florian Roth (Nextron Systems)Thu Nov 09windows
Detectionmediumtest

Uncommon New Firewall Rule Added In Windows Firewall Exception List

Detects when a rule has been added to the Windows Firewall exception list

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François HubautSat Feb 19windows
Detectionhightest

New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application

Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François HubautSun Feb 26windows
Detectionmediumtest

New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE

Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François Hubaut+1Fri May 10windows
Detectionhightest

All Rules Have Been Deleted From The Windows Firewall Configuration

Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François Hubaut+1Tue Jan 17windows
Detectionmediumtest

A Rule Has Been Deleted From The Windows Firewall Exception List

Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François HubautSat Feb 19windows
Detectionlowtest

The Windows Defender Firewall Service Failed To Load Group Policy

Detects activity when The Windows Defender Firewall service failed to load Group Policy

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François HubautSat Feb 19windows
Detectionlowtest

Windows Defender Firewall Has Been Reset To Its Default Configuration

Detects activity when Windows Defender Firewall has been reset to its default configuration

Windowsfirewall-as
TA0005 · Defense EvasionT1562.004 · Disable or Modify System Firewall
François HubautSat Feb 19windows