Skip to content

Sigma rules

Named by 5 kept items in this workspace.

Search every workspace for Sigma rules. It matches the name as written, so it can find other things that share it.

The items that name it 5

  • It’s Not Safe To Pay SafePa
    writeup2026-07-17It is written here as Sigma rules (various, Huntress- and SigmaHQ-authored).

    Detection rules provided for Windows Defender GUI/registry tampering, RTP disabling, malware protection configuration changes, CMSTPLUA COM interface abuse, and suspicious WinRAR usage.

  • mukul975/Anthropic-Cybersecurity-Skills
    repo2026-05-26

    Detection rules cited as an example of what a junior analyst should know, specifically rules catching Kerberoasting

  • Bullying LLMs
    writeup2026-05-13

    5,800+ public Sigma rules indexed into the local offensive security knowledge base

  • The ADWS Architecture That Hides PowerShell AD Enumeration
    writeup2026-04-08

    Used to build detections parsing Event 1644 LDAP filters in earlier parts of the series

  • ESXi Exploitation in the Wild
    writeup2026-01-07

    Rules referenced to detect key behaviors from exploit.exe enabling ESXi exploitation and VM escape

All technologies in this workspace.