Rule Library
Search across titles, descriptions, IDs, authors, tags, ATT&CK techniques, log sources and detection values. Filters combine, and the URL always reflects your current search.
3,791 rules found
Disable of ETW Trace - Powershell
highDetects usage of powershell cmdlets to disable or remove ETW trace sessions
testwindowsps_scriptT1070T1685Core RulesNasreddine Bencherchali (Nextron Systems) · modified 2026-10-12
ETW Trace Evasion Activity
highDetects command line activity that attempts to tamper with Event Tracing for Windows (ETW) by clearing or disabling trace logs or providers. Adversaries may target ETW to blind se…
testwindowsprocess_creationT1070T1685Core Rules@neu5ron et al. · modified 2026-10-12
Relevant Anti-Virus Signature Keywords In Application Log
highDetects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
testwindowsapplicationT1588Core RulesFlorian Roth (Nextron Systems) et al. · modified 2026-10-12
Suspicious Double Extension Files
highDetects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
testwindowsfile_eventT1036Core RulesNasreddine Bencherchali (Nextron Systems) et al. · modified 2026-10-12
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index
highDetects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This…
experimentalwindowsprocess_creationT1027T1059Core RulesNorbert Jaśniewicz (AlphaSOC) et al. · modified 2026-10-06
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script
mediumDetects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This can be used to evade detecti…
experimentalwindowsps_scriptT1027T1059Core RulesNorbert Jaśniewicz (AlphaSOC) · modified 2026-10-06
Renamed Schtasks Execution
highDetects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks. One of the very common persistence techniques is schedule ma…
experimentalwindowsprocess_creationT1036T1053Core RulesSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-10-02
Bitsadmin to Uncommon TLD
highDetects Bitsadmin connections to domains with uncommon TLDs
testproxyT1071T1197Core RulesFlorian Roth (Nextron Systems) et al. · modified 2026-09-30
Uncommon Child Process Spawned From XBootMgrSleep.EXE
mediumDetects a process other than XBootMgr.exe spawned by XBootMgrSleep.exe. XBootMgrSleep.exe is a Microsoft-signed Windows Performance Toolkit binary that can execute an arbitrary ex…
experimentalwindowsprocess_creationT1202Core RulesDiablo Research · modified 2026-09-27
Azure Subscription Permission Elevation Via AuditLogs
highDetects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker a…
testazureauditlogsT1078Core RulesAustin Songer @austinsonger · modified 2026-09-26
Potential Arbitrary File Download Using Office Application
highDetects potential arbitrary file download using a Microsoft Office application
testwindowsprocess_creationT1202Core RulesNasreddine Bencherchali (Nextron Systems) et al. · modified 2026-09-25
Potential Netcat Reverse Shell Execution
highDetects execution of netcat with the "-e" or "-c" flags followed by common shells, which are commonly used to spawn reverse shells.
testlinuxprocess_creationT1059Core Rules@d4ns4n_ et al. · modified 2026-09-24
Potential PowerShell Obfuscation Using Alias Cmdlets
lowDetects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
testwindowsps_scriptT1027T1059Core Rulesfrack113 · modified 2026-09-17
HackTool - Dumpert Process Dumper Execution
criticalDetects the use of Dumpert process dumper, which dumps the lsass.exe process memory
testwindowsprocess_creationT1003Core RulesFlorian Roth (Nextron Systems) · modified 2026-09-16
Elevated System Shell Spawned
mediumDetects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
testwindowsprocess_creationT1059Threat HuntingNasreddine Bencherchali (Nextron Systems) et al. · modified 2026-09-15
LSASS Access From Program In Potentially Suspicious Folder
mediumDetects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder
testwindowsprocess_accessT1003Threat HuntingFlorian Roth (Nextron Systems) · modified 2026-09-15
Potential Shellcode Injection
mediumDetects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.
testwindowsprocess_accessT1055Threat HuntingBhabesh Raj · modified 2026-09-15
Suspicious Kerberos Ticket Request via CLI
highDetects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces…
experimentalwindowsprocess_creationT1558Core RulesSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-09-14
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
highDetects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberoasting or silver ticket att…
testwindowsps_scriptT1558Core Rulesfrack113 · modified 2026-09-14
Suspicious Login Activity Classified By Google
mediumDetects Google Workspace login activity that's classified as suspicious by Google.
experimentalgcpgoogle_workspace.loginT1078Core RulesTom Kluter · modified 2026-09-14
ServiceDll Hijack
mediumDetects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.
testwindowsregistry_setT1543Core Rulesfrack113 · modified 2026-08-31
DNS Query to External Service Interaction Domains
highDetects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn…
testdnsT1190T1595Core RulesFlorian Roth (Nextron Systems) et al. · modified 2026-08-28
Office Autorun Keys Modification
mediumDetects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are vario…
testwindowsregistry_setT1547Core RulesVictor Sergeev et al. · modified 2026-08-28
CMSTP App Paths Registry Key Modification
highDetects modifications to the CMSTP App Paths registry key. This may indicate abuse of Microsoft Connection Manager Profile Installer (CMSTP) for arbitrary code execution or UAC by…
stablewindowsregistry_eventT1218Core RulesNik Seetharaman · modified 2026-08-27
About the Sigma rule library
This library indexes 3,791 community-maintained Sigma detection rules from theSigmaHQ repository. Use the search box to match a rule by title, description, author, tag, MITRE ATT&CK technique ID, log source or detection value, then narrow the results with the combinable filters for product, service, log source category, severity, status, ATT&CK tactic and technique, author and year. Every search and filter is reflected in the page URL, so a query can be bookmarked or shared with your team.
Prefer to browse? Jump to aplatform, alog source, a severity levelor a specificMITRE ATT&CK technique. Each rule opens on a dedicated page with its detection logic, ATT&CK mapping, false positives, references, related rules and the original Sigma YAML ready to copy or download.