Sigma Rules

No entries match these filters. Clear filters

1. r2026-07-01 Jul 9, 2026 · issue 011

   20 new Sigma detection rules added, including TanStack supply-chain attack coverage, CVE-2026-41089, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hash leak via Curl.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2026-07-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2026-07-01

   • New rule: Detects APT malware signatures via antivirus telemetry.
   • New rule: Detects remote access tool signatures via antivirus telemetry.
   • New rule: Detects AppLocker 'application would have been blocked' audit events.
   • New rule: Detects Authencesn crypto module load via Modprobe as a copy-fail indicator.
   • New rule: Detects file uploads to file-sharing websites via Curl.

   +19 more show less

   • New rule: Detects failed event log clearing via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. NTEventLogFile ClearEventLog.
   • New rule: Detects LSASS crash via Netlogon stack buffer overflow (CVE-2026-41089).
   • New rule: Detects Linux AF_ALG socket creation as a kernel crypto API exploit indicator.
   • New rule: Detects NTLM hash leakage via Curl NTLM authentication.
   • New rule: Detects new agent skills installation attempts via Node.EXE.
   • New rule: Detects process execution from shared memory directories.
   • New rule: Detects the RedTail cryptominer by its characteristic User-Agent string.
   • New rule: Detects registry enumeration via WMI StdRegProv.
   • New rule: Detects signed DLLs loaded with missing PE version metadata.
   • New rule: Detects TanStack supply-chain attack DNS indicators.
   • New rule: Detects TanStack supply-chain attack execution indicators on Linux.
   • New rule: Detects TanStack supply-chain attack execution indicators on Windows.
   • New rule: Detects TanStack supply-chain attack file creation indicators on Linux.
   • New rule: Detects TanStack supply-chain attack file creation indicators on Windows.
   • New rule: Detects Windows Defender being disabled via SystemSettingsAdminFlows.EXE.
   • Expanded ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. coverage across dozens of existing rules by adding the *64a.exe OriginalFileName variant.
   • Broadened file-sharing domain lists across all download/transfer detection rules for improved exfiltration coverage.
   • Updated PowerShell WinAPI rule to include local shellcode injection patterns.
   • Updated WMI StdRegProv registry manipulation rule scoped to write methods only, reducing noise.

   24 details in Everything

2. r2026-04-01 Apr 28, 2026 · release notes

   Sigma r2026-04-01 adds 57 new detection rules covering Axios/Shai-Hulud supply chain attacks, DMSA abuse, CVE exploits, and Kubernetes enumeration.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2026-04-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2026-04-01

   • Adds cross-platform detection for the Axios NPM compromise: file creation indicators on Linux, macOS, and Windows; process execution indicators; malicious C2 DNS queries; and Azure sign-ins using the Axios user agent.
   • Adds detections for the Shai-Hulud 2.0 malicious NPM package installation and Bun execution on Linux and Windows, plus malware indicators for both platforms.
   • Adds detections for the LiteLLM / TeamPCP supply chain attack indicators and TeamPCP persistence indicators.
   • Adds rules for DMSA (Delegated Managed Service Account) abuse: new DMSA object creation, DMSA created in specific OUs (PowerShell and non-PowerShell), and modification of msDS-DelegatedManagedServiceAccount link attributes.
   • Adds detections for RedSun malware: Conhost.exe spawned by TieringEngineService.exe, named pipe creation, EICAR test file detection, and staging in RS-prefixed temp directories.

   +22 more show less

   • Adds detection for NetExec (HackTool) file indicators and execution.
   • Adds detection for potential CVE-2026-33829 exploitation via Windows Snipping Tool remote file path URI.
   • Adds detection for potential exploitation of CVE-2025-5054 or CVE-2025-4598.
   • Adds Kubernetes potential enumeration activity detection.
   • Adds Google Workspace rules for government attack warnings, out-of-domain email forwarding, and suspicious login activity classified by Google.
   • Adds Microsoft 365 / Exchange rules for suspicious delivered emails, inbox rule creation/update via ExchangePowerShell cmdlet, inbox rule activity in O365, and mail forwarding/redirecting via ExchangePowerShell cmdlet.
   • Adds Okta session impersonation granted from untrusted domain detection.
   • Adds indirect command execution via SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. ProxyCommand detection.
   • Adds Python Base64 encoded inline command execution detections for Linux and Windows.
   • Adds detection for sensitive file dump via Print.EXE.
   • Adds detection for service startup type changes via Wmic.EXE.
   • Adds detection for memory dump mounting via MemProcFS (PUA).
   • Adds detection for potential Vcruntime140 DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading.
   • Adds detections for suspicious and uncommon file creation by Notepad++ Updater (GUP.exe) and suspicious child processes spawned by it.
   • Adds detection for OpenEDR spawning a command shell and potentially suspicious file creation by OpenEDR's ITSMService.
   • Adds detection for system language discovery via Reg.exe.
   • Adds detection for system restore registry modification via command line.
   • Adds detection for Windows EventLog Autologger session registry modification via command line.
   • Adds detection for Cisco Dot1x being disabled.
   • Adds detection for script interpreters spawning credential scanners on Linux and Windows.
   • Adds detection for suspicious child process of SolarWinds WebHelpDesk.
   • Removes the Suspicious PowerShell Mailbox SMTP Forward Rule rule (replaced by new inbox/forwarding rules).

