Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Rule Library

    Sigma Rules

    Browse detections by severity and log source, with YAML and sample events one click away.

    3,782Total
    3,164Detection
    474Emerging
    141Hunting
    4 rulesInspect a rule without leaving your results.
    highstableEmerging Threat

    Potential CVE-2021-26857 Exploitation Attempt

    Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

    windowsprocess_creation
    2023-02-07
    hightestEmerging Threat

    CVE-2021-26858 Exchange Exploitation

    Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for creation of non-standard files on disk by Exchange Server’s Unified Messaging service which could indicate dropping web shells or other malicious content

    windowsfile_event
    2022-10-09
    criticaltestEmerging Threat

    HAFNIUM Exchange Exploitation Activity

    Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

    windowsprocess_creation
    2023-03-09
    hightestEmerging Threat

    Exchange Exploitation Used by HAFNIUM

    Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

    Generalwebserver
    2023-01-02