Skip to content

Actions: SigmaHQ/sigma

Actions

Sigma Rule Tests

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
sigma-test.yml
2,500+ workflow runs
2,500+ workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
chore(tests): fix get_level in deprecated_rules and optimize test_rules execution Sigma Rule Tests #20668: Pull request #6239 opened by Shaivarth
Action required Shaivarth:fix/deprecated-level-and-test-rules-optimization
Shaivarth:fix/deprecated-level-and-test-rules-optimization
Action required
Add Kerberos Pre-Authentication Disabled On A User Account Sigma Rule Tests #20667: Pull request #6238 opened by mmadersbacher
Action required mmadersbacher:rule-asrep-preauth-disabled
mmadersbacher:rule-asrep-preauth-disabled
Action required
🦺 update pySigma-validators-sigmahq to 0.21 Sigma Rule Tests #20666: Pull request #6225 synchronize by frack113
2m 3s frack113:chore/update-sigma-check
frack113:chore/update-sigma-check
2m 3s
feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) Sigma Rule Tests #20665: Pull request #6237 synchronize by AAH20
Action required AAH20:feat/dual-signal-ids-triage
AAH20:feat/dual-signal-ids-triage
Action required
feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) Sigma Rule Tests #20664: Pull request #6237 opened by AAH20
Action required AAH20:feat/dual-signal-ids-triage
AAH20:feat/dual-signal-ids-triage
Action required
🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Sigma Rule Tests #20663: Pull request #6231 synchronize by frack113
2m 5s frack113:sigma-regression-simulation
frack113:sigma-regression-simulation
2m 5s
new: closes #4542 - add rules for IFEO Debugger tampering, disabling usb storage and windowsupdate Sigma Rule Tests #20662: Pull request #6236 opened by swachchhanda000
1m 51s swachchhanda000:ifeo_admin_tools_tamper
swachchhanda000:ifeo_admin_tools_tamper
1m 51s
update: expand sudoers file modification coverage Sigma Rule Tests #20661: Pull request #6235 opened by Haseeb-1698
2m 3s Haseeb-1698:update/sudoers-main-file-coverage
Haseeb-1698:update/sudoers-main-file-coverage
2m 3s
Add macOS rule for sensitive data archived via ditto Sigma Rule Tests #20660: Pull request #6234 opened by clivoa
Action required clivoa:macos-ditto-sensitive-data-archive
clivoa:macos-ditto-sensitive-data-archive
Action required
Add macOS rule for browser credential database query via a database CLI utility Sigma Rule Tests #20659: Pull request #6233 opened by clivoa
Action required clivoa:macos-browser-credential-db-query
clivoa:macos-browser-credential-db-query
Action required
🦺 update pySigma-validators-sigmahq to 0.21 Sigma Rule Tests #20658: Pull request #6225 synchronize by frack113
2m 9s frack113:chore/update-sigma-check
frack113:chore/update-sigma-check
2m 9s
Archive New Rule References Sigma Rule Tests #20657: Pull request #6232 opened by github-actions Bot
2m 5s create-pull-request/reference-archiver
create-pull-request/reference-archiver
2m 5s
🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Sigma Rule Tests #20656: Pull request #6231 synchronize by frack113
1m 46s frack113:sigma-regression-simulation
frack113:sigma-regression-simulation
1m 46s
🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Sigma Rule Tests #20655: Pull request #6231 opened by frack113
29s frack113:sigma-regression-simulation
frack113:sigma-regression-simulation
29s
new: silent-call rules Sigma Rule Tests #20654: Pull request #6230 synchronize by mromanode
Action required mromanode:rules/tomcat-manager-deploy-sudo-gdb
mromanode:rules/tomcat-manager-deploy-sudo-gdb
Action required
new: silent-call rules Sigma Rule Tests #20653: Pull request #6230 opened by mromanode
Action required mromanode:rules/tomcat-manager-deploy-sudo-gdb
mromanode:rules/tomcat-manager-deploy-sudo-gdb
Action required
new: SSH Authorized Keys Made Immutable Sigma Rule Tests #20652: Pull request #6229 opened by marvalous123
1m 43s marvalous123:codex/ssh-authorized-keys-immutable
marvalous123:codex/ssh-authorized-keys-immutable
1m 43s
Add machine-readable JSON changelog to releases Sigma Rule Tests #20651: Pull request #6050 synchronize by swachchhanda000
Action required ni5h4nt:feat/release-changelog-json
ni5h4nt:feat/release-changelog-json
Action required
Typo in proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml Sigma Rule Tests #20650: Pull request #6188 synchronize by swachchhanda000
1m 46s epuni:patch-1
epuni:patch-1
1m 46s
new: detect potential proxy execution via setupugc Sigma Rule Tests #20649: Pull request #6152 synchronize by swachchhanda000
Action required archit15singh:new/setupugc-proxy-execution
archit15singh:new/setupugc-proxy-execution
Action required
new: user creation attempt via adsi Sigma Rule Tests #20648: Pull request #6228 opened by swachchhanda000
1m 48s swachchhanda000:adsi_create_user
swachchhanda000:adsi_create_user
1m 48s
docs: improve description of Sysmon File Executable Creation Detected Sigma Rule Tests #20647: Pull request #6226 synchronize by swachchhanda000
1m 56s valmal04:fix/simplehelp-false-positive
valmal04:fix/simplehelp-false-positive
1m 56s
docs: improve description of Sysmon File Executable Creation Detected Sigma Rule Tests #20646: Pull request #6226 synchronize by swachchhanda000
2m 5s valmal04:fix/simplehelp-false-positive
valmal04:fix/simplehelp-false-positive
2m 5s
docs: improve description of Sysmon File Executable Creation Detected Sigma Rule Tests #20645: Pull request #6226 synchronize by swachchhanda000
Action required valmal04:fix/simplehelp-false-positive
valmal04:fix/simplehelp-false-positive
Action required
fix: AWS IAM Backdoor Users Keys filter using |fieldref|contains Sigma Rule Tests #20644: Pull request #6227 opened by swachchhanda000
1m 55s swachchhanda000:fix/aws-iam-backdoor-users-keys-fieldref
swachchhanda000:fix/aws-iam-backdoor-users-keys-fieldref
1m 55s