// HUNT // SECURE

Detection Rule Generator

Paste an EHWS finding, a MITRE ATT&CK technique ID (T1558.003), or a Windows Event ID to get a ready-to-deploy SIGMA rule and Sysmon config snippet — all offline. Nothing leaves your browser.

⬡

Paste a finding, technique ID, or Event ID

Accepts EHWS tool findings (JSON), MITRE ATT&CK technique IDs (T1558.003), Windows Event IDs (4769), or technique names. Generates SIGMA rules and Sysmon XML — nothing leaves your browser.