SigmaHQ Rules Release Highlights — r2024–01–15

SigmaHQ Rules Release Highlights — r2024–01–15

Sigma Rule Packages for 15–01–2024 are released and available for download. This release saw the addition of 19 new rules, 17 rule updates and 5 rule fixes by 18+ contributors.

New Rules

Some highlights for the newer rules include, a detection covering a new LOLbin “Dotnet-Trace.EXE” reported by bohops

title: Binary Proxy Execution Via Dotnet-Trace.EXE
id: 9257c05b-4a4a-48e5-a670-b7b073cf401b
status: experimental
description: Detects commandline arguments for executing a child process via dotnet-trace.exe
references: …

article conversation link medium people release rules story the conversation