Search results

Detect AV‑enumeration via findstr.exe (Quick Heal, Webroot, ESET, Bitdefender, Avast, AVG, Norton, Sophos)

Status: Open.

#5539 In SigmaHQ/sigma;

· Securityinbits opened on Jul 23, 2025

Wazuh/OSSEC Support?

Status: Open.

#5535 In SigmaHQ/sigma;

· xStevex opened on Jul 18, 2025

Filter enhancement for office executables

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5529 In SigmaHQ/sigma;

· rkmbaxed opened on Jul 17, 2025

Suspicious BitLocker Access Agent Update Utility Execution

Status: Open.

#5502 In SigmaHQ/sigma;

· BIitzkrieg opened on Jun 27, 2025

Should the Blackbyte Ransomware Registry rule require all three registry keys to be present and set to 1 to trigger?

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5474 In SigmaHQ/sigma;

· renzhexigua opened on Jun 11, 2025

Enhancement on rule promotions

Status: Open.

#5422 In SigmaHQ/sigma;

· ariel-anieli opened on May 17, 2025

rule archiver should sort references

Status: Open.

#5404 In SigmaHQ/sigma;

· phantinuss opened on May 5, 2025

Rule Does Not Meet Current Sigma Capabilities

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

Status: Open.

#5247 In SigmaHQ/sigma;

· BalsamicSentry opened on Mar 27, 2025

False-Negative: Netsh Firewall Discovery With Full Command Path

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5171 In SigmaHQ/sigma;

· BalsamicSentry opened on Jan 25, 2025

Rule incorrectly identifies our driver (Topaz Systems - www.topazsystems.com) as using Windows Credential Editor

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

False-PositiveIssue reporting a false positive with one of the rulesIssue reporting a false positive with one of the rules

Status: Open.

#5170 In SigmaHQ/sigma;

· m1keam opened on Jan 24, 2025

LDAP Nightmare (CVE-2024-49112)

Status: Open.

#5151 In SigmaHQ/sigma;

· devilman85 opened on Jan 2, 2025

Add Definition to Auditd susp_activity

Create Pull-Requestissues that should be provided as a pull requestissues that should be provided as a pull request

Work In ProgressSome changes are neededSome changes are needed

Status: Open.

#5142 In SigmaHQ/sigma;

· BalsamicSentry opened on Dec 25, 2024