| sigma |
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) |
experimental |
2025-10-20 |
| sigma |
Usage Of Web Request Commands And Cmdlets |
test |
2025-10-20 |
| sigma |
Local Accounts Discovery |
test |
2025-10-20 |
| sigma |
Use Short Name Path in Image |
test |
2025-10-20 |
| sigma |
Suspicious File Write to Webapps Root Directory |
experimental |
2025-10-20 |
| sigma |
PowerShell Download Pattern |
test |
2025-10-20 |
| sigma |
ISATAP Router Address Was Set |
experimental |
2025-10-19 |
| sigma |
Suspicious SYSTEM User Process Creation |
test |
2025-10-19 |
| sigma |
Unsigned or Unencrypted SMB Connection to Share Established |
experimental |
2025-10-19 |
| sigma |
Potential Data Exfiltration Activity Via CommandLine Tools |
test |
2025-10-19 |
| sigma |
Powershell Token Obfuscation - Powershell |
test |
2025-10-19 |
| sigma |
Potential Snatch Ransomware Activity |
stable |
2025-10-19 |
| sigma |
Potential LSASS Process Dump Via Procdump |
stable |
2025-10-19 |
| sigma |
AWS ConsoleLogin Failed Authentication |
experimental |
2025-10-19 |
| sigma |
Turla Group Commands May 2020 |
test |
2025-10-19 |
| sigma |
Mint Sandstorm - AsperaFaspex Suspicious Process Execution |
test |
2025-10-19 |
| sigma |
File Access Of Signal Desktop Sensitive Data |
experimental |
2025-10-19 |
| sigma |
PFX File Creation |
test |
2025-10-19 |
| sigma |
Mint Sandstorm - ManageEngine Suspicious Process Execution |
test |
2025-10-19 |
| sigma |
Potential Devil Bait Malware Reconnaissance |
test |
2025-10-19 |
| sigma |
AWS Bucket Deleted |
experimental |
2025-10-19 |
| sigma |
AWS EnableRegion Command Monitoring |
experimental |
2025-10-19 |
| sigma |
Suspicious Network Command |
test |
2025-10-19 |
| sigma |
AWS VPC Flow Logs Deleted |
experimental |
2025-10-19 |
| sigma |
Kerberoasting Activity - Initial Query |
test |
2025-10-19 |
| sigma |
Kaspersky Endpoint Security Stopped Via CommandLine - Linux |
experimental |
2025-10-18 |
| sigma |
GitHub Repository Archive Status Changed |
experimental |
2025-10-18 |
| sigma |
WannaCry Ransomware Activity |
test |
2025-10-18 |
| sigma |
GitHub Repository Pages Site Changed to Public |
experimental |
2025-10-18 |
| sigma |
AWS KMS Imported Key Material Usage |
experimental |
2025-10-18 |
| sigma |
Firewall Configuration Discovery Via Netsh.EXE |
test |
2025-10-18 |
| sigma |
Suspicious BitLocker Access Agent Update Utility Execution |
experimental |
2025-10-18 |
| sigma |
BaaUpdate.exe Suspicious DLL Load |
experimental |
2025-10-18 |
| sigma |
PUA - Restic Backup Tool Execution |
experimental |
2025-10-17 |
| sigma |
Suspicious Access to Sensitive File Extensions - Zeek |
test |
2025-10-17 |
| sigma |
Audit Rules Deleted Via Auditctl |
experimental |
2025-10-17 |
| sigma |
Alternate PowerShell Hosts - PowerShell Module |
test |
2025-10-17 |
| sigma |
Mask System Power Settings Via Systemctl |
experimental |
2025-10-17 |
| sigma |
Account Tampering - Suspicious Failed Logon Reasons |
test |
2025-10-17 |
| sigma |
Potentially Suspicious Desktop Background Change Via Registry |
test |
2025-10-17 |