Rule Library

Sigma Rules

Browse detections by severity and log source, with YAML and sample events one click away.

3,782Total

3,164Detection

474Emerging

141Hunting

Filters

Type

Severity

Status

Product

CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File

Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

windowsfile_event

2023-08-30

hightestEmerging Threat

CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process

Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

windowsprocess_creation

2024-01-22