https://cybertoolchain.io/tools/sigma-rules New releases and features in Sigma Rules, tracked by The Cyber Toolchain. en Thu, 09 Jul 2026 14:51:34 GMT https://github.com/SigmaHQ/sigma/releases/tag/r2026-07-01 https://github.com/SigmaHQ/sigma/releases/tag/r2026-07-01 Thu, 09 Jul 2026 14:51:34 GMT 20 new Sigma detection rules added, including TanStack supply-chain attack coverage, CVE-2026-41089, and NTLM hash leak via Curl. • New rule: Detects APT malware signatures via antivirus telemetry. • New rule: Detects remote access tool signatures via antivirus telemetry. • New rule: Detects AppLocker 'application would have been blocked' audit events. • New rule: Detects Authencesn crypto module load via Modprobe as a copy-fail indicator. • New rule: Detects file uploads to file-sharing websites via Curl. • New rule: Detects failed event log clearing via WMI NTEventLogFile ClearEventLog. • New rule: Detects LSASS crash via Netlogon stack buffer overflow (CVE-2026-41089). • New rule: Detects Linux AF_ALG socket creation as a kernel crypto API exploit indicator. • New rule: Detects NTLM hash leakage via Curl NTLM authentication. • New rule: Detects new agent skills installation attempts via Node.EXE. • New rule: Detects process execution from shared memory directories. • New rule: Detects the RedTail cryptominer by its characteristic User-Agent string. • New rule: Detects registry enumeration via WMI StdRegProv. • New rule: Detects signed DLLs loaded with missing PE version metadata. • New rule: Detects TanStack supply-chain attack DNS indicators. • New rule: Detects TanStack supply-chain attack execution indicators on Linux. • New rule: Detects TanStack supply-chain attack execution indicators on Windows. • New rule: Detects TanStack supply-chain attack file creation indicators on Linux. • New rule: Detects TanStack supply-chain attack file creation indicators on Windows. • New rule: Detects Windows Defender being disabled via SystemSettingsAdminFlows.EXE. • Expanded ARM64 coverage across dozens of existing rules by adding the `*64a.exe` OriginalFileName variant. • Broadened file-sharing domain lists across all download/transfer detection rules for improved exfiltration coverage. • Updated PowerShell WinAPI rule to include local shellcode injection patterns. • Updated WMI StdRegProv registry manipulation rule scoped to write methods only, reducing noise. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2026-04-01 https://github.com/SigmaHQ/sigma/releases/tag/r2026-04-01 Tue, 28 Apr 2026 11:32:44 GMT Sigma r2026-04-01 adds 57 new detection rules covering Axios/Shai-Hulud supply chain attacks, DMSA abuse, CVE exploits, and Kubernetes enumeration. • Adds cross-platform detection for the Axios NPM compromise: file creation indicators on Linux, macOS, and Windows; process execution indicators; malicious C2 DNS queries; and Azure sign-ins using the Axios user agent. • Adds detections for the Shai-Hulud 2.0 malicious NPM package installation and Bun execution on Linux and Windows, plus malware indicators for both platforms. • Adds detections for the LiteLLM / TeamPCP supply chain attack indicators and TeamPCP persistence indicators. • Adds rules for DMSA (Delegated Managed Service Account) abuse: new DMSA object creation, DMSA created in specific OUs (PowerShell and non-PowerShell), and modification of msDS-DelegatedManagedServiceAccount link attributes. • Adds detections for RedSun malware: Conhost.exe spawned by TieringEngineService.exe, named pipe creation, EICAR test file detection, and staging in RS-prefixed temp directories. • Adds detection for NetExec (HackTool) file indicators and execution. • Adds detection for potential CVE-2026-33829 exploitation via Windows Snipping Tool remote file path URI. • Adds detection for potential exploitation of CVE-2025-5054 or CVE-2025-4598. • Adds Kubernetes potential enumeration activity detection. • Adds Google Workspace rules for government attack warnings, out-of-domain email forwarding, and suspicious login activity classified by Google. • Adds Microsoft 365 / Exchange rules for suspicious delivered emails, inbox rule creation/update via ExchangePowerShell cmdlet, inbox rule activity in O365, and mail forwarding/redirecting via ExchangePowerShell