Rule Library

Sigma Rules

Browse detections by severity and log source, with YAML and sample events one click away.

3,782Total
3,164Detection
474Emerging
141Hunting
1 rulesInspect a rule without leaving your results.
highexperimentalEmerging Threat

FunkLocker Ransomware File Creation

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

windowsfile_event
2025-08-08