Sigma r2026-07-01 — 20 new detection rules

What it is

Sigma release r2026-07-01, published 9 Jul, adds 20 new detection rules and modifies dozens more across Windows, Linux, and macOS, authored by a large community contributor list (frack113, nasbench, Neo23x0, fukusuket, and ~25 others credited).

How it works

The update targets several distinct threat clusters with named rules:

• CVE-2026-41089: a new rule "LSASS Crash Via Netlogon Stack Buffer Overflow" detects exploitation of this specific Netlogon vulnerability.
• TanStack supply-chain attack: five separate new rules cover DNS indicators, execution indicators (Windows and Linux variants), and file-creation indicators (Windows and Linux variants) — a notably granular, platform-split detection set for one campaign.
• WMI abuse: new rules for registry enumeration via StdRegProv and failed event-log clearing via NTEventLogFile.ClearEventLog, plus expanded/renamed existing Wmic.EXE rules (process creation, process reconnaissance, process termination) with added discovery tags and terminate filters.
• AF_ALG kernel crypto exploit indicator (Linux) and RedTail cryptominer user-agent detection are new.
• ARM64 coverage gap closed: dozens of existing rules (LSASS access, Procdump, Sysinternals tools, AMSI/CredUI DLL loads, etc.) now match the *64a.exe binary naming convention used by ARM64 builds — meaning prior versions of these rules would silently miss ARM64 variants of the same tools.
• File-sharing-domain IOC lists were expanded across ~12 separate rules (BITS, curl, wget, certutil, PowerShell, bitsadmin downloads).

Preconditions / Affected

Relevant to environments ingesting Sigma rules into SIEM/EDR detection pipelines (any backend Sigma compiles to). ARM64 fixes only matter for environments running ARM64 Windows binaries. The CVE-2026-41089 rule assumes exposure to the underlying Netlogon flaw (no CVSS or affected-version range given on this page).

What to do

Pull release r2026-07-01 (or later) into your rule pipeline to gain the 20 new rules and propagate the fixes. If running ARM64 Windows endpoints, prioritize re-deploying the ~25 updated rules carrying the *64a.exe fix, since earlier rule versions had a detection gap there. Also notable fixes: a tightened CobaltStrike named-pipe regex, a corrected Dir vs rmdir enumeration mismatch, and a fixed broken UFW-disable detection. The page recommends the "Core" ruleset for newcomers; package selection detail is deferred to a separate Releases.md file not reproduced here.

Caveats

The page gives no CVSS score, affected-version range, or exploitation detail for CVE-2026-41089 beyond the rule name/mechanism (LSASS crash via Netlogon stack buffer overflow). No false-positive rates or testing notes are provided for the new TanStack or RedTail rules.