cmdlet. • Adds Okta session impersonation granted from untrusted domain detection. • Adds indirect command execution via SFTP ProxyCommand detection. • Adds Python Base64 encoded inline command execution detections for Linux and Windows. • Adds detection for sensitive file dump via Print.EXE. • Adds detection for service startup type changes via Wmic.EXE. • Adds detection for memory dump mounting via MemProcFS (PUA). • Adds detection for potential Vcruntime140 DLL sideloading. • Adds detections for suspicious and uncommon file creation by Notepad++ Updater (GUP.exe) and suspicious child processes spawned by it. • Adds detection for OpenEDR spawning a command shell and potentially suspicious file creation by OpenEDR's ITSMService. • Adds detection for system language discovery via Reg.exe. • Adds detection for system restore registry modification via command line. • Adds detection for Windows EventLog Autologger session registry modification via command line. • Adds detection for Cisco Dot1x being disabled. • Adds detection for script interpreters spawning credential scanners on Linux and Windows. • Adds detection for suspicious child process of SolarWinds WebHelpDesk. • Removes the 'Suspicious PowerShell Mailbox SMTP Forward Rule' rule (replaced by new inbox/forwarding rules). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2026-01-01 https://github.com/SigmaHQ/sigma/releases/tag/r2026-01-01 Thu, 29 Jan 2026 12:57:15 GMT 37 new Sigma detection rules added covering EDR evasion, AppX abuse, OpenCanary honeypot scans, AMSI/Credential Guard tampering, and more. • Adds detection for AMSI being disabled via registry modification and via command-line registry tampering. • Adds detection for Windows Credential Guard being disabled, tampered with via command-line, or having related registry values deleted. • Adds five OpenCanary honeypot detections: SYN port scan, NMAP FIN/NULL/OS/XMAS scans, and RDP new connection attempts. • Adds EDR-Freeze attack detections: suspicious process access to MsMpEng by WerFaultSecure and WerFaultSecure loading DbgCore/DbgHelp from uncommon locations. • Adds detection for Dbgcore/Dbghelp DLLs loaded from uncommon locations and used to access LSASS. • Adds detection for HVCI (Hypervisor-protected Code Integrity) registry tampering via command-line. • Adds detection for Vulnerable Driver Blocklist being disabled and tampered with via command-line. • Adds detection for PUA - Kernel Driver Utility (KDU) execution. • Adds detection for OCI DLL redirection via registry modification. • Adds detection for MSIX/AppX package installation scenarios: successful installs, unsigned packages, full trust packages, and MSIX Package Support Framework AI_STUBS execution. • Adds detection for GitHub Self-Hosted Runner execution. • Adds Linux detections for setuid and setgid capabilities set on binaries via the setcap utility. • Adds detection for suspicious child processes spawned from Node.js (React2Shell) on both Windows and Linux. • Adds detection for cmd launched with hidden start flags to suspicious targets. • Adds detection for Devcon execution disabling the VMware VMCI device. • Adds detection for HTML files opened from the Downloads folder. • Adds detection for legitimate applications writing files to uncommon locations. • Adds detection for suspicious ArcSOC.exe child processes and files created by ArcSOC.exe. • Adds detection for suspicious Shell Open Command registry modifications. • Adds detection for User Shell Folders registry modification via command-line. • Extends Invoke-DNSExfiltrator coverage across PowerShell commandlet and script detection rules. • Extends github.com to file-sharing and suspicious download detection rules across Bitsadmin, curl, wget, certutil, and network connection rules. • Extends EDR-Freeze hacktools rule with additional coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-12-01 https://github.com/SigmaHQ/sigma/releases/tag/r2025-12-01 Fri, 28 Nov 2025 10:43:38 GMT 35 new Sigma rules added covering macOS stealers, FortiGate admin activity, ClickFix/FileFix, WSUS deserialization, and more. • Adds detection for AWS GuardDuty detector deletion or modification. • Adds two rules for Atomic macOS Stealer: FileGrabber activity and persistence indicators. • Adds detection for Cisco ASA/FP SSL VPN exploitation (CVE-2025-20333 / CVE-2025-20362) via proxy logs. • Adds DNS query detection for the Finger utility. • Adds two rules covering WSUS deserialization exploitation (CVE-2025-59287): log-based and suspicious child process. • Adds six FortiGate-specific rules detecting admin account creation, local user creation, VPN SSL portal/settings changes, firewall policy/address-object additions, and user group modification. • Adds detection for Grixba malware reconnaissance activity. • Adds detection for HackTool WSASS execution. • Adds detection for network connections initiated via Finger.EXE. • Adds Linux detection for potentially suspicious long filename patterns. • Adds detection for enabling or disabling RDP via the Win32_TerminalServiceSetting WMI class. • Adds two rules for registry modification attempts via VBScript (process-based and PowerShell). • Adds detection for registry tampering by potentially suspicious processes. • Adds detection for renamed Schtasks execution. • Adds four ClickFix/FileFix detection rules: suspicious execution patterns, Explorer process with whitespace padding, space characters in RunMRU, and space characters in TypedPaths. • Adds detection for filenames with embedded Base64 commands. • Adds detection for suspicious Kerberos ticket requests via CLI. • Adds detection for suspicious use of For loop with recursive directory search in CMD. • Adds detection for uncommon Svchost command-line parameters. • Adds detection for unsigned .node files being loaded. • Adds two rules for Windows Default Domain GPO modification (generic and via GPME). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-11-01 https://github.com/SigmaHQ/sigma/releases/tag/r2025-11-01 Wed, 29 Oct 2025 11:28:42 GMT Sigma r2025-11-01 adds 37 new detection rules spanning AWS, Linux, GitHub, and Windows threat vectors. • Adds AWS cloud detection rules for bucket deletion, console login monitoring, failed authentication, IAM console access without MFA, KMS imported key material usage, STS GetCallerIdentity enumeration via TruffleHog, VPC Flow Logs deletion, and EnableRegion command monitoring. • Adds detection for EDR-Freeze hacktool execution, targeting EDR evasion techniques. • Adds rule detecting unsigned or unencrypted SMB connections to shares. • Adds detection for audit rules deleted via auditctl, covering tampering with Linux audit subsystems. • Adds Linux-specific rules for sudo chroot execution, Python web server execution, Kaspersky Endpoint Security stopped via command line, and masking system power settings via systemctl. • Adds detection for WSL KaliLinux installation and usage. • Adds GitHub-specific rules for repository archive status changes and Pages site visibility changes to public. • Adds detection for potential exploitation of CVE-2025-32463 via non-standard nsswitch.conf creation. • Adds detection for potential GoAnywhere MFT vulnerability exploitation. • Adds detection for lateral movement via Windows Remote Shell (winrs), including local command execution. • Adds detection for FTP connection attempts via WinSCP CLI and WinSCP execution from non-standard folders. • Adds detection for file access of Signal Desktop sensitive data. • Adds detection for IIS web server log deletion via command-line utilities and syslog clearing or removal via system utilities. • Adds detection for WFP filter additions via registry. • Adds detection for RunMRU registry key deletion (process and registry log variants). • Adds detection for WinRAR creating files in startup locations. • Adds detection for ISATAP router address configuration changes. • Adds detection for PUA Restic backup tool execution. • Adds detection for executables running themselves as sacrificial processes. • Adds detection for BaaUpdate.exe suspicious DLL load and suspicious BitLocker Access Agent Update Utility execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-10-01 https://github.com/SigmaHQ/sigma/releases/tag/r2025-10-01 Wed, 01 Oct 2025 12:54:14 GMT Sigma r2025-10-01 adds 43 new detection rules covering SharePoint ToolShell, SAP NetWeaver, FunkLocker ransomware, and more. • New rule: Detects ADExplorer writing a complete Active Directory