The detection rules and queries from the UMBRASEC research writeups, as runnable files. Every rule comes out of a writeup that explains the technique, the log artifacts, the tuning knobs, and the false-positive profile. Read that before you deploy the rule.
Each file below is served directly over HTTPS - no account, no clone. Validate anything here yourself before running it; sigma-cli will syntax-check the whole directory.
| Rule / query | Type | MITRE ATT&CK | Tactic | Status |
|---|---|---|---|---|
| kerberoasting-rc4-service-ticket.yml | Sigma | T1558.003 Kerberoasting | Credential Access | experimental |
| kerberoasting-spn-fanout.yml | Sigma (correlation) | T1558.003 Kerberoasting | Credential Access | experimental |
| kerberoasting-honeypot-spn.yml | Sigma | T1558.003 Kerberoasting | Credential Access | experimental |
| oauth-consent-sensitive-scopes.kql | KQL | T1528 Steal Application Access Token | Credential Access | query |
| oauth2-permission-grant-post.kql | KQL | T1528 Steal Application Access Token | Credential Access | query |
| app-role-assignment.kql | KQL | T1528 Steal Application Access Token | Credential Access | query |
| litellm-proxy-spawns-shell.yml | Sigma | T1190 Exploit Public-Facing App; T1059 Command & Scripting | Initial Access / Execution | experimental |
| litellm-mcp-test-endpoint.yml | Sigma | T1190 Exploit Public-Facing App | Initial Access | experimental |
| masquerading-svchost-outside-system32.yml | Sigma | T1036.005 Match Legitimate Resource Name or Location | Defense Evasion | experimental |
| cloudflared-tunnel-service-install.yml | Sigma | T1543.003 Windows Service; T1572 Protocol Tunneling | Persistence / Command & Control | experimental |
| metabase-reset-password-sqli.yml | Sigma | T1190 Exploit Public-Facing App | Initial Access | experimental |
experimental is the Sigma status the rules themselves declare - new rules,
not yet battle-tested across many environments. KQL queries carry no Sigma status.
curl -sO https://umbrasec.dev/tools/sigma-pack/rules/windows/kerberoasting-spn-fanout.yml
Every path in the table works the same way. Rules are plain YAML, queries are plain text.
git clone https://codeberg.org/0xdev1/umbrasec
The pack lives in tools/sigma-pack/, alongside the writeups each rule came from.
False positives and tuning notes are worth more than silence - if one of these fires wrongly in your environment, say so. Open an issue →