Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
SigmaHQ
/
sigma
Public
Uh oh!
There was an error while loading.
Please reload this page
.
Notifications
You must be signed in to change notification settings
Fork
2.8k
Star
10.9k
Code
Issues
5
Pull requests
186
Discussions
Actions
Projects
Wiki
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Wiki
Security and quality
Insights
Actions: SigmaHQ/sigma
Actions
All workflows
Workflows
Copilot
Copilot
Copilot code review
Copilot code review
Create deprecated summary
Create deprecated summary
Create Release
Create Release
Generate Updated ATT&CK Heatmap
Generate Updated ATT&CK Heatmap
Goodlog Tests
Goodlog Tests
Greet First-Time Contributors
Greet First-Time Contributors
pages-build-deployment
pages-build-deployment
PR Labeler Workflow
PR Labeler Workflow
Reference Archiver
Reference Archiver
Show more workflows...
Management
Caches
Deployments
Greet First-Time Contributors
Greet First-Time Contributors
Actions
Loading...
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading.
Please reload this page
.
will be ignored since log searching is not yet available
Show workflow options
Create status badge
Create status badge
Loading
Uh oh!
There was an error while loading.
Please reload this page
.
greetings.yml
will be ignored since log searching is not yet available
1,786 workflow runs
1,786 workflow runs
Event
Filter by Event
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching events.
Status
Filter by Status
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching statuses.
Branch
Filter by Branch
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching branches.
Actor
Filter by Actor
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching users.
new: SSH Authorized Keys Modification
Greet First-Time Contributors
#5390:
Pull request
#6186
opened by
Char0n1507
26s
26s
View #6186
View workflow file
Fix BITS transfer rule filename
Greet First-Time Contributors
#5389:
Pull request
#6185
opened by
hantaee22
1m 15s
1m 15s
View #6185
View workflow file
Add CrashStealer macOS Detection Rules
Greet First-Time Contributors
#5388:
Pull request
#6184
opened by
warlocksmurf
33s
33s
View #6184
View workflow file
Add PamStealer macOS Detection Rules
Greet First-Time Contributors
#5387:
Pull request
#6183
opened by
warlocksmurf
1m 12s
1m 12s
View #6183
View workflow file
fix(posh_ps_create_local_user): add ADSI/WinNT local user creation detection
Greet First-Time Contributors
#5386:
Pull request
#6182
opened by
Char0n1507
1m 19s
1m 19s
View #6182
View workflow file
Add macOS Keychain password retrieval detection
Greet First-Time Contributors
#5385:
Pull request
#6181
opened by
JasonPhang98
21s
21s
View #6181
View workflow file
fix: macOS network service scanning filter matches any 'l', not the netcat listen flag
Greet First-Time Contributors
#5384:
Pull request
#6180
opened by
munzzyy
19s
19s
View #6180
View workflow file
new: suspicious user agent detected in SharePoint request
Greet First-Time Contributors
#5383:
Pull request
#6179
opened by
swachchhanda000
19s
19s
View #6179
View workflow file
Application Firewall Disabled Via Socketfilterfw
Greet First-Time Contributors
#5382:
Pull request
#6178
opened by
Gerrrt
22s
22s
View #6178
View workflow file
Add macOS suspicious UI process termination rule
Greet First-Time Contributors
#5381:
Pull request
#6177
opened by
JasonPhang98
33s
33s
View #6177
View workflow file
Add NTUSER.MAN Persistence and HiveSwarming Detection Rules
Greet First-Time Contributors
#5380:
Pull request
#6176
opened by
Nullbyte0x
30s
30s
View #6176
View workflow file
update: add new crypto mining pools to the list of known domains
Greet First-Time Contributors
#5379:
Pull request
#6175
opened by
chrialonso
33s
33s
View #6175
View workflow file
Add docker socket access via curl or wget
Greet First-Time Contributors
#5378:
Pull request
#6174
opened by
Gerrrt
1m 12s
1m 12s
View #6174
View workflow file
Add gobygo.net to net_dns_external_service_interaction_domains
Greet First-Time Contributors
#5377:
Pull request
#6173
opened by
darses
24s
24s
View #6173
View workflow file
new rule - LuaJit Malware
Greet First-Time Contributors
#5376:
Pull request
#6172
opened by
joshnck
35s
35s
View #6172
View workflow file
feat: Add French error description in Sysmon Configuration Error
Greet First-Time Contributors
#5375:
Pull request
#6171
opened by
gregorywychowaniec-zt
29s
29s
View #6171
View workflow file
Add gobygo.net to rule DNS Query to External Service Interaction Domains
Greet First-Time Contributors
#5374:
Issue
#6170
opened by
darses
20s
20s
View workflow file
new: legacyhive indicators
Greet First-Time Contributors
#5373:
Pull request
#6169
opened by
swachchhanda000
23s
23s
View #6169
View workflow file
add sigma rules for Windows Sandbox
Greet First-Time Contributors
#5372:
Pull request
#6168
opened by
unrooted
1m 2s
1m 2s
View #6168
View workflow file
Typo in proc_creation_win_office_susp_child_processes.yml
Greet First-Time Contributors
#5371:
Pull request
#6167
opened by
chrialonso
1m 21s
1m 21s
View #6167
View workflow file
feat: Add PUA - TruffleHog Execution macOS rule
Greet First-Time Contributors
#5370:
Pull request
#6166
opened by
Breakingpoint608
54s
54s
View #6166
View workflow file
feat: Add Python One-Liners with Base64 Decoding macOS rule
Greet First-Time Contributors
#5369:
Pull request
#6165
opened by
Breakingpoint608
1m 8s
1m 8s
View #6165
View workflow file
new: Suspicious Hidden Password Prompt Via Osascript
Greet First-Time Contributors
#5368:
Pull request
#6164
opened by
IsThisRitika
27s
27s
View #6164
View workflow file
New Agent Skills Installation Attempt Via Node - Linux
Greet First-Time Contributors
#5367:
Pull request
#6163
opened by
IsThisRitika
26s
26s
View #6163
View workflow file
New rule: Script Interpreter Spawning Credential Scanner - macOS
Greet First-Time Contributors
#5366:
Pull request
#6162
opened by
IsThisRitika
1m 9s
1m 9s
View #6162
View workflow file
Previous
1
2
3
4
5
…
71
72
Next
You can’t perform that action at this time.