Search results

Question about key allowed characters

Status: Open.

#5187 In SigmaHQ/sigma;

· djlukic opened on Feb 6, 2025

False-Negative: Netsh Firewall Discovery With Full Command Path

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5171 In SigmaHQ/sigma;

· BalsamicSentry opened on Jan 25, 2025

Rule incorrectly identifies our driver (Topaz Systems - www.topazsystems.com) as using Windows Credential Editor

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5170 In SigmaHQ/sigma;

· m1keam opened on Jan 24, 2025

LDAP Nightmare (CVE-2024-49112)

Status: Open.

#5151 In SigmaHQ/sigma;

· devilman85 opened on Jan 2, 2025

Add Definition to Auditd susp_activity

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5142 In SigmaHQ/sigma;

· BalsamicSentry opened on Dec 25, 2024

Update WannaCry Ransomware Activity

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Status: Open.

#5131 In SigmaHQ/sigma;

· nasbench opened on Dec 16, 2024

AWS IAM user login without MFA

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5074 In SigmaHQ/sigma;

· thuya-hacktilizer opened on Nov 9, 2024

Adding sigma rules related to Restic for Data Exfiltration and CleanUpLoader(Oyster Backdoor)

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5056 In SigmaHQ/sigma;

· CTI-Driven opened on Oct 20, 2024

Remove ending spaces from selection in posh_ps_susp_invocation_generic.yml

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5034 In SigmaHQ/sigma;

· BlakeHensleyy opened on Oct 4, 2024

Wrong filter in " Kerberoasting Activity - Initial Query" rule condition?

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5011 In SigmaHQ/sigma;

· zambomarcell opened on Sep 17, 2024

Certain Windows commands include two spaces between the process and the parameters which is NOT reflected in related SIGMA rules

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#4914 In SigmaHQ/sigma;

· Koifman opened on Jul 13, 2024

Possible wrong access mask in Mimikatz DC Sync rule

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#4895 In SigmaHQ/sigma;

· ail4ni opened on Jul 2, 2024