snapshot to a .dat file. • New rule: Detects CrushFTP RCE vulnerability CVE-2025-54309 exploitation. • New rule: Detects disabling of Windows Defender WMI Autologger Session via Reg.exe. • New rule: Detects FunkLocker ransomware file creation activity. • New rule: Detects Low Reputation Effective Top-Level Domain (eTLD) usage. • New rule: Detects MMC executing files with reversed extensions via RTLO abuse. • New rule: Detects MMC loading script engine DLLs. • New rule: Detects macOS FileGrabber infostealer activity. • New rule: Detects password-never-expires accounts set via WMI. • New rule: Detects Potential ClickFix execution patterns via the registry. • New rule: Detects Potential Hello-World Scraper Botnet activity. • New rule: Detects potential JLI.dll side-loading. • New rule: Detects potential PowerShell console history file access attempts. • New rule: Detects potential SSH tunnel persistence installed via a scheduled task. • New rule: Detects potentially suspicious child processes spawned by ConHost. • New rule: Detects PowerShell setting Windows Defender default threat action to 'Allow' or 'NoAction'. • New rule: Detects registry manipulation via WMI Stdregprov. • New rule: Detects TacticalRMM agent registration to potential attacker-controlled servers. • New rule: Detects scheduled task creation masquerading as system processes. • New rule: Detects schtasks combining curl download with PowerShell execution. • New rules: Detects security event logging disabled via the MiniNt registry key (process and registry set variants). • New rule: Detects suspicious .library-ms file creation as a potential CVE-2025-24054 exploit. • New rule: Detects suspicious file creation in the Outlook temporary directory. • New rule: Detects suspicious file writes to the SharePoint Layouts directory. • New rule: Detects suspicious process suspension via WERFaultSecure through EDR-Freeze. • New rule: Detects suspicious uninstallation of the Windows Defender feature via PowerShell. • New rule: Detects suspicious Velociraptor child processes. • New rule: Detects WDAC policy file creation in the CodeIntegrity folder. • New rule: Detects Windows Defender default threat action modifications. • New rule: Detects Windows Recovery Environment being disabled via Reagentc. • Updated rules: Expanded invoke-restmethod cmdlet coverage across multiple PowerShell web-request and download detection rules. • Updated rule: Potential Defense Evasion Via Right-to-Left Override and File Extension Spoofing rules now include the U+202E character and additional extensions. • Updated rule: Potential Defense Evasion Via Binary Rename adds 7za coverage. • Updated rule: Suspicious Double Extension Files adds .svg extension. • Updated rule: System File Execution Location Anomaly adds taskhostw. • Updated rule: Suspicious Windows Service Tampering adds coverage for wmic and PowerShell WMI module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-07-08 https://github.com/SigmaHQ/sigma/releases/tag/r2025-07-08 Tue, 08 Jul 2025 11:32:17 GMT 43 new Sigma detection rules added covering Kerberos coercion, Katz Stealer, CVE-2025-33053, MeshAgent RAT, SAP NetViewer webshells, and more. • Adds detection for Kerberos coercion via DNS SPN spoofing across multiple rule variants (process, DNS query, network) • Adds detection for Katz Stealer malware via DLL load, DNS queries, and suspicious User-Agent signatures • Adds three-rule coverage for exploitation of RCE vulnerability CVE-2025-33053 (process, image load, process access) • Adds detection for SharpSuccessor and HollowReaper hack tools, and Doppelanger LSASS dumper execution • Adds detection for MeshAgent remote access tool usage and suspicious behavior on both Windows and macOS • Adds detection for potential Java webshell upload and command execution in SAP NetViewer Server • Adds detection for Notepad++ CVE-2025-49144 exploitation attempts • Adds detection for FileFix browser file upload abuse via TypedPaths registry evidence and suspicious child processes • Adds detection for obfuscated and remote-sourced PowerShell MSI installs via WindowsInstaller COM • Adds detection for MSSQL destructive queries • Adds detection for proxy execution via vshadow.exe with -exec flag • Adds