   27 details in Everything

3. r2026-01-01 Jan 29, 2026 · release notes

   37 new Sigma detection rules added covering EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. evasion, AppX abuse, OpenCanary honeypot scans, AMSI/Credential Guard tampering, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2026-01-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2026-01-01

   • Adds detection for AMSI being disabled via registry modification and via command-line registry tampering.
   • Adds detection for Windows Credential Guard being disabled, tampered with via command-line, or having related registry values deleted.
   • Adds five OpenCanary honeypot detections: SYN port scan, NMAP FIN/NULL/OS/XMAS scans, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. new connection attempts.
   • Adds EDR-Freeze attack detections: suspicious process access to MsMpEng by WerFaultSecure and WerFaultSecure loading DbgCore/DbgHelp from uncommon locations.
   • Adds detection for Dbgcore/Dbghelp DLLs loaded from uncommon locations and used to access LSASS.

   +18 more show less

   • Adds detection for HVCI (Hypervisor-protected Code Integrity) registry tampering via command-line.
   • Adds detection for Vulnerable Driver Blocklist being disabled and tampered with via command-line.
   • Adds detection for PUA - Kernel Driver Utility (KDU) execution.
   • Adds detection for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. redirection via registry modification.
   • Adds detection for MSIX/AppX package installation scenarios: successful installs, unsigned packages, full trust packages, and MSIX Package Support Framework AI_STUBS execution.
   • Adds detection for GitHub Self-Hosted Runner execution.
   • Adds Linux detections for setuid and setgid capabilities set on binaries via the setcap utility.
   • Adds detection for suspicious child processes spawned from Node.js (React2Shell) on both Windows and Linux.
   • Adds detection for cmd launched with hidden start flags to suspicious targets.
   • Adds detection for Devcon execution disabling the VMware VMCI device.
   • Adds detection for HTML files opened from the Downloads folder.
   • Adds detection for legitimate applications writing files to uncommon locations.
   • Adds detection for suspicious ArcSOC.exe child processes and files created by ArcSOC.exe.
   • Adds detection for suspicious Shell Open Command registry modifications.
   • Adds detection for User Shell Folders registry modification via command-line.
   • Extends Invoke-DNSExfiltrator coverage across PowerShell commandlet and script detection rules.
   • Extends github.com to file-sharing and suspicious download detection rules across Bitsadmin, curl, wget, certutil, and network connection rules.
   • Extends EDR-Freeze hacktools rule with additional coverage.

   23 details in Everything

4. r2025-12-01 Nov 28, 2025 · release notes

   35 new Sigma rules added covering macOS stealers, FortiGate admin activity, ClickFix/FileFix, WSUSWSUSWindows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet. deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-12-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-12-01

   • Adds detection for AWS GuardDuty detector deletion or modification.
   • Adds two rules for Atomic macOS Stealer: FileGrabber activity and persistence indicators.
   • Adds detection for Cisco ASA/FP SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. exploitation (CVE-2025-20333 / CVE-2025-20362) via proxy logs.
   • Adds DNS query detection for the Finger utility.
   • Adds two rules covering WSUS deserialization exploitation (CVE-2025-59287): log-based and suspicious child process.

   +16 more show less

   • Adds six FortiGate-specific rules detecting admin account creation, local user creation, VPN SSL portal/settings changes, firewall policy/address-object additions, and user group modification.
   • Adds detection for Grixba malware reconnaissance activity.
   • Adds detection for HackTool WSASS execution.
   • Adds detection for network connections initiated via Finger.EXE.
   • Adds Linux detection for potentially suspicious long filename patterns.
   • Adds detection for enabling or disabling RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. via the Win32_TerminalServiceSetting WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. class.
   • Adds two rules for registry modification attempts via VBScript (process-based and PowerShell).
   • Adds detection for registry tampering by potentially suspicious processes.
   • Adds detection for renamed Schtasks execution.
   • Adds four ClickFix/FileFix detection rules: suspicious execution patterns, Explorer process with whitespace padding, space characters in RunMRU, and space characters in TypedPaths.
   • Adds detection for filenames with embedded Base64 commands.
   • Adds detection for suspicious KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket requests via CLI.
   • Adds detection for suspicious use of For loop with recursive directory search in CMD.
   • Adds detection for uncommon Svchost command-line parameters.
   • Adds detection for unsigned .node files being loaded.
   • Adds two rules for Windows Default Domain GPO modification (generic and via GPME).

