Rule Library

Sigma Rules

4 rules found for "Huntress Labs"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest

Suspicious Rundll32 Setupapi.dll Activity

setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

WindowsProcess Creation
TA0005 · Defense EvasionT1218.011 · Rundll32
Konstantin Grishchenko+1Wed Oct 07windows
Detectionhighstable

Suspicious Eventlog Clearing or Configuration Change Activity

Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses.

WindowsProcess Creation
TA0005 · Defense EvasionT1070.001 · Clear Windows Event LogsT1562.002 · Disable Windows Event Logging2016-04-002 · CAR 2016-04-002
Ecco+4Thu Sep 26windows
Emerging Threathightest

PaperCut MF/NG Potential Exploitation

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

WindowsProcess Creation
TA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)+1Thu Apr 202023
Emerging Threathighexperimental

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

WindowsProcess Creation
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationT1203 · Exploitation for Client Execution+2
Huntress Labs+1Fri Oct 312025