Sigma Rule Packages for 20–11–2023 are released and available for download. This release saw the addition of 29 new rules, 44 rule updates and 11 rule fixes by 21+ contributors. New Rules Some highlights for the newer rules include, emerging threat detections for CVE-2023–22518 and CVE-2023–46747 exploitation attempts. title: CVE-2023-22518 Exploitation Attempt…

Since its inception last year the LOLDrivers project has seen mass adoption through out the community, from users to vendors and all in between. With the simple but powerful mission to shine a light on the obscure topic that is living of the land drivers abuse. …

Sigma Rule Packages for 06–11–2023 are released and available for download. This release saw the addition of 27 new rules, 40 rule updates and 9 rule fixes. New Rules Some highlights for the newer rules include, emerging threat detections for Diamond Sleet APT based on Microsoft report covering IOCs and DLL sideloading…

Create and Update Sigma Security Content Directly From The Web Introduction The core of Sigma has always been about sharing detections and helping people around the globe improve their defensive posture by leveraging the many kind of detections hosted on SigmaHQ and other repositories provided by the many contributors in the…

Sigma Rule Packages for 23-10-2023 are released and available for download. This release saw the addition of 21 new rules, 17 rule updates and 24 rule fixes. New Rules Some highlights for the newer rules include, detections for CVE-2023–27363 (Remote Code Execution in Foxit Reader) based on .hta …

From its humble beginnings in 2017, the Sigma project has grown to be one of the most used tools in defensive security and is now used by vendors and thousands of user around the world. The project in itself has seen multiple updates from the introduction of a new tooling…

One of the most common questions we get often from people using and leveraging Sigma rules is “how should we use Sigma rules?”. Sigma offers more than 3000 rules with different maturity and severity levels, described by the status and level fields respectively. Today we’re happy to announce that SigmaHQ…

In 2017 Oddvar Moe published a blog post on how he was able to use BgInfo to bypass application whitelisting. This finding is documented on LOLBAS and it still works today. While looking at this Lolbin this past week. I found that you can achieve the same effect by using…

In the past few months we’ve been busy doing a major overhaul of the Sigma project, which includes rules re-writes, metadata enhancements (titles, descriptions, false positives notes) and much more. Last month we introduced the logsource-guides a new addition that aims to ease the process of mapping the different log…