   21 details in Everything

5. r2025-11-01 Oct 29, 2025 · release notes

   Sigma r2025-11-01 adds 37 new detection rules spanning AWS, Linux, GitHub, and Windows threat vectors.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-11-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-11-01

   • Adds AWS cloud detection rules for bucket deletion, console login monitoring, failed authentication, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. console access without MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. imported key material usage, STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. GetCallerIdentity enumeration via TruffleHog, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs deletion, and EnableRegion command monitoring.
   • Adds detection for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-Freeze hacktool execution, targeting EDR evasion techniques.
   • Adds rule detecting unsigned or unencrypted SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. connections to shares.
   • Adds detection for audit rules deleted via auditctl, covering tampering with Linux audit subsystems.
   • Adds Linux-specific rules for sudo chroot execution, Python web server execution, Kaspersky Endpoint Security stopped via command line, and masking system power settings via systemctl.

   +15 more show less

   • Adds detection for WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. KaliLinux installation and usage.
   • Adds GitHub-specific rules for repository archive status changes and Pages site visibility changes to public.
   • Adds detection for potential exploitation of CVE-2025-32463 via non-standard nsswitch.conf creation.
   • Adds detection for potential GoAnywhere MFT vulnerability exploitation.
   • Adds detection for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. via Windows Remote Shell (winrs), including local command execution.
   • Adds detection for FTP connection attempts via WinSCP CLI and WinSCP execution from non-standard folders.
   • Adds detection for file access of Signal Desktop sensitive data.
   • Adds detection for IIS web server log deletion via command-line utilities and syslog clearing or removal via system utilities.
   • Adds detection for WFP filter additions via registry.
   • Adds detection for RunMRU registry key deletion (process and registry log variants).
   • Adds detection for WinRAR creating files in startup locations.
   • Adds detection for ISATAP router address configuration changes.
   • Adds detection for PUA Restic backup tool execution.
   • Adds detection for executables running themselves as sacrificial processes.
   • Adds detection for BaaUpdate.exe suspicious DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. load and suspicious BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. Access Agent Update Utility execution.

   20 details in Everything

6. r2025-10-01 Oct 1, 2025 · release notes

   Sigma r2025-10-01 adds 43 new detection rules covering SharePoint ToolShell, SAP NetWeaver, FunkLocker ransomware, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-10-01 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-10-01

   • New rule: Detects ADExplorer writing a complete Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. snapshot to a .dat file.
   • New rule: Detects CrushFTP RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability CVE-2025-54309 exploitation.
   • New rule: Detects disabling of Windows Defender WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. Autologger Session via Reg.exe.
   • New rule: Detects FunkLocker ransomware file creation activity.
   • New rule: Detects Low Reputation Effective Top-Level Domain (eTLD) usage.

   +31 more show less

   • New rule: Detects MMC executing files with reversed extensions via RTLO abuse.
   • New rule: Detects MMC loading script engine DLLs.
   • New rule: Detects macOS FileGrabber infostealer activity.
   • New rule: Detects password-never-expires accounts set via WMI.
   • New rule: Detects Potential ClickFix execution patterns via the registry.
   • New rule: Detects Potential Hello-World Scraper Botnet activity.
   • New rule: Detects potential JLI.dll side-loading.
   • New rule: Detects potential PowerShell console history file access attempts.
   • New rule: Detects potential SSH tunnel persistence installed via a scheduled task.
   • New rule: Detects potentially suspicious child processes spawned by ConHost.
   • New rule: Detects PowerShell setting Windows Defender default threat action to Allow or NoAction.
   • New rule: Detects registry manipulation via WMI Stdregprov.
   • New rule: Detects TacticalRMM agent registration to potential attacker-controlled servers.
   • New rule: Detects scheduled task creation masquerading as system processes.
   • New rule: Detects schtasks combining curl download with PowerShell execution.
   • New rules: Detects security event logging disabled via the MiniNt registry key (process and registry set variants).
   • New rule: Detects suspicious .library-ms file creation as a potential CVE-2025-24054 exploit.
   • New rule: Detects suspicious file creation in the Outlook temporary directory.
   • New rule: Detects suspicious file writes to the SharePoint Layouts directory.
   • New rule: Detects suspicious process suspension via WERFaultSecure through EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-Freeze.
   • New rule: Detects suspicious uninstallation of the Windows Defender feature via PowerShell.
   • New rule: Detects suspicious Velociraptor child processes.
   • New rule: Detects WDAC policy file creation in the CodeIntegrity folder.
   • New rule: Detects Windows Defender default threat action modifications.
   • New rule: Detects Windows Recovery Environment being disabled via Reagentc.
   • Updated rules: Expanded invoke-restmethod cmdlet coverage across multiple PowerShell web-request and download detection rules.
   • Updated rule: Potential Defense Evasion Via Right-to-Left Override and File Extension Spoofing rules now include the U+202E character and additional extensions.
   • Updated rule: Potential Defense Evasion Via Binary Rename adds 7za coverage.
   • Updated rule: Suspicious Double Extension Files adds .svg extension.
   • Updated rule: System File Execution Location Anomaly adds taskhostw.
   • Updated rule: Suspicious Windows Service Tampering adds coverage for wmic and PowerShell WMI module.

