Search results

Should the Blackbyte Ransomware Registry rule require all three registry keys to be present and set to 1 to trigger?

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5474 In SigmaHQ/sigma;

· renzhexigua opened on Jun 11, 2025

Enhancement on rule promotions

Status: Open.

#5422 In SigmaHQ/sigma;

· ariel-anieli opened on May 17, 2025

rule archiver should sort references

Status: Open.

#5404 In SigmaHQ/sigma;

· phantinuss opened on May 5, 2025

Rule Does Not Meet Current Sigma Capabilities

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

Status: Open.

#5247 In SigmaHQ/sigma;

· BalsamicSentry opened on Mar 27, 2025

False-Negative: Netsh Firewall Discovery With Full Command Path

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5171 In SigmaHQ/sigma;

· BalsamicSentry opened on Jan 25, 2025

Rule incorrectly identifies our driver (Topaz Systems - www.topazsystems.com) as using Windows Credential Editor

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5170 In SigmaHQ/sigma;

· m1keam opened on Jan 24, 2025

LDAP Nightmare (CVE-2024-49112)

Status: Open.

#5151 In SigmaHQ/sigma;

· devilman85 opened on Jan 2, 2025

Add Definition to Auditd susp_activity

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5142 In SigmaHQ/sigma;

· BalsamicSentry opened on Dec 25, 2024

Update WannaCry Ransomware Activity

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Status: Open.

#5131 In SigmaHQ/sigma;

· nasbench opened on Dec 16, 2024

AWS IAM user login without MFA

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5074 In SigmaHQ/sigma;

· thuya-hacktilizer opened on Nov 9, 2024

Adding sigma rules related to Restic for Data Exfiltration and CleanUpLoader(Oyster Backdoor)

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5056 In SigmaHQ/sigma;

· CTI-Driven opened on Oct 20, 2024

Remove ending spaces from selection in posh_ps_susp_invocation_generic.yml

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5034 In SigmaHQ/sigma;

· BlakeHensleyy opened on Oct 4, 2024