Every published rule
Every rule shows the reporting behind it, the telemetry it needs and where it falls short — before it costs you anything.
45 rules
Suspicious Telegram API Access (via proxy)
mediumThis rule detects anomalous requests to Telegram API without the usual Telegram User-Agent
sigmaWeb2026-01-18Suspicious Successful IIS Shortname Fuzzing Scan (via webserver)
mediumