All Rules

This article contains all Stellar Cyber rules, including SigmaHQ rules and rules developed internally by Stellar Cyber. The rules are listed alphabetically by their rule ID.

Due to silent or deleted rules, the rule IDs are not sequential.

Active Directory (AD) Rule IDs

(missing or bad snippet)

Amazon Web Services (AWS) Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

AWS Config Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Azure Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

certutil.exe Rule IDs

(missing or bad snippet)

Domain Name Service (DNS) Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Mimikatz Rule IDs

(missing or bad snippet)

Network Security Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Oracle Cloud Infrastructure (OCI) Audit Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

OCI Virtual Cloud Network (VCN) Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Office 365 Mail Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

PowerShell Command and Control (CNC) Rule IDs

(missing or bad snippet)(missing or bad snippet)

PowerShell Scriptblock Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Process Creation Commandline Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Process Creation Image Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Process Creation Parent Child Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Suspicious AD Kerberos Rule IDs

(missing or bad snippet)

Encoded PowerShell Rule IDs

(missing or bad snippet)

Windows Identity Threat Detection and Response (ITDR) Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Windows Network Connection Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Windows Process Access Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)

Windows Registry Set Rule IDs

(missing or bad snippet)(missing or bad snippet)

Windows Security Rule IDs

(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)(missing or bad snippet)