   36 details in Everything

7. r2025-07-08 Jul 8, 2025 · release notes

   43 new Sigma detection rules added covering KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. coercion, Katz Stealer, CVE-2025-33053, MeshAgent RAT, SAP NetViewer webshells, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-07-08 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-07-08

   • Adds detection for Kerberos coercion via DNS SPN spoofing across multiple rule variants (process, DNS query, network)
   • Adds detection for Katz Stealer malware via DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. load, DNS queries, and suspicious User-Agent signatures
   • Adds three-rule coverage for exploitation of RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerability CVE-2025-33053 (process, image load, process access)
   • Adds detection for SharpSuccessor and HollowReaper hack tools, and Doppelanger LSASS dumper execution
   • Adds detection for MeshAgent remote access tool usage and suspicious behavior on both Windows and macOS

   +16 more show less

   • Adds detection for potential Java webshell upload and command execution in SAP NetViewer Server
   • Adds detection for Notepad++ CVE-2025-49144 exploitation attempts
   • Adds detection for FileFix browser file upload abuse via TypedPaths registry evidence and suspicious child processes
   • Adds detection for obfuscated and remote-sourced PowerShell MSI installs via WindowsInstaller COM
   • Adds detection for MSSQL destructive queries
   • Adds detection for proxy execution via vshadow.exe with -exec flag
   • Adds detection for trusted path bypass via Windows directory spoofing
   • Adds detection for suspicious Deno file writes from remote sources and curl/wget download-and-execute patterns
   • Adds detection for suspicious file access to browser credential storage and registry export of third-party credentials
   • Adds Linux detections for disabling ASLR via personality syscall, clearing kernel ring buffer via syslog syscall, special file creation via mknod, system info discovery via sysinfo, potential abuse of Linux Magic System Request Key, and AS-REP roastingAS-REP roastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline. via Kerberos TGT requests
   • Adds detection for Impacket file indicators on disk
   • Adds detection for RegAsm.EXE execution without command-line flags or files
   • Expands BadSuccessor exploit and Invoke-PowerDPAPI coverage across PowerShell detection rules (PoshModule, ScriptBlock, FileCreation, ProcessCreation)
   • Expands Windows Defender registry tampering detection with DisableCloudProtection and DisableSecurityCenter values
   • Expands MSHTA suspicious file extension detection with additional extensions
   • Expands Commands to Clear or Remove the Syslog rule to detect journald vacuuming

   21 details in Everything

8. r2025-05-21 May 27, 2025 · release notes

   Sigma r2025-05-21 adds 15 new detection rules covering Ivanti EPMM RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., CrushFTP, WDAC abuse, and more.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-05-21 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-05-21

   • New rule: detects Clfs.SYS loaded by a process in a potentially suspicious location.
   • New rule: detects crash dumps created by the operating system (potential exploit artifact).
   • New rule: detects HTTP requests to low-reputation TLDs or suspicious file extensions.
   • New rule: detects Kalambur backdoor curl TOR SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy execution.
   • New rule: detects Notepad-based password file discovery activity.

   +22 more show less

   • New rule: detects PUA AdFind.EXE execution.
   • New rule: detects PUA NimScan execution.
   • New rule: detects potential CVE-2024-35250 exploitation activity.
   • New rule: detects potential exploitation of CVE-2025-4427/4428 Ivanti EPMM pre-auth RCE.
   • New rule: detects potential unconstrained delegation discovery via Get-ADComputer in ScriptBlock logs.
   • New rule: detects potentially suspicious WDAC policy file creation.
   • New rule: detects suspicious autorun registry modifications via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk..
   • New rule: detects suspicious CrushFTP child process spawning.
   • New rule: detects suspicious LNK command-line padding with whitespace characters.
   • New rule: detects suspicious processes spawned by CentreStack Portal AppPool.
   • Updated AADInternals detection rules with additional framework strings for broader coverage.
   • Updated AnyDesk rules to cover the AnyDesk MSI variant (AnyDeskMSI.exe).
   • Updated audio capture rule to add ecasound detection.
   • Updated buffer overflow attempt rule with reworked logic and new keywords.
   • Updated malicious PowerShell commandlet rules to detect Veeam-Get-Creds.
   • Updated Nslookup PowerShell download cradle rule with additional -type=txt http coverage.
   • Updated suspicious eventlog clearing rules to cover clearing via .NET dotnet class.
   • Updated COM object hijacking rule with additional CLSID entries.
   • Updated potential binary impersonation of Sysinternals tools to include ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.-compiled binaries.
   • Updated potential browser data stealing rule to add esentutl.exe.
   • Updated process memory dump via Comsvcs.DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. rule with additional obfuscation method coverage.
   • Updated ESXi esxcli rules to align with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework v17.

