Search results

Exclude alerting on OneDrive from writing PFX Files

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5702 In SigmaHQ/sigma;

· securesean opened on Oct 17, 2025

Suspicious Speech Runtime Binary Execution

Rule Idea

Status: Open.

#5603 In SigmaHQ/sigma;

· BIitzkrieg opened on Aug 19, 2025

Changelog: add guid's?

Status: Open.

#5590 In SigmaHQ/sigma;

· sandervandegeijn opened on Aug 11, 2025

Should the Blackbyte Ransomware Registry rule require all three registry keys to be present and set to 1 to trigger?

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5474 In SigmaHQ/sigma;

· renzhexigua opened on Jun 11, 2025

Enhancement on rule promotions

Status: Open.

#5422 In SigmaHQ/sigma;

· ariel-anieli opened on May 17, 2025

rule archiver should sort references

Status: Open.

#5404 In SigmaHQ/sigma;

· phantinuss opened on May 5, 2025

Rule incorrectly identifies our driver (Topaz Systems - www.topazsystems.com) as using Windows Credential Editor

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5170 In SigmaHQ/sigma;

· m1keam opened on Jan 24, 2025

LDAP Nightmare (CVE-2024-49112)

Status: Open.

#5151 In SigmaHQ/sigma;

· devilman85 opened on Jan 2, 2025

Adding sigma rules related to Restic for Data Exfiltration and CleanUpLoader(Oyster Backdoor)

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5056 In SigmaHQ/sigma;

· CTI-Driven opened on Oct 20, 2024

Remove ending spaces from selection in posh_ps_susp_invocation_generic.yml

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5034 In SigmaHQ/sigma;

· BlakeHensleyy opened on Oct 4, 2024

Wrong filter in " Kerberoasting Activity - Initial Query" rule condition?

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5011 In SigmaHQ/sigma;

· zambomarcell opened on Sep 17, 2024

Certain Windows commands include two spaces between the process and the parameters which is NOT reflected in related SIGMA rules

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#4914 In SigmaHQ/sigma;

· Koifman opened on Jul 13, 2024