detection for trusted path bypass via Windows directory spoofing • Adds detection for suspicious Deno file writes from remote sources and curl/wget download-and-execute patterns • Adds detection for suspicious file access to browser credential storage and registry export of third-party credentials • Adds Linux detections for disabling ASLR via personality syscall, clearing kernel ring buffer via syslog syscall, special file creation via mknod, system info discovery via sysinfo, potential abuse of Linux Magic System Request Key, and AS-REP roasting via Kerberos TGT requests • Adds detection for Impacket file indicators on disk • Adds detection for RegAsm.EXE execution without command-line flags or files • Expands BadSuccessor exploit and Invoke-PowerDPAPI coverage across PowerShell detection rules (PoshModule, ScriptBlock, FileCreation, ProcessCreation) • Expands Windows Defender registry tampering detection with DisableCloudProtection and DisableSecurityCenter values • Expands MSHTA suspicious file extension detection with additional extensions • Expands Commands to Clear or Remove the Syslog rule to detect journald vacuuming Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-05-21 https://github.com/SigmaHQ/sigma/releases/tag/r2025-05-21 Tue, 27 May 2025 11:13:34 GMT Sigma r2025-05-21 adds 15 new detection rules covering Ivanti EPMM RCE, CrushFTP, WDAC abuse, and more. • New rule: detects Clfs.SYS loaded by a process in a potentially suspicious location. • New rule: detects crash dumps created by the operating system (potential exploit artifact). • New rule: detects HTTP requests to low-reputation TLDs or suspicious file extensions. • New rule: detects Kalambur backdoor curl TOR SOCKS proxy execution. • New rule: detects Notepad-based password file discovery activity. • New rule: detects PUA AdFind.EXE execution. • New rule: detects PUA NimScan execution. • New rule: detects potential CVE-2024-35250 exploitation activity. • New rule: detects potential exploitation of CVE-2025-4427/4428 Ivanti EPMM pre-auth RCE. • New rule: detects potential unconstrained delegation discovery via Get-ADComputer in ScriptBlock logs. • New rule: detects potentially suspicious WDAC policy file creation. • New rule: detects suspicious autorun registry modifications via WMI. • New rule: detects suspicious CrushFTP child process spawning. • New rule: detects suspicious LNK command-line padding with whitespace characters. • New rule: detects suspicious processes spawned by CentreStack Portal AppPool. • Updated AADInternals detection rules with additional framework strings for broader coverage. • Updated AnyDesk rules to cover the AnyDesk MSI variant (`AnyDeskMSI.exe`). • Updated audio capture rule to add ecasound detection. • Updated buffer overflow attempt rule with reworked logic and new keywords. • Updated malicious PowerShell commandlet rules to detect `Veeam-Get-Creds`. • Updated Nslookup PowerShell download cradle rule with additional `-type=txt http` coverage. • Updated suspicious eventlog clearing rules to cover clearing via .NET dotnet class. • Updated COM object hijacking rule with additional CLSID entries. • Updated potential binary impersonation of Sysinternals tools to include ARM64-compiled binaries. • Updated potential browser data stealing rule to add esentutl.exe. • Updated process memory dump via Comsvcs.DLL rule with additional obfuscation method coverage. • Updated ESXi esxcli rules to align with MITRE ATT&CK framework v17. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2025-02-03 https://github.com/SigmaHQ/sigma/releases/tag/r2025-02-03 Mon, 03 Feb 2025 17:34:32 GMT Sigma r2025-02-03 adds 5 new detection rules covering Azure conditional access bypass, LDAPNightmare, and Windows event log tampering. • New rule: detects Azure Login Bypassing Conditional Access Policies. • New rule: detects CVE-2024-49113 (LDAPNightmare) exploitation attempts. • New rule: detects suspicious binaries and scripts placed in public folders. • New rule: detects suspicious shell invocation via Rsync. • New rule: detects Windows Event Log access tampering via the registry. • Updated Exploit Framework User Agent rule to include the default Havoc C2 user agent string. • Updated Shell Execution via Rsync (Linux) rule with more generic logic covering additional shells. • Updated Suspicious Windows Service Tampering rule with additional monitored services. Breaking changes: • The 'Windows Defender Exclusion Deleted' rule has been removed and will no longer fire on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2024-12-19 https://github.com/SigmaHQ/sigma/releases/tag/r2024-12-19 Thu, 19 Dec 2024 19:46:49 GMT Sigma r2024-12-19 adds 12 new detection rules including CVE-2024-50623 (Cleo), Lummac Stealer, and QuickAssist abuse. • New rule detects CVE-2024-50623 exploitation attempts against Cleo file-transfer products. • New rule detects Lummac Stealer activity via execution of More.com and Vbc.exe. • New rules detect QuickAssist abuse, covering both DNS queries and process execution. • New rule detects potential Right-to-Left Override (RTLO) file extension spoofing. • New rule detects suspicious Azure Front Door connections indicative of C2 or data exfiltration. • New rules cover AWS activity: key pair imports, SAML provider deletions, RDS cluster modification/deletion, and new Lambda Function URL configurations. • New rule detects Setup16.EXE execution with a custom .lst file, a living-off-the-land technique. • New rule detects suspicious ShellExec_RunDLL calls via ordinal. • Updated DNS remote access rule adds coverage for getscreen.me. • Updated Linux file/directory discovery rule adds 'findmnt' and 'mlocate' binaries. • Updated Linux local account discovery adds 'less' and 'emacs' readers and '/etc/pwd.db' path. • Updated Linux password policy discovery adds '/etc/pam.d/common-account', '/etc/pam.d/common-auth', and '/etc/pam.d/auth' paths. • Updated Linux system user/owner discovery adds 'whoami', 'hostname', 'id', and 'last' tools. • Updated Linux process discovery adds 'htop' and 'atop'. • Updated binary rename evasion rule adds ie4uinit.exe and msxsl.exe. • Updated remote access tool services rule adds AnyDesk detection. • Updated O365 mail forwarding/redirecting rule adds additional parameters for broader coverage. • Updated webshell detection rule adds suspicious PowerShell command-line keywords. • Updated cabinet file expansion rule adds new built-in share paths. • Updated COM object hijacking rule adds two additional GUID values observed in the wild. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2024-11-10 https://github.com/SigmaHQ/sigma/releases/tag/r2024-11-10 Sun, 10 Nov 2024 10:47:43 GMT Sigma r2024-11-10 adds 17 new detection rules covering IIS tampering, GPO abuse, RDP phishing, and BTunnels C2. • New rule: Detects .RDP files created by the Outlook process — catching RDP-based phishing via email clients. • New rule: Detects access to browser credential files by uncommon applications via Security event log. • New rule: Detects commands executed via the Windows Run dialog box using registry artifacts. • New rule: Detects DNS requests originating from Windows Script Host (wscript/cscript). • New rule: Detects ETW logging or processing options being disabled on IIS servers. • New rule: Detects Group Policy abuse for privilege addition. • New rule: Detects HTTP logging being disabled on IIS servers. • New rule: Detects network connections initiated to BTunnels domains — a covert tunneling service. • New rule: Detects new modules added to an IIS server. • New rule: Detects potential Python DLL sideloading. • New rule: Detects potentially suspicious commands executed via the Windows Run dialog box using registry artifacts. • New rule: Detects PowerShell Web Access feature being enabled via DISM. • New rule: Detects PowerShell Web Access installation via PowerShell script. • New rule: Detects removal of previously installed IIS modules. • New rule: Detects a process deleting its own executable — a common malware self-cleanup technique. • New rule: Detects Remote Access Tool MeshAgent command execution via MeshCentral. • New rule: Detects startup or logon scripts added to a Group Policy Object. • Updated file-sharing domain rules now include `pixeldrain.com` across BITS, curl, wget, PowerShell, and network connection detections. • Updated Certipy detection adds new flags `cert`, `template`, and `ptt` for broader coverage. • Updated LSASS dump file rule adds patterns for RustiveDump and NativeDump. • Updated DNS query rule for remote access software adds Tailscale, Twingate, and Microsoft Remote Assistance domains. • Updated JWT token CLI search rule adds the `eyJhbGciOi` string to detect `{"alg":` JWT header lookups. • Updated GPO scheduled task persistence rule adds coverage for Event ID 5136. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2024-09-02 https://github.com/SigmaHQ/sigma/releases/tag/r2024-09-02 Mon, 02 Sep 2024 18:30:09 GMT Sigma r2024-09-02 adds 74 new detection rules spanning macOS, Linux, GitHub audit logs, RATs, ransomware loaders, and CVE-specific exploits. • Adds detections for access to Chromium browser sensitive files, crypto currency wallets, and Microsoft Teams sensitive files by uncommon applications. • Adds macOS-specific rules for disk image creation/mounting via Hdiutil, hiding files via Chflags, and clipboard data collection via Pbpaste. • Adds Linux shell invocation rules covering Capsh, AWK, SSH, Env, GCC, Find, Flock, Git, Nice, and Rsync as shell-spawning vectors. • Adds GitHub audit log detections for forking private repositories, repository/organization transfers, SSH certificate configuration changes, and MFA/risk policy updates. • Adds CVE-specific exploit detection rules for CVE-2024-37085 (VMware ESXi ESX Admins group), CVE-2023-34362 (MOVEit Transfer), CVE-2021-44228 (VMware Horizon Log4Shell), CVE-2022-22954 (VMware Workspace ONE), and CVE-2020-1472 (ZeroLogon). • Adds detections for Raspberry Robin (initial execution from external drive, subsequent commands, AcluI DLL sideloading, registry ZoneMap manipulation). • Adds remote access tool detections for Action1 arbitrary code execution, Ammy Admin agent execution, AnyDesk incoming connections, and AnyViewer cmd.exe execution. • Adds malware-family-specific rules for ChromeLoader, Emotet LNK loader, FakeUpdates/SocGholish, Serpent backdoor scheduled task, GuLoader injected browser rundll32, Ursnif discovery command redirection, and potential APT FIN7 exploitation. • Adds detection for WSUS abuse via HackTool SharpWSUS/WSUSpendu execution. • Adds detection for SOAPHound Active Directory data collection tool execution. • Adds detection for Kerberoasting initial LDAP query activity. • Adds four rules detecting defense evasion via emoji characters in command lines. • Adds detection for obfuscated PowerShell one-liner execution and potential Unicode character obfuscation from suspicious images. • Adds detection for inline Python spawning a shell via the OS system library. • Adds detection for MSSQL data export via BCP.EXE, potential file override via SET command, and data export scenarios. • Adds detection for Multi-Factor Authentication disabled for user accounts and User Risk/MFA registration policy updates. • Adds detection for headless processes launched via Conhost.EXE and PowerShell executed from a headless ConHost process. • Adds detection for suspicious process masquerading as SvcHost.EXE and processes launched without an image name. • Adds detection for Python function execution security warning disabled in Excel (process and registry variants). • Adds detection for potential BOINC software execution and renamed BOINC client execution (living-off-trusted-apps abuse vector). • Adds detection for Unattend.XML file access attempts and uncommon connections to Active Directory Web Services. • Adds detection for Task Scheduler DLL loaded by applications in potentially suspicious locations. • Adds detection for hiding user accounts via the SpecialAccounts registry key from the command line. • Adds detection for manual execution of scripts inside compressed files and OneNote malicious embedded script execution. • Expands file-sharing domain coverage across BITS, curl, wget, certutil, PowerShell, Bitsadmin, and network connection rules with `*.trycloudflare.com`, `*.pages.dev`, `*.w3spaces.com`, and `*.workers.dev`. • Expands GitHub high-risk configuration detection to include GitHub Advanced Security business- and org-level disable events. • Expands Active Directory LDAP reconnaissance detection to cover enumeration of distinguished names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2024-07-17 https://github.com/SigmaHQ/sigma/releases/tag/r2024-07-17 