Issues

• Nslookup PowerShell Download Cradle: OriginalFileName '\nslookup.exe' with a leading backslash never matches

  SigmaHQ/sigma#6448 · Filter by author JustinHendersonSMAPPER opened on Oct 10, 2026

• Exchange PowerShell Cmdlet History Deleted: startswith on a path fragment means the rule never matches

  SigmaHQ/sigma#6447 · Filter by author JustinHendersonSMAPPER opened on Oct 10, 2026

• EVTX Created In Uncommon Location: filter_main_baseimage endswith a trailing backslash never matches

  SigmaHQ/sigma#6446 · Filter by author JustinHendersonSMAPPER opened on Oct 10, 2026
  1

• Update the two webserver rules to the taxonomy field names cs(User-Agent) and cs(Referrer)

  Work In Progress
  SigmaHQ/sigma#6431 · Filter by author frack113 opened on Oct 6, 2026

• Coverage Gap: proc_creation_win_schtasks_creation — Schedule.Service COM Object Bypass

  False-Positive
  SigmaHQ/sigma#6249 · Filter by author WiLL75G opened on Aug 22, 2026
  2

  

• [Rule modification] Testing Usage of Uncommonly Used Port

  SigmaHQ/sigma#6132 · Filter by author norbert791 opened on Jul 13, 2026
  5

• Changelog: add guid's?

  Enhancement
  SigmaHQ/sigma#5590 · Filter by author sandervandegeijn opened on Aug 11, 2025
  12

  

• LDAP Nightmare (CVE-2024-49112)

  SigmaHQ/sigma#5151 · Filter by author devilman85 opened on Jan 2, 2025
  6

  

• Suspicious Process DNS Query Known Abuse Web Services

  SigmaHQ/sigma#4748 · Filter by author cY83rR0H1t opened on Mar 1, 2024
  

• Based on suspicious regedit changes sigma rules

  Work In Progress
  SigmaHQ/sigma#4542 · Filter by author HydraDragonAntivirus opened on Nov 4, 2023
  3