Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Sigma rules

Written by hand from vendor reports and the hunt packages, for things SigmaHQ doesn't cover yet. Each rule cites the report it came from. Plain Sigma; convert it to your SIEM with whatever you already use.

Rules (19)

Rule Status Level Logsource ATT&CK YAML
T1059 Process Launched from the PeopleSoft PSEMHUB.war Directory experimental high process_creation T1036, T1059 .yml
T1190 Oracle PeopleSoft PSEMHUB Request via a Non-Canonical Path (UNC6240 WAF Bypass) experimental high webserver T1190 .yml
T1505.003 Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp experimental high file_event T1219, T1505.003 .yml
T1098.005 Okta Verify Enrollment from a Hypervisor Guest experimental high okta T1098.005 .yml
T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel experimental medium okta T1111, T1557 .yml
T1557 Claims Kit First-Party Exfil: X-Enc Single-Letter C2 experimental high proxy T1027.013, T1557 .yml
T1557 Okta Verify SVG Asset Served by a Non-Okta Host experimental high proxy T1557 .yml
T1557 reCAPTCHA-Skinned Cloudflare Turnstile Gate experimental high proxy T1036.005, T1557 .yml
T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain experimental medium dns T1566.004, T1583.001 .yml
T1055 Process Injection: Rundll32 Spawning Explorer as an Injection Host experimental high windows / process_creation T1055, T1218.011 .yml
T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process experimental medium windows / network_connection T1071.004, T1573 .yml
T1574.002 DLL Side-Loading: Signed javac.exe Loading jli.dll from a User-Writable Path experimental high windows / image_load T1574.002 .yml
T1102.001 Dead Drop Resolver: EtherHiding Payload Retrieval from BNB Smart Chain Testnet experimental high proxy T1102.001 .yml
T1195.002 Compromise Software Supply Chain: Malicious Google Tag Manager Container experimental high proxy T1195.002 .yml
T1204.004 Malicious Copy and Paste: ClickFix macOS Terminal Execution experimental high macos / process_creation T1204.004 .yml
T1204.004 Malicious Copy and Paste: ClickFix Run Dialog Execution experimental high windows / process_creation T1105, T1204.004, T1218.011 .yml
T1037 Boot or Logon Initialization Scripts: Linux Init Script Modification experimental medium linux / file_event T1037 .yml
T1098.004 Account Manipulation: SSH Authorized Keys File Modification experimental medium linux / file_event T1098.004 .yml
T1566.002 Spearphishing Link: Luxembourg Hospitality SMS Phishing Campaign experimental medium mobile / sms T1566.002 .yml

Up next

Techniques with activity this window and no public rule, scored by active malware families, KEV CVEs, research citations and EPSS. The highest score gets written first.

Technique Name State Score Active families KEV
T1573.001 Symmetric Cryptography candidate 52.8 - 3
T1530 Data from Cloud Storage scaffolded 24 - 2
T1003.008 /etc/passwd and /etc/shadow scaffolded 24 - 1
T1542.005 TFTP Boot candidate 8.3 - 1
T1056.003 Web Portal Capture candidate 6 - 0
T1678 Delay Execution candidate 6 - 0
T1001.001 Junk Data candidate 3 - 0
T1027.007 Dynamic API Resolution candidate 3 - 0
T1027.012 LNK Icon Smuggling candidate 3 - 0
T1027.016 Junk Code Insertion candidate 3 - 0
T1070.009 Clear Persistence candidate 3 - 0
T1480.002 Mutual Exclusion candidate 3 - 0

Pulling rules in CI

Poll /sigma/rules.lock.json. Each rule has a content sha256, a version that only goes up, and a change_type. If change_type is logic, the detection or logsource changed and you should re-test before deploying. A metadata change is safe to take. Diffing two lock files shows what changed.

/sigma/rules.tar.gz has every rule in one file. /sigma/sigma-feed.xml posts new and logic-changed rules. Rule URLs and UUIDs never change. When a rule is retired it goes in CHANGELOG.md.

Status follows Sigma: experimental, then test, then stable. Drafts in the queue have a TODO detection block and stay out of the feed and the tarball.