   27 details in Everything

9. r2025-02-03 Feb 3, 2025 · release notes

   Sigma r2025-02-03 adds 5 new detection rules covering Azure conditional access bypass, LDAPNightmare, and Windows event log tampering.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch r2025-02-03 https://github.com/SigmaHQ/sigma.git
   # already have the repo? check out this version:
   $ git checkout r2025-02-03

   • New rule: detects Azure Login Bypassing Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies.
   • New rule: detects CVE-2024-49113 (LDAPNightmare) exploitation attempts.
   • New rule: detects suspicious binaries and scripts placed in public folders.
   • New rule: detects suspicious shell invocation via Rsync.
   • New rule: detects Windows Event Log access tampering via the registry.

   +3 more show less

   • Updated Exploit Framework User Agent rule to include the default Havoc C2 user agent string.
   • Updated Shell Execution via Rsync (Linux) rule with more generic logic covering additional shells.
   • Updated Suspicious Windows Service Tampering rule with additional monitored services.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Windows Defender Exclusion Deleted rule has been removed and will no longer fire on upgrade.
10. r2024-12-19 Dec 19, 2024 · release notes

    Sigma r2024-12-19 adds 12 new detection rules including CVE-2024-50623 (Cleo), Lummac Stealer, and QuickAssist abuse.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch r2024-12-19 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout r2024-12-19

    • New rule detects CVE-2024-50623 exploitation attempts against Cleo file-transfer products.
    • New rule detects Lummac Stealer activity via execution of More.com and Vbc.exe.
    • New rules detect QuickAssist abuse, covering both DNS queries and process execution.
    • New rule detects potential Right-to-Left Override (RTLO) file extension spoofing.
    • New rule detects suspicious Azure Front Door connections indicative of C2 or data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..

    +15 more show less

    • New rules cover AWS activity: key pair imports, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider deletions, RDS cluster modification/deletion, and new Lambda Function URL configurations.
    • New rule detects Setup16.EXE execution with a custom .lst file, a living-off-the-land technique.
    • New rule detects suspicious ShellExec_RunDLL calls via ordinal.
    • Updated DNS remote access rule adds coverage for getscreen.me.
    • Updated Linux file/directory discovery rule adds findmnt and mlocate binaries.
    • Updated Linux local account discovery adds less and emacs readers and /etc/pwd.db path.
    • Updated Linux password policy discovery adds /etc/pam.d/common-account, /etc/pam.d/common-auth, and /etc/pam.d/auth paths.
    • Updated Linux system user/owner discovery adds whoami, hostname, id, and last tools.
    • Updated Linux process discovery adds htop and atop.
    • Updated binary rename evasion rule adds ie4uinit.exe and msxsl.exe.
    • Updated remote access tool services rule adds AnyDesk detection.
    • Updated O365 mail forwarding/redirecting rule adds additional parameters for broader coverage.
    • Updated webshell detection rule adds suspicious PowerShell command-line keywords.
    • Updated cabinet file expansion rule adds new built-in share paths.
    • Updated COM object hijacking rule adds two additional GUID values observed in the wild.

    20 details in Everything

11. r2024-11-10 Nov 10, 2024 · release notes

    Sigma r2024-11-10 adds 17 new detection rules covering IIS tampering, GPO abuse, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. phishing, and BTunnels C2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch r2024-11-10 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout r2024-11-10

    • New rule: Detects .RDP files created by the Outlook process — catching RDP-based phishing via email clients.
    • New rule: Detects access to browser credential files by uncommon applications via Security event log.
    • New rule: Detects commands executed via the Windows Run dialog box using registry artifacts.
    • New rule: Detects DNS requests originating from Windows Script Host (wscript/cscript).
    • New rule: Detects ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging or processing options being disabled on IIS servers.

    +18 more show less

    • New rule: Detects Group Policy abuse for privilege addition.
    • New rule: Detects HTTP logging being disabled on IIS servers.
    • New rule: Detects network connections initiated to BTunnels domains — a covert tunneling service.
    • New rule: Detects new modules added to an IIS server.
    • New rule: Detects potential Python DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading.
    • New rule: Detects potentially suspicious commands executed via the Windows Run dialog box using registry artifacts.
    • New rule: Detects PowerShell Web Access feature being enabled via DISM.
    • New rule: Detects PowerShell Web Access installation via PowerShell script.
    • New rule: Detects removal of previously installed IIS modules.
    • New rule: Detects a process deleting its own executable — a common malware self-cleanup technique.
    • New rule: Detects Remote Access Tool MeshAgent command execution via MeshCentral.
    • New rule: Detects startup or logon scripts added to a Group Policy Object.
    • Updated file-sharing domain rules now include pixeldrain.com across BITS, curl, wget, PowerShell, and network connection detections.
    • Updated Certipy detection adds new flags cert, template, and ptt for broader coverage.
    • Updated LSASS dump file rule adds patterns for RustiveDump and NativeDump.
    • Updated DNS query rule for remote access software adds Tailscale, Twingate, and Microsoft Remote Assistance domains.
    • Updated JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token CLI search rule adds the eyJhbGciOi string to detect {"alg": JWT header lookups.
    • Updated GPO scheduled task persistence rule adds coverage for Event ID 5136.

