SigmaHQ Rules Release Highlights — r2024–02–26

SigmaHQ Rules Release Highlights — r2024–02–26

Sigma Rule Packages for 26–02–2024 are released and available for download. This release saw the addition of 31 new rules, 16 rule updates by 9 contributors.

New Rules

Some highlights for the newer rules include new rules related to the ScreenConnect “Slash and Grab” exploit CVE-2024–1708 and CVE-2024–1709.

title: CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation
id: d27eabad-9068-401a-b0d6-9eac744d6e67
status: experimental
description: |
    Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of …

article conversation curl data data export deletion export global link medium people permission project release rules scanning story tampering the conversation