SigmaHQ Rules Release Highlights — r2024–01–29

SigmaHQ Rules Release Highlights — r2024–01–29

Sigma Rule Packages for 29–01–2024 are released and available for download. This release saw the addition of 7 new rules, 30 rule updates and 11 rule fixes by 10+ contributors.

New Rules

Some highlights for the newer rules include new Pikabot rule to detect loading of DLL with uncommon extensions

title: Pikabot Fake DLL Extension Execution Via Rundll32.EXE
id: 1bf0ba65-9a39-42a2-9271-31d31bf2f0bf
status: experimental
description: |
    Detects specific process tree behavior linked to …

article conversation link medium people release rules story the conversation