hightestEmerging Threat
Potential EmpireMonkey Activity
Detects potential EmpireMonkey APT activity
windowsprocess_creation
2023-03-09
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
criticaltestEmerging Threat
Griffon Malware Attack Pattern
Detects process execution patterns related to Griffon malware as reported by Kaspersky
windowsprocess_creation
2023-03-09
hightestEmerging Threat
Potential APT FIN7 Related PowerShell Script Created
Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts
windowsfile_event
2026-11-02
hightestEmerging Threat
Potential APT FIN7 POWERHOLD Execution
Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs
windowsps_script
2023-05-04
hightestEmerging Threat
Potential POWERTRASH Script Execution
Detects potential execution of the PowerShell script POWERTRASH
windowsps_script
2023-05-04