Sigma-August-Release-26

Issues

• Improved Linux local account discovery detection and false positives

  LinuxReady to MergeRules
  Unread
  SigmaHQ/sigma#5843·Aadith1422 opened Jan 20, 2026 · Updated Oct 6, 2026
  11

• Tamper firewall by Registry

  Ready to MergeRulesWindows
  Unread
  SigmaHQ/sigma#5172·frack113 opened Jan 26, 2025 · Updated Oct 4, 2026
  10

  

• new: windows discovery rules

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6040·swachchhanda000 opened Jun 2, 2026 · Updated Oct 4, 2026
  3

• new: susp package execution

  LinuxReview NeededRulesWindowsWork In Progress
  Unread
  SigmaHQ/sigma#6054·swachchhanda000 opened Jun 8, 2026 · Updated Oct 4, 2026
  2

• Add rule for Win connection to suspicious WiFi

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6005·privet-username opened May 10, 2026 · Updated Jul 5, 2026
  10

• new: Rules for AWS Bedrock LLMJacking

  Author Input RequiredReview NeededRulesThreat-Hunting
  Unread
  SigmaHQ/sigma#5903·marcopedrinazzi opened Mar 13, 2026 · Updated Jul 3, 2026
  3

• Update Clearing Windows Console History with Extended Coverage

  Author Input RequiredReview NeededRulesWindows
  Unread
  SigmaHQ/sigma#5918·eriknordstrm opened Mar 25, 2026 · Updated Jul 6, 2026
  4

• fix: Install Root Certificate - Match Certificate Trust Utilities In CommandLine

  LinuxReview NeededRules
  Unread
  SigmaHQ/sigma#5986·Bit-ByteBandit opened May 4, 2026 · Updated Oct 4, 2026
  1

• New rules: Microsoft Defender for Office 365

  Ready to MergeRules
  Unread
  SigmaHQ/sigma#5849·Luke57 opened Jan 31, 2026 · Updated Oct 2, 2026
  15

• new: AWS Cloudtrail S3 bucket Block Public Access settings weakened

  Review NeededRules
  Unread
  SigmaHQ/sigma#6118·ShobanChiddarth opened Jul 8, 2026 · Updated Sep 20, 2026
  7

• update: multiple regsvr32 rules tuning

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6122·swachchhanda000 opened Jul 10, 2026 · Updated Jul 10, 2026
  6

• Add rule: HackTool - PrintSpoofer Execution

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6124·ashish-cybersec opened Jul 10, 2026 · Updated Jul 10, 2026
  6

• Add Celery worker shell-spawn detection (rev. of #6108)

  LinuxReview NeededRules
  Unread
  SigmaHQ/sigma#6120·Batina-Jennifer opened Jul 9, 2026 · Updated Jul 10, 2026
  5

• fix: net user rules coverage and deprecate redundant rule

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6107·swachchhanda000 opened Jul 3, 2026 · Updated Jul 10, 2026
  3

• new: EDRChoker QoS ThrottleRate Set by WMI

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6062·0xtamseel opened Jun 12, 2026 · Updated Jul 12, 2026
  10

• new: edrchoker qos throttle rate modification rules

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6063·swachchhanda000 opened Jun 12, 2026 · Updated Jul 12, 2026
  10

• feat: Add Azure application using authentication transfer flow

  Additional Data NeededAuthor Input RequiredReview NeededRules
  Unread
  SigmaHQ/sigma#6126·gregorywychowaniec-zt opened Jul 10, 2026 · Updated Jul 15, 2026
  2

• update: Azure Rules(signin_logs folder) - align detection fields to Event Hub format

  Review NeededRules
  Unread
  SigmaHQ/sigma#5992·fukusuket opened May 8, 2026 · Updated Oct 7, 2026

• update: Azure Rules(audit_logs folder) - align detection fields to Event Hub format

  Review NeededRules
  Unread
  SigmaHQ/sigma#5993·fukusuket opened May 9, 2026 · Updated Sep 16, 2026
  15

• update: Azure Rules(activity_logs folder) - align detection fields to Event Hub format

  Ready to MergeRules
  Unread
  SigmaHQ/sigma#5987·fukusuket opened May 5, 2026 · Updated Oct 4, 2026
  3

• fix: macOS network service scanning filter matches any 'l', not the netcat listen flag

  Author Input RequiredMacOSReview NeededRules
  Unread
  SigmaHQ/sigma#6180·munzzyy opened Jul 27, 2026 · Updated Sep 1, 2026
  8

• update: Add current Acronis Cyber Protect service names to proc_creation_win_susp_service_tamper

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6151·xuanxuan0 opened Jul 17, 2026 · Updated Sep 27, 2026
  3

• Add detection for Lynx Ransomware execution flags

  Review NeededRulesWindows
  Unread
  SigmaHQ/sigma#6082·Swarup-Ingale opened Jun 25, 2026 · Updated Jul 28, 2026
  8

• Update proc_creation_win_findstr_security_keyword_lookup.yml

  Ready to MergeRulesWindows
  Unread
  SigmaHQ/sigma#5085·MalGamy12 opened Nov 20, 2024 · Updated Oct 2, 2026
  11

  

• Add requestrepo.com to DNS Query to External Service Interaction Domains

  Ready to MergeRules
  Unread
  SigmaHQ/sigma#6193·darses opened Jul 30, 2026 · Updated Aug 7, 2026
  4