Wed, 17 Jul 2024 09:37:49 GMT Sigma r2024-07-17 adds 62 new detection rules covering Kapeka backdoor, Kubernetes, macOS, AWS/cloud, and Windows Recall. • Adds full Kapeka backdoor detection suite: autorun persistence, configuration persistence, execution via RunDLL32, scheduled task creation, and decrypted backdoor indicators. • Adds Kubernetes detection rules for admission controller modification, CronJob/Job modification, rolebinding modification, secrets modification/deletion, and unauthorized/unauthenticated access. • Adds macOS detection rules for file download via nscurl, system information discovery via sysctl, Time Machine backup deletion/disabling, and new Time Machine exclusion additions via tmutil. • Adds Windows Recall feature enablement detection via registry value deletion, registry key, and Reg.EXE execution. • Adds DSInternals suspicious PowerShell cmdlet detection (standard and ScriptBlock variants). • Adds HackTool detections for Evil-WinRm, LaZagne, RemoteKrbRelay (including SMB relay secrets dump), and SharpDPAPI. • Adds cloud-focused rules for malicious IMDS credential usage outside AWS infrastructure, potential malicious CloudTrail System Manager usage, and Ingress/Egress/LoadBalancer/RDS security group modifications. • Adds LocaltoNet and Portmap.IO tunneling service communication detection (Windows and Linux). • Adds DLL sideloading detections for DbgModel.DLL, MpSvc.DLL, and MsCorSvc.DLL. • Adds CVE-2023-1389 exploitation detection for unauthenticated command injection in TP-Link Archer AX21. • Adds DPAPI backup keys and certificate export activity IOC rule. • Adds Windows LAPS credential dump from Entra ID detection. • Adds Hypervisor Enforced Paging Translation disabled detection. • Adds DNS query and network connection rules for AzureWebsites.NET by non-browser processes and Cloudflared tunnel domains. • Adds DarkGate loader drop detection in C:\Temp directory. • Adds Directory Service Restore Mode (DSRM) registry value tampering detection. • Adds detection for COM object hijacking via modification of default system CLSID default value. • Adds detection for BitlockerTogo.EXE execution. • Adds detection for renamed Microsoft Teams execution. • Adds detection for periodic backup of system registry hives being enabled. • Adds detection for PDF file created by RegEdit.EXE. • Adds detection for network connections initiated from the Users\Public folder. • Adds detection for potentially suspicious Qemu usage. • Adds detection for Microsoft Word add-in loaded. • Adds detection for uncommon file creation by MySQL daemon process and uncommon process access rights for target image. • Adds detection for files with system DLL names in unexpected locations. • Adds New Network ACL Entry and New Network Route Added cloud audit rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/r2024-05-13 https://github.com/SigmaHQ/sigma/releases/tag/r2024-05-13 Mon, 13 May 2024 17:50:20 GMT Sigma Rules r2024-05-13 adds 16 new detection rules and updates others • Adds 16 new Sigma detection rules covering Windows Outlook mail file access, Wbadmin backup operations, LaunchAgent/Daemon execution, firewall rule modifications, RDP connections, Packet Capture activity, malware callbacks, WebDAV execution, and UAC security settings. • Updates existing rules with enhanced logic, additional process lists, and expanded file paths to increase detection coverage for scenarios including PDQDeployRunner execution, Scheduled Task creation from temporary folders, and Icacls file hiding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules https://github.com/SigmaHQ/sigma/releases/tag/0.21 https://github.com/SigmaHQ/sigma/releases/tag/0.21 Fri, 08 Apr 2022 22:55:46 GMT New Azure Sentinel, OpenSearch Monitor, Hawk, Datadog, FortiSIEM, Lacework, and Athena SQL backends • Adds `Azure Sentinel` backend for rule conversion • Adds `OpenSearch Monitor` backend for rule conversion • Adds `Hawk` backend for rule conversion • Adds `Datadog` backend for rule conversion • Adds `FortiSIEM` backend for rule conversion • Adds `Lacework` agent data support • Adds `Athena SQL` backend for rule conversion • Adds regex support in SQLite backend Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-rules