Critical 153High 1808Medium 1526Low 449Informational 31
DETECTRASigma Rule Search Engine
NEXT RULE SYNCSYNC PENDING
OPEN DETECTION INTELLIGENCE
⊞Windows3230◉Linux209△Azure123
RULE CONVERTER
Turn Sigma into a SIEM-ready query.
Paste your own rule or send one directly from the detection index.
5 TARGETS READY
QUICK SEARCH
3967 RULES MATCHING ALL SYSTEMS
PAGE 1 / 397mediumab18a523-e093-4ac6● experimental2026-10-21
AWS Bucket Block Public Access Weakened
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
AWSattack.defense-impairmentattack.t1686.001
medium288a39fc-4914-4831● test2026-10-21
Azure Active Directory Hybrid Health AD FS New Server
This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.
Azureattack.defense-impairmentattack.t1578
medium48739819-8230-4ee3● test2026-10-21
Azure Active Directory Hybrid Health AD FS Service Delete
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
Azureattack.defense-impairmentattack.t1578.003
low557e3bd3-7f21-495d● experimental2 VARIANTS2026-10-20
AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. This rule triggers on the AppLocker audit events and requires review of the reported path against the local AppLocker policy. Since this rule triggers solely on event IDs without path-based filtering, tuning and false positive suppression must be handled at the AppLocker policy level by the policy author, not via Sigma filters. Analysts should review the reported FullFilePath and correlate with the local AppLocker policy to determine whether the activity is expected or warrants investigation.
Windowsattack.executionattack.t1204.002
medium962fe167-e48d-4fd6● test2 VARIANTS2026-10-20
LSASS Access From Non System Account
Detects potential mimikatz-like tools accessing LSASS from non system account
Windowsattack.credential-accessattack.t1003.001
medium4a1b6da0-d94f-4fc3● test2 VARIANTS2026-10-20
Potentially Suspicious AccessMask Requested From LSASS
Detects process handle on LSASS process with certain access mask
Windowsattack.credential-accesscar.2019-04-004
mediuma18dd26b-6450-46de● test2 VARIANTS2026-10-20
Potentially Suspicious GrantedAccess Flags On LSASS
Detects process access requests to LSASS process with potentially suspicious access flags
Windowsattack.credential-accessattack.t1003.001
mediumc187c075-bb3e-4c62● test2 VARIANTS2026-10-19
A Rule Has Been Deleted From The Windows Firewall Exception List
Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall
Windowsattack.defense-impairmentattack.t1686.003
medium64e8e417-c19a-475a● test3 VARIANTS2026-10-19
Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Windowsattack.executionattack.t1059.001
medium84f52741-8834-4a8c● test3 VARIANTS2026-10-19
DllUnregisterServer Function Call Via Msiexec.EXE
Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Windowsattack.stealthattack.t1218.007