Skip to content

Issues: SigmaHQ/sigma

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

14 Open 595 Closed
14 Open 595 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Add Definition to Auditd susp_activity Create Pull-Request issues that should be provided as a pull request Work In Progress Some changes are needed
#5142 opened Dec 25, 2024 by BalsamicSentry
@nasbench
1
Update WannaCry Ransomware Activity Create Pull-Request issues that should be provided as a pull request
#5131 opened Dec 16, 2024 by nasbench
@nasbench
AWS IAM user login without MFA Create Pull-Request issues that should be provided as a pull request Work In Progress Some changes are needed
#5074 opened Nov 9, 2024 by thuya-hacktilizer
@nasbench
1
Adding sigma rules related to Restic for Data Exfiltration and CleanUpLoader(Oyster Backdoor) Create Pull-Request issues that should be provided as a pull request Work In Progress Some changes are needed
#5056 opened Oct 20, 2024 by CTI-Driven
@nasbench
Remove ending spaces from selection in posh_ps_susp_invocation_generic.yml False-Positive Issue reporting a false positive with one of the rules
#5034 opened Oct 4, 2024 by BlakeHensleyy
@nasbench
1
Wrong filter in " Kerberoasting Activity - Initial Query" rule condition? False-Positive Issue reporting a false positive with one of the rules Work In Progress Some changes are needed
#5011 opened Sep 17, 2024 by zambomarcell
@nasbench
2
Certain Windows commands include two spaces between the process and the parameters which is NOT reflected in related SIGMA rules False-Positive Issue reporting a false positive with one of the rules
#4914 opened Jul 13, 2024 by Koifman
@nasbench
7
Possible wrong access mask in Mimikatz DC Sync rule Work In Progress Some changes are needed
#4895 opened Jul 2, 2024 by ail4ni
@nasbench
3
DNS Exfiltration rule Work In Progress Some changes are needed
#4889 opened Jun 25, 2024 by pramodpabbati
@nasbench
2
False Detections with Invoke-Obfuscation and Null Bytes False-Positive Issue reporting a false positive with one of the rules Work In Progress Some changes are needed
#4875 opened Jun 9, 2024 by KDot227
@nasbench
2
Update of Rare Service Install Detection Rule to use correlation syntax Work In Progress Some changes are needed
#4854 opened May 14, 2024 by Mat0vu
@nasbench
4
Suspicious Process DNS Query Known Abuse Web Services
#4748 opened Mar 1, 2024 by cY83rR0H1t
@nasbench
Based on suspicious regedit changes sigma rules Work In Progress Some changes are needed
#4542 opened Nov 4, 2023 by HydraDragonAntivirus
@nasbench
3
Detect PowerShell w/o PowerShell Execution via RunDLL32 and various other methods Work In Progress Some changes are needed
#4197 opened Apr 25, 2023 by JulianDroste
@nasbench
3
ProTip! Mix and match filters to narrow down what you’re looking for.