    23 details in Everything

12. r2024-09-02 Sep 2, 2024 · release notes

    Sigma r2024-09-02 adds 74 new detection rules spanning macOS, Linux, GitHub audit logs, RATs, ransomware loaders, and CVE-specific exploits.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch r2024-09-02 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout r2024-09-02

    • Adds detections for access to Chromium browser sensitive files, crypto currency wallets, and Microsoft Teams sensitive files by uncommon applications.
    • Adds macOS-specific rules for disk image creation/mounting via Hdiutil, hiding files via Chflags, and clipboard data collection via Pbpaste.
    • Adds Linux shell invocation rules covering Capsh, AWK, SSH, Env, GCC, Find, Flock, Git, Nice, and Rsync as shell-spawning vectors.
    • Adds GitHub audit log detections for forking private repositories, repository/organization transfers, SSH certificate configuration changes, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./risk policy updates.
    • Adds CVE-specific exploit detection rules for CVE-2024-37085 (VMware ESXi ESX Admins group), CVE-2023-34362 (MOVEit Transfer), CVE-2021-44228 (VMware Horizon Log4Shell), CVE-2022-22954 (VMware Workspace ONE), and CVE-2020-1472 (ZeroLogon).

    +22 more show less

    • Adds detections for Raspberry Robin (initial execution from external drive, subsequent commands, AcluI DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading, registry ZoneMap manipulation).
    • Adds remote access tool detections for Action1 arbitrary code execution, Ammy Admin agent execution, AnyDesk incoming connections, and AnyViewer cmd.exe execution.
    • Adds malware-family-specific rules for ChromeLoader, Emotet LNK loader, FakeUpdates/SocGholish, Serpent backdoor scheduled task, GuLoader injected browser rundll32, Ursnif discovery command redirection, and potential APT FIN7 exploitation.
    • Adds detection for WSUSWSUSWindows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet. abuse via HackTool SharpWSUS/WSUSpendu execution.
    • Adds detection for SOAPHound Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. data collection tool execution.
    • Adds detection for KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. initial LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. query activity.
    • Adds four rules detecting defense evasion via emoji characters in command lines.
    • Adds detection for obfuscated PowerShell one-liner execution and potential Unicode character obfuscation from suspicious images.
    • Adds detection for inline Python spawning a shell via the OS system library.
    • Adds detection for MSSQL data export via BCP.EXE, potential file override via SET command, and data export scenarios.
    • Adds detection for Multi-Factor Authentication disabled for user accounts and User Risk/MFA registration policy updates.
    • Adds detection for headless processes launched via Conhost.EXE and PowerShell executed from a headless ConHost process.
    • Adds detection for suspicious process masquerading as SvcHost.EXE and processes launched without an image name.
    • Adds detection for Python function execution security warning disabled in Excel (process and registry variants).
    • Adds detection for potential BOINC software execution and renamed BOINC client execution (living-off-trusted-apps abuse vector).
    • Adds detection for Unattend.XML file access attempts and uncommon connections to Active Directory Web Services.
    • Adds detection for Task Scheduler DLL loaded by applications in potentially suspicious locations.
    • Adds detection for hiding user accounts via the SpecialAccounts registry key from the command line.
    • Adds detection for manual execution of scripts inside compressed files and OneNote malicious embedded script execution.
    • Expands file-sharing domain coverage across BITS, curl, wget, certutil, PowerShell, Bitsadmin, and network connection rules with *.trycloudflare.com, *.pages.dev, *.w3spaces.com, and *.workers.dev.
    • Expands GitHub high-risk configuration detection to include GitHub Advanced Security business- and org-level disable events.
    • Expands Active Directory LDAP reconnaissance detection to cover enumeration of distinguished names.

    27 details in Everything

13. r2024-07-17 Jul 17, 2024 · release notes

    Sigma r2024-07-17 adds 62 new detection rules covering Kapeka backdoor, Kubernetes, macOS, AWS/cloud, and Windows Recall.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch r2024-07-17 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout r2024-07-17

    • Adds full Kapeka backdoor detection suite: autorun persistence, configuration persistence, execution via RunDLL32, scheduled task creation, and decrypted backdoor indicators.
    • Adds Kubernetes detection rules for admission controller modification, CronJob/Job modification, rolebinding modification, secrets modification/deletion, and unauthorized/unauthenticated access.
    • Adds macOS detection rules for file download via nscurl, system information discovery via sysctl, Time Machine backup deletion/disabling, and new Time Machine exclusion additions via tmutil.
    • Adds Windows Recall feature enablement detection via registry value deletion, registry key, and Reg.EXE execution.
    • Adds DSInternals suspicious PowerShell cmdlet detection (standard and ScriptBlock variants).

