Rule Library
Search across titles, descriptions, IDs, authors, tags, ATT&CK techniques, log sources and detection values. Filters combine, and the URL always reflects your current search.
3,783 rules found
Linux Webshell Indicators
highDetects suspicious sub processes of web server processes
testlinuxprocess_creationT1505Core RulesFlorian Roth (Nextron Systems) et al. · modified 2026-08-19
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
lowDetects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
experimentalwindowsprocess_creationT1518Core RulesTom3306 · modified 2026-08-19
New User Account Creation Attempt Via ADSI
mediumDetects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user a…
experimentalwindowsps_scriptT1136Core RulesWilliam Gokah (idea) et al. · modified 2026-08-13
New User Account Creation Attempt Via ADSI in CommandLine
mediumDetects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This i…
experimentalwindowsprocess_creationT1136Core RulesWilliam Gokah (idea) et al. · modified 2026-08-13
Potentially Suspicious Mofcomp Execution
highDetects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility pars…
testwindowsprocess_creationT1218Core RulesNasreddine Bencherchali (Nextron Systems) · modified 2026-08-06
Uncommon New Firewall Rule Added In Windows Firewall Exception List
mediumDetects when a rule has been added to the Windows Firewall exception list
testwindowsfirewall-asT1686Core Rulesfrack113 · modified 2026-08-06
Active Directory Replication from Non Machine Account - DcSync Indicator
mediumDetects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
testwindowssecurityT1003Core RulesRoberto Rodriguez @Cyb3rWard0g · modified 2026-07-30
ADCS - Certighost Ghost Machine Account Creation
highDetects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-…
experimentalwindowssecurityT1136T1649Emerging ThreatsSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-30
Suspicious Machine Account Replication - DcSync Indicator
mediumDetects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controll…
testwindowssecurityT1003Core RulesBenjamin Delpy et al. · modified 2026-07-30
Certificate Services Outbound SMB or LDAP Connection
highDetects the Windows Certificate Services process (certsrv.exe) initiating an outbound network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is inhere…
experimentalwindowsnetwork_connectionT1649PlaceholderSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-29
DC Machine Account Network Logon from Non-DC Source IP
criticalDetects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from oth…
experimentalwindowssecurityT1550T1558T1649PlaceholderSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-29
DC Machine Account TGS Request from Non-DC Source IP
highDetects a Kerberos service ticket request (Event 4769) targeting a Domain Controller machine account's service (e.g. DRSUAPI) originating from an IP address that is not a known Do…
experimentalwindowssecurityT1550T1558PlaceholderSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-29
DC Machine Account TGT Request from Non-DC Source IP
highDetects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originating from an IP address that is not a known Domain Controller. DC machine accounts…
experimentalwindowssecurityT1649T1550T1558PlaceholderSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-29
Access To Windows DPAPI Master Keys By Uncommon Applications
mediumDetects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage…
testwindowsfile_accessT1555Core RulesNasreddine Bencherchali (Nextron Systems) · modified 2026-07-28
Credential Manager Access By Uncommon Applications
mediumDetects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usa…
testwindowsfile_accessT1003Core RulesNasreddine Bencherchali (Nextron Systems) · modified 2026-07-28
Files With System Process Name In Unsuspected Locations
mediumDetects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial b…
testwindowsfile_eventT1036Core RulesSander Wiebing et al. · modified 2026-07-28
Load Of RstrtMgr.DLL By An Uncommon Process
lowDetects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encrypt…
testwindowsimage_loadT1486T1685Core RulesLuc Génaux · modified 2026-07-28
Msiexec Quiet Installation
mediumAdversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with…
testwindowsprocess_creationT1218Core Rulesfrack113 · modified 2026-07-28
PowerShell Core DLL Loaded By Non PowerShell Process
mediumDetects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.
testwindowsimage_loadT1059Core RulesTom Kern et al. · modified 2026-07-28
PSScriptPolicyTest Creation By Uncommon Process
mediumDetects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.
testwindowsfile_eventCore RulesNasreddine Bencherchali (Nextron Systems) · modified 2026-07-28
Suspicious WSMAN Provider Image Loads
mediumDetects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
testwindowsimage_loadT1059T1021Core RulesRoberto Rodriguez (Cyb3rWard0g) et al. · modified 2026-07-28
System File Execution Location Anomaly
highDetects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
testwindowsprocess_creationT1036Core RulesFlorian Roth (Nextron Systems) et al. · modified 2026-07-28
ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
highDetects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domai…
experimentalwindowssecurityT1649Emerging ThreatsSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-27
ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
highDetects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming th…
experimentalwindowssecurityT1649Emerging ThreatsSwachchhanda Shrawan Poudel (Nextron Systems) · modified 2026-07-27
About the Sigma rule library
This library indexes 3,783 community-maintained Sigma detection rules from theSigmaHQ repository. Use the search box to match a rule by title, description, author, tag, MITRE ATT&CK technique ID, log source or detection value, then narrow the results with the combinable filters for product, service, log source category, severity, status, ATT&CK tactic and technique, author and year. Every search and filter is reflected in the page URL, so a query can be bookmarked or shared with your team.
Prefer to browse? Jump to aplatform, alog source, a severity levelor a specificMITRE ATT&CK technique. Each rule opens on a dedicated page with its detection logic, ATT&CK mapping, false positives, references, related rules and the original Sigma YAML ready to copy or download.