List view

Add Correlation Support

Work In ProgressSome changes are neededSome changes are needed

Status: Draft (not ready).

SigmaHQ/sigmanumber 5759

#5759 In SigmaHQ/sigma;

· nasbench opened on Nov 17, 2025

Tamper firewall by Registry

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5172

#5172 In SigmaHQ/sigma;

· frack113 opened on Jan 26, 2025

Add more keys concerned with lsa ppl protection

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5399

#5399 In SigmaHQ/sigma;

· swachchhanda000 opened on May 1, 2025

new: wmic service manipulation

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5827

#5827 In SigmaHQ/sigma;

· swachchhanda000 opened on Jan 7, 2026

feat: Shai-Hulud: The Second Coming Rules

Emerging-Threats

LinuxPull request add/update linux related rulesPull request add/update linux related rules

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5772

#5772 In SigmaHQ/sigma;

· swachchhanda000 opened on Nov 25, 2025

update: suspicious file activity related to file sharing websites

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5574

#5574 In SigmaHQ/sigma;

· swachchhanda000 opened on Aug 1, 2025

New rule: suspicious emails delivered in Microsoft 365

Review NeededThe PR requires reviewThe PR requires review

Rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5846

#5846 In SigmaHQ/sigma;

· marcopedrinazzi opened on Jan 27, 2026

New rule system language discovery via reg.exe

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5845

#5845 In SigmaHQ/sigma;

· marcopedrinazzi opened on Jan 26, 2026

New email hiding rule, fix typo and tags in email forwarding rule (m365 audit logs)

Review NeededThe PR requires reviewThe PR requires review

Rules

Threat-Hunting

Status: Open (in progress).

SigmaHQ/sigmanumber 5844

#5844 In SigmaHQ/sigma;

· marcopedrinazzi opened on Jan 26, 2026

Improved Linux local account discovery detection and false positives

LinuxPull request add/update linux related rulesPull request add/update linux related rules

Review NeededThe PR requires reviewThe PR requires review

Rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5843

#5843 In SigmaHQ/sigma;

· Aadith1422 opened on Jan 20, 2026

fix: edr-freeze rules fps analysed from VT

Review NeededThe PR requires reviewThe PR requires review

Rules

Threat-Hunting

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5832

#5832 In SigmaHQ/sigma;

· swachchhanda000 opened on Jan 9, 2026

Update proc_creation_lnx_env_shell_invocation.yml so that it covers all the examples given in the referenced link

LinuxPull request add/update linux related rulesPull request add/update linux related rules

Review NeededThe PR requires reviewThe PR requires review

Rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5828

#5828 In SigmaHQ/sigma;

· Zirbo opened on Jan 8, 2026

New: mail forwarding and hiding rules via powershell cmdlets

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

Review NeededThe PR requires reviewThe PR requires review

Rules

Threat-Hunting

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5860

#5860 In SigmaHQ/sigma;

· marcopedrinazzi opened on Feb 10, 2026

new: Bthprops.Cpl sideloading by fsquirt.exe

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

Review NeededThe PR requires reviewThe PR requires review

Rules

WindowsPull request add/update windows related rulesPull request add/update windows related rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5856

#5856 In SigmaHQ/sigma;

· swachchhanda000 opened on Feb 4, 2026

Improve description and false positives for Linux security tool disablement detection

Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rules

LinuxPull request add/update linux related rulesPull request add/update linux related rules

Review NeededThe PR requires reviewThe PR requires review

Rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5853

#5853 In SigmaHQ/sigma;

· amittrap opened on Feb 3, 2026

Improve macOS "Credentials from Password Stores - Keychain" rule

MacOSPull request add/update macos related rulesPull request add/update macos related rules

Review NeededThe PR requires reviewThe PR requires review

Rules

Status: Open (in progress).

SigmaHQ/sigmanumber 5848

#5848 In SigmaHQ/sigma;

· Niicolaa opened on Jan 30, 2026