    +22 more show less

    • Adds HackTool detections for Evil-WinRm, LaZagne, RemoteKrbRelay (including SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. relay secrets dump), and SharpDPAPI.
    • Adds cloud-focused rules for malicious IMDS credential usage outside AWS infrastructure, potential malicious CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. System Manager usage, and Ingress/Egress/LoadBalancer/RDS security group modifications.
    • Adds LocaltoNet and Portmap.IO tunneling service communication detection (Windows and Linux).
    • Adds DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. sideloading detections for DbgModel.DLL, MpSvc.DLL, and MsCorSvc.DLL.
    • Adds CVE-2023-1389 exploitation detection for unauthenticated command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in TP-Link Archer AX21.
    • Adds DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves. backup keys and certificate export activity IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. rule.
    • Adds Windows LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. credential dump from Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. detection.
    • Adds Hypervisor Enforced Paging Translation disabled detection.
    • Adds DNS query and network connection rules for AzureWebsites.NET by non-browser processes and Cloudflared tunnel domains.
    • Adds DarkGate loader drop detection in C:\Temp directory.
    • Adds Directory Service Restore Mode (DSRM) registry value tampering detection.
    • Adds detection for COM object hijacking via modification of default system CLSID default value.
    • Adds detection for BitlockerTogo.EXE execution.
    • Adds detection for renamed Microsoft Teams execution.
    • Adds detection for periodic backup of system registry hives being enabled.
    • Adds detection for PDF file created by RegEdit.EXE.
    • Adds detection for network connections initiated from the Users\Public folder.
    • Adds detection for potentially suspicious Qemu usage.
    • Adds detection for Microsoft Word add-in loaded.
    • Adds detection for uncommon file creation by MySQL daemon process and uncommon process access rights for target image.
    • Adds detection for files with system DLL names in unexpected locations.
    • Adds New Network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Entry and New Network Route Added cloud audit rules.

    27 details in Everything

14. r2024-05-13 May 13, 2024 · release notes

    Sigma Rules r2024-05-13 adds 16 new detection rules and updates others

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch r2024-05-13 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout r2024-05-13

    • Adds 16 new Sigma detection rules covering Windows Outlook mail file access, Wbadmin backup operations, LaunchAgent/Daemon execution, firewall rule modifications, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. connections, Packet Capture activity, malware callbacks, WebDAV execution, and UAC security settings.
    • Updates existing rules with enhanced logic, additional process lists, and expanded file paths to increase detection coverage for scenarios including PDQDeployRunner execution, Scheduled Task creation from temporary folders, and Icacls file hiding.

    2 details in Everything

15. 0.21 Apr 8, 2022 · release notes

    New Azure Sentinel, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Monitor, Hawk, Datadog, FortiSIEM, Lacework, and Athena SQL backends

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.21 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.21

    • Adds Azure Sentinel backend for rule conversion
    • Adds OpenSearch Monitor backend for rule conversion
    • Adds Hawk backend for rule conversion
    • Adds Datadog backend for rule conversion
    • Adds FortiSIEM backend for rule conversion

    +3 more show less

    • Adds Lacework agent data support
    • Adds Athena SQL backend for rule conversion
    • Adds regex support in SQLite backend

    8 details in Everything

16. 0.20 Aug 13, 2021 · release notes

    Sigma 0.20 adds Chronicle, CarbonBlack EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., Splunk Data Models, Logrhythm, and generic YAML/JSON output backends.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.20 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.20

    • Adds chronicle backend for generating detections compatible with Google Chronicle
    • Adds carbonblack backend for CarbonBlack EDR rule generation
    • Adds splunk_datamodels backend for Splunk Data Model compatibility
    • Adds logrhythm backend for Logrhythm SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. support
    • Adds ability to output results as generic YAML or JSON formats

    +8 more show less

    • Adds hash_normalize option in Elasticsearch backend for wildcard handling
    • Adds fields selection support in SQL backend
    • Adds table specification capability in SQL backend
    • Adds Linux/MacOS support for MDATP backend
    • Adds AWS Cloudtrail and Azure mappings for ALA
    • Adds generic registry event log source support
    • Adds filter negation capability
    • Adds additional conversion selection filters

    13 details in Everything

17. 0.19 Feb 28, 2021 · release notes

    Sigma Rules 0.19 adds five new backend integrations including Kibana NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. and uberAgent ESA.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.19 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.19

    • Adds kibana_ndjson backend for generating Kibana NDJSON detections
    • Adds uberagent_esa backend for uberAgent ESA detection output
    • Adds sumologic_cse backend for SumoLogic CSE detection output
    • Adds fireeye_helix backend for FireEye Helix integration
    • Adds new parameters for Elastic backends

    +1 more show less

    • Improved MDATP backend with case insensitive search support

    6 details in Everything

18. 0.18.1 Aug 25, 2020 · release notes

    Adds C# and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. backend support with expanded Windows log sources

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.18.1 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.18.1

    • New csharp backend for rendering Sigma rules to C#
    • New stix backend for rendering Sigma rules to STIX format
    • Windows Defender log source mappings added via the new windows_defender keyword
    • Generic DNS query log source mapping via the new dns_query keyword
    • AppLocker log source mapping via the new applocker keyword

