Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
SigmaHQ
/
sigma
Public
Uh oh!
There was an error while loading.
Please reload this page
.
Notifications
You must be signed in to change notification settings
Fork
2.8k
Star
10.9k
Code
Issues
5
Pull requests
186
Discussions
Actions
Projects
Wiki
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Wiki
Security and quality
Insights
Actions: SigmaHQ/sigma
Actions
All workflows
Workflows
Copilot
Copilot
Copilot code review
Copilot code review
Create deprecated summary
Create deprecated summary
Create Release
Create Release
Generate Updated ATT&CK Heatmap
Generate Updated ATT&CK Heatmap
Goodlog Tests
Goodlog Tests
Greet First-Time Contributors
Greet First-Time Contributors
pages-build-deployment
pages-build-deployment
PR Labeler Workflow
PR Labeler Workflow
Reference Archiver
Reference Archiver
Show more workflows...
Management
Caches
Deployments
Greet First-Time Contributors
Greet First-Time Contributors
Actions
Loading...
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading.
Please reload this page
.
will be ignored since log searching is not yet available
Show workflow options
Create status badge
Create status badge
Loading
Uh oh!
There was an error while loading.
Please reload this page
.
greetings.yml
will be ignored since log searching is not yet available
1,786 workflow runs
1,786 workflow runs
Event
Filter by Event
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching events.
Status
Filter by Status
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching statuses.
Branch
Filter by Branch
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching branches.
Actor
Filter by Actor
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
No matching users.
RoguePlanet Exploit Rules
Greet First-Time Contributors
#5315:
Pull request
#6109
opened by
st0pp3r
20s
20s
View #6109
View workflow file
Add rule for LLM agent indirect prompt injection detection
Greet First-Time Contributors
#5314:
Pull request
#6108
opened by
Batina-Jennifer
1m 6s
1m 6s
View #6108
View workflow file
fix: net user rules coverage and deprecate redundant rule
Greet First-Time Contributors
#5313:
Pull request
#6107
opened by
swachchhanda000
19s
19s
View #6107
View workflow file
Add proxy rule: Base64 Encoded URL In Web Request
Greet First-Time Contributors
#5312:
Pull request
#6106
opened by
Usurper-Vladimir
1m 20s
1m 20s
View #6106
View workflow file
Add rule detecting inbound SSH drops on MikroTik WAN
Greet First-Time Contributors
#5311:
Pull request
#6105
opened by
OriolesMagic333
1m 27s
1m 27s
View #6105
View workflow file
Add rule: indirect command execution via scp.exe
Greet First-Time Contributors
#5310:
Pull request
#6104
opened by
ashish-cybersec
23s
23s
View #6104
View workflow file
Add rule: arbitrary command execution via git config override
Greet First-Time Contributors
#5309:
Pull request
#6103
opened by
ashish-cybersec
1m 17s
1m 17s
View #6103
View workflow file
improve phishing detection
Greet First-Time Contributors
#5308:
Pull request
#6102
opened by
Dev2023-Op
28s
28s
View #6102
View workflow file
Improved phishing detection
Greet First-Time Contributors
#5307:
Issue
#6101
opened by
Dev2023-Op
23s
23s
View workflow file
new: wmi activity ntEventLogFile ClearEventLog failed attempts
Greet First-Time Contributors
#5306:
Pull request
#6100
opened by
swachchhanda000
30s
30s
View #6100
View workflow file
Add detection for PnPUtil driver and device removal activity
Greet First-Time Contributors
#5305:
Pull request
#6099
opened by
Kvvvvvvvvv
6h 0m 16s
6h 0m 16s
View #6099
View workflow file
Add an exception for vmmemwsl for suspicious process image path missing
Greet First-Time Contributors
#5304:
Issue
#6096
opened by
crayy8
22s
22s
View workflow file
Add cross-platform discovery/collection rules
Greet First-Time Contributors
#5303:
Pull request
#6095
opened by
einlamye
19s
19s
View #6095
View workflow file
Add Sysinternals tooling and driver/UAC detection rules
Greet First-Time Contributors
#5302:
Pull request
#6094
opened by
einlamye
21s
21s
View #6094
View workflow file
Add Active Directory / Kerberos attack detection rules
Greet First-Time Contributors
#5301:
Pull request
#6093
opened by
einlamye
25s
25s
View #6093
View workflow file
Add ADS abuse and signed-binary LOLBIN detection rules
Greet First-Time Contributors
#5300:
Pull request
#6092
opened by
einlamye
25s
25s
View #6092
View workflow file
Enrich ATT&CK tags (T1654/T1652) and dedupe bcdedit safeboot logic
Greet First-Time Contributors
#5299:
Pull request
#6091
opened by
einlamye
29s
29s
View #6091
View workflow file
Sysinternals: add ARM64 (*64a.exe) binary coverage
Greet First-Time Contributors
#5298:
Pull request
#6090
opened by
einlamye
1m 24s
1m 24s
View #6090
View workflow file
rules/windows: add Dev Tunnel hosting or creation process_creation rule
Greet First-Time Contributors
#5297:
Pull request
#6089
opened by
BL3IP
1m 9s
1m 9s
View #6089
View workflow file
detect phishing and scam websites
Greet First-Time Contributors
#5296:
Pull request
#6088
opened by
Dev2023-Op
1m 19s
1m 19s
View #6088
View workflow file
Add UNC2814 LLM API abuse Gemini C2 from scripting host
Greet First-Time Contributors
#5295:
Pull request
#6087
opened by
WRG-11
23s
23s
View #6087
View workflow file
rules: add AWS Secrets Manager BatchGetSecretValue bulk retrieval (T1555.006)
Greet First-Time Contributors
#5294:
Pull request
#6086
opened by
adamalizeerj
1m 13s
1m 13s
View #6086
View workflow file
new: bruteforce detection for a single account based on Event 4625
Greet First-Time Contributors
#5293:
Pull request
#6085
opened by
Hydra2113
1m 19s
1m 19s
View #6085
View workflow file
Add DDoS attack detection rules
Greet First-Time Contributors
#5292:
Pull request
#6084
opened by
jacob-masse
1m 13s
1m 13s
View #6084
View workflow file
new: Dindoor Backdoor Malware rule
Greet First-Time Contributors
#5291:
Pull request
#6083
opened by
marcopedrinazzi
26s
26s
View #6083
View workflow file
Previous
1
2
3
4
5
6
7
8
…
71
72
Next
You can’t perform that action at this time.