Detection Rule Index
Sigma and Splunk detection rules, mirrored as metadata plus IntelFusions original rules published in full — each linked to the ATT&CK techniques it covers and the malware it detects.
- HackTool - Defendnot Default Scheduled Task Activity SIGMA · high
- Potential HackTool - Defendnot Security Center AV Registry Modification SIGMA · medium
- HackTool - Defendnot Installation via PowerShell One-Liner SIGMA · high
- HackTool - Defendnot Execution SIGMA · high
- AWS IAM Role Created with External Trust SPLUNK
- PowerShell Download from Code Hosting Service SPLUNK
- AWS Repeated CloudWatch Logs Read Operations SPLUNK
- AWS Anomalous Secrets Manager Batch Retrieval SPLUNK
- Windows Process Outbound Connection To Social Media Domain SPLUNK
- AWS EC2 Startup Script Modified on Stopped Instance SPLUNK
- AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity SPLUNK
- Lynx Ransomware Execution Pattern SIGMA · high
- Shell Spawned by Celery Worker Process SIGMA · medium
- Registry Tampering Of Internal Tools Settings SIGMA · medium
- Cisco AI Defense Allowed Sensitive Response SPLUNK
- Cisco AI Defense Allowed Sensitive Prompt SPLUNK
- Cisco AI Defense Repeated High Risk Activity SPLUNK
- Unusual SSH Client Banner SPLUNK
- Ollama Long-Running Inference Requests SPLUNK
- HTTP POST Request with Encoded Payload SPLUNK
- Ollama Repeated Application Errors SPLUNK
- Unusual HTTP Request Method SPLUNK
- Add Authorized Applications to Microsoft Defender Firewall via Registry SIGMA · medium
- Allow Exceptions in Microsoft Defender Firewall via Registry SIGMA · medium
- PowerShell Dynamic Module Invocation Via ExportedCommands Array Index SIGMA · high
- PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script SIGMA · medium
- Windows Renamed Popular 3rd Party Software was Executed SPLUNK
- Windows AD Computer SPN Modified By User Account SPLUNK
- Windows Renamed Command Interpreter was Executed SPLUNK
- Windows Renamed Python Binary was Executed SPLUNK
- Windows Renamed LOLBAS Binary was Executed SPLUNK
- Windows AD SPN Unicode Collision Injection SPLUNK
- Suspicious WSL Binary Masquerading SIGMA · high
- Uncommon Child Process Spawned From XBootMgrSleep.EXE SIGMA · medium
- Potential WSL Binary Modification from Installed Location SIGMA · medium
- Potential WSL InstallLocation Registry Key Modification SIGMA · medium
- Suspicious WSL Binary Hijack via Proxy Execution SIGMA · high
- Suspicious WSL InstallLocation Registry Key Modification Via CommandLine SIGMA · high
- Windows Defender Intermediary Artifact Was Observed SPLUNK
- Windows AD User Suspicious UPN Change SPLUNK
- Windows For Loop Usage Within Cmd.exe To Execute Commands SPLUNK
- Windows Finger.exe Connecting to a Remote Host SPLUNK
- Windows Node.exe Executing JS Script In Immediate Folder SPLUNK
- MacOS Osascript Executing Interactive Shell SPLUNK
- Cisco NVM - Osascript Network Connection for a Long Duration SPLUNK
- MacOS Osascript Executing JavaScript Code With ObjC SPLUNK
- Windows Process Accessing IronLanguages Repository On GitHub SPLUNK
- Malware Shellcode in Verclsid Target Process SIGMA · high
- Goofy Guineapig Backdoor IOC SIGMA · high
- Pandemic Registry Key SIGMA · critical