Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Rule Library

    Sigma Rules

    Browse detections by severity and log source, with YAML and sample events one click away.

    3,782Total
    3,164Detection
    474Emerging
    141Hunting
    3 rulesInspect a rule without leaving your results.
    lowtestEmerging Threat

    Outlook Task/Note Reminder Received

    Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

    windowsregistry_set
    2023-08-17
    criticaltestEmerging Threat

    CVE-2023-23397 Exploitation Attempt

    Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

    windowssecurity
    2023-03-22
    mediumtestEmerging Threat

    Potential CVE-2023-23397 Exploitation Attempt - SMB

    Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

    windowssmbclient-connectivity
    2026-10-19