    +3 more show less

    • Backend option action_throttle_period added to the xpack-watcher backend
    • Backend option mail_from added to the xpack-watcher backend
    • Backend option mail_profile added to the xpack-watcher backend

    8 details in Everything

19. 0.17.0 Jun 12, 2020 · release notes

    Sigma 0.17.0 adds LogIQ, CarbonBlack, Elasticsearch rule, SQLite, CrowdStrike, Humio, and ee-outliers backends with new aggregation and override capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.17.0 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.17.0

    • Adds logiq backend to convert Sigma rules for the LOGIQ platform.
    • Adds carbonblack backend with dedicated field mappings for Carbon Black.
    • Adds es-rule backend for generating Elasticsearch detection rules.
    • Adds ee-outliers backend support.
    • Adds crowdstrike backend for CrowdStrike rule generation.

    +10 more show less

    • Adds humio backend for Humio rule generation.
    • Adds aggregation capabilities within the SQL backend.
    • Adds sqlite backend for SQLite-based output formats.
    • Adds AWS Cloudtrail ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. mappings for cloud event normalization.
    • Adds support for rule overrides to customize detection behavior.
    • Adds Zeek configurations for various supported backends.
    • Enables case-insensitive matching for Elasticsearch-based backends.
    • Adds ECS proxy mappings for network event standardization.
    • Adds RuleName field mapping specifically for Winlogbeat output.
    • Includes the new sigma2attack tool for ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework alignment.

    15 details in Everything

20. 0.16.0 Feb 25, 2020 · release notes

    Sigma Rules v0.16.0 adds SQL, Carbon Black, ArcSight ESM, and Elasticsearch backends plus sigma2attack script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.16.0 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.16.0

    • Adds ala-rule backend for Azure Log Analytics generation
    • Adds sql backend for SQL statement generation
    • Adds carbon_black backend configuration support
    • Adds ArcSight ESM backend support with extended mapping
    • Adds Elasticsearch detection rule backend

    +1 more show less

    • Adds proxy field name to ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. (ecs-proxy) configuration mapping

    6 details in Everything

21. 0.15.0 Dec 6, 2019 · release notes

    Adds sigma-uuid tool for rule identifier management and es-dsl regex support in 0.15.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.15.0 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.15.0

    └──▷ TRY IT
    Manage rule identifiers directly from the command line.
    copy

    $ sigma-uuid --help

    • sigma-uuid tool for addition and check of Sigma rule identifiers
    • Regular expression support in es-dsl backend

    2 details in Everything

22. 0.12 Nov 29, 2019 · release notes

    Adds value modifiers (contains, alt, base64, re) and new configurations for ELK Winlogbeat and xpack-watcher.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.12 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.12

    • Supports contains, alt, base64, base64offset, and re value modifiers in Sigma rules
    • Adds support for regular expressions via the re value modifier
    • Adds configuration support for Winlogbeat 7.x
    • Enables usage of Channel field in ELK Windows configuration
    • Adds xpack-watcher actions index and webhook support

    5 details in Everything

23. 0.13 Nov 29, 2019 · release notes

    Sigma Rules 0.13 adds Sumologic index mappings, value modifiers (utf16/utf16le/wide/utf16be), and various QRadar/Elasticsearch backend improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.13

    • Adds Malicious cmdlets in wdatp
    • Adds QRadar support for keyword searches
    • Adds QRadar mapping improvements
    • Adds QRadar field selection
    • Adds QRadar type regex modifier support

    +4 more show less

    • Adds Elasticsearch keyword field blacklisting with wildcards
    • Adds dateField configuration parameter in xpack-watcher backend
    • Adds Field mappings in configurations
    • Adds Field name mapping for conditional fields

    9 details in Everything

24. 0.14 Nov 29, 2019 · release notes

    Adds sigma-similarity tool, LimaCharlie backend, es-dsl regex support, and startswith/endswith value modifiers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.14 https://github.com/SigmaHQ/sigma.git
    # already have the repo? check out this version:
    $ git checkout 0.14

    └──▷ TRY IT
    Run similarity analysis on a set of sigma rules to find duplicates or close matches.
    copy

    $ sigma-similarity ./rules/

    Use a regex in a Sigma condition with the es-dsl backend.
    yaml copy

    ---
    title: Test Rule
    status: test
    description: Example rule with value modifiers
    logsource:
      category: process_creation
      product: windows
    detection:
      selection:
        CommandLine|startswith: 'cmd.exe'
      condition: selection
    ---

    • Adds sigma-similarity tool as a new CLI command for rule similarity analysis
    • Adds LimaCharlie as a new backend output format
    • Enables regular expression support in the es-dsl backend, propagating to derived backends like elastalert-dsl
    • Adds startswith value modifier for Sigma rule conditions
    • Adds endswith value modifier for Sigma rule conditions

    5 details in Everything