🧰 Sigma

The items that name it 27

• ikow/php2shell-poc
  repoas classification.technologies2026-10-21
• DFIR Radar (@DFIR_Radar) on X
  threadas classification.technologies2026-10-19
• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeupas tools2026-10-08

  Detection rule format; Huntress published four Sigma rules for this campaign in its threat-intel repository.

• tl;dr sec #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes
  articleas tools2026-10-08It is written here as SIGMA (open-source detection rule repository).

  open-source detection rule repository

• jiwoochris/artex-global
  repoas tools2026-10-03

  Rule format used for the repository's host, log and SIEM detections of ARTEX activity

• Adversarial-Detection-Engineering/adeskills
  repoas affected products2026-09-27It is written here as Sigma (detection rules).

  public ruleset analyzed for detection-logic bug patterns

• OAuth Token Theft Through Microsoft's Front Door | Huntress
  writeupas tools2026-09-23

  Rule format used to author the detection rule 'Sideloaded AppX Web Host Beaconing to Non-Microsoft Host' keyed on MSAppHost/3.0 user agent

• ThreatIntel-Aggregator
  repoas tools2026-09-17

  Supported detection rule format (YAML, single- or multi-document) for local import

• DeathShotXD/0xCr0ssCrush
  repoas classification.technologies2026-09-14
• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas tools2026-08-13

  Rule format whose style Daniel Koifman wants for agent abuse patterns

• SiberKapan
  repoas classification.technologies2026-08-08
• awesome-osint-arsenal
  repoas tools2026-07-31It is written here as Sigma (detection rules).

  detection rules

• It’s Not Safe To Pay SafePa
  writeupas classification.technologies2026-07-17
• XORCISM-AI/XORCISM
  repoas classification.technologies2026-07-01
• 0xMohammedHassan/morphkatz
  repoas tools2026-05-07

  detection content format referenced as a byte-pattern detection type MorphKatz can defeat

• The (!FALSE) Pattern | Huntress
  writeupas tools2026-01-29

  Rule format used to build two detection rules for SOAPHound based on Event ID 1644 patterns (! (FALSE)), SDFlags:0x7, and specific attribute lists

• SDFlags | Huntress
  articleas classification.technologies2026-01-15
• ESXi Exploitation in the Wild
  writeupas classification.technologies2026-01-07
• The LDAP Whitespace Problem | Huntress
  writeupas tools2025-12-30

  rule format used to write detection logic (selection/condition syntax) for SIEM detections

• The OID Problem: Writing LDAP Detections That Actually Work
  writeupas tools2025-12-16

  Detection rule format used to write and share the LDAP-based detection rules described in the post

• PrivEsc: Abusing the Service Control Manager for Stealthy & Persistent LPE
  writeupas classification.technologies2023-02-27
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
  advisoryas classification.technologies
• Sigma r2026-07-01 — 20 new detection rules
  repoas tools

  Open-source generic signature format for SIEM detection rules; this release (r2026-07-01) adds 20 new rules, updates existing ones, and applies fixes

• CAIRN — Cisco Talos AI-Malware-Hunting Toolkit
  repoas classification.technologies
• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
  advisoryas classification.technologies
• Agent Threat Rules (ATR) — open detection-rule standard for AI agent threats
  repoas tools

  Generic SIEM log-based detection rule format (architectural precedent for ATR)

• Agent Threat Rules (ATR) — Sigma/YARA-style open detection format for AI agent threats
  otheras tools

  Generic detection rule format for SIEM log-based detections (cited as architectural precedent for ATR)