Critical 153High 1808Medium 1529Low 449Informational 31
DETECTRASigma Rule Search Engine
NEXT RULE SYNCSYNC PENDING
OPEN DETECTION INTELLIGENCE
⊞Windows3233◉Linux209△Azure123
RULE CONVERTER
Turn Sigma into a SIEM-ready query.
Paste your own rule or send one directly from the detection index.
5 TARGETS READY
QUICK SEARCH
3970 RULES MATCHING ALL SYSTEMS
PAGE 1 / 397medium53d4bb30-3f36-4e8a● test3 VARIANTS2026-11-04
COM Object Execution via Xwizard.EXE
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.
Windowsattack.stealthattack.t1218
high1117f6c7-1c68-9c6e● experimental2026-11-03
CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
Detects an Application Error (EventID 1000) where LSASS crashes in the Windows LDAP client module WLDAP32.dll. This is the crash telemetry produced by the public LDAP Nightmare proof-of-concept for CVE-2024-49113 (denial of service). CVE-2024-49112 is the related LDAP remote code execution issue on the same LDAP client path. The published exploit chain covers the denial of service only: code execution would run inside LSASS and leave no Windows log of its own. The cve.2024-49112 tag marks that shared path, not a coverage claim: this rule detects the CVE-2024-49113 denial of service only.
Windowsattack.impactattack.t1499
low676381a6-15ca-4d73● test2026-11-03
Local Groups Discovery Attempt - Linux
Detects attempts to enumerate local groups and group membership via common Linux utilities and sensitive file access. Adversaries may read files such as /etc/group and /etc/gshadow, or use tools like getent and groups to identify group memberships and privilege assignments on a compromised system.
Linuxattack.discoveryattack.t1069.001
lowb45e3d6f-42c6-47d8● test2026-11-03
Local System Accounts Discovery Attempt - Linux
Detects attempts to enumerate local user accounts via common Linux utilities and sensitive file access. Adversaries may read files such as /etc/passwd, /etc/shadow, and /etc/sudoers, or use tools like getent, id, who, and finger to identify accounts and privilege levels on a compromised system.
Linuxattack.discoveryattack.t1087.001
low4c519226-f0cd-4471● test2026-11-03
System Network Connections Discovery - Linux
Detects attempts to discover system network connections via common Linux utilities. Adversaries may use tools such as netstat, ss, or lsof to enumerate active connections, open ports, and listening services on a compromised system.
Linuxattack.discoveryattack.t1049
high28365632-fa32-14dc● test2026-11-02
Lazarus APT DLL Sideloading Activity
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
Windowsattack.privilege-escalationattack.persistence
high926c11ac-e9fd-8dba● test2026-11-02
Potential APT FIN7 Related PowerShell Script Created
Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts
Windowsattack.executionattack.g0046
medium7482a6b9-2304-1d3c● test2 VARIANTS2026-11-01
ClickOnce Deployment Execution - Dfsvc.EXE Child Process
Detects child processes of "dfsvc" which indicates a ClickOnce deployment execution.
Windowsattack.executiondetection.threat-hunting
low399dee28-dfcb-7990● test2026-11-01
Creation of an Executable by an Executable
Detects the creation of an executable by another executable.
Windowsattack.resource-developmentattack.t1587.001
medium6c304b02-06e6-402d● test3 VARIANTS2026-11-01
Potential SentinelOne Shell Context Menu Scan Command Tampering
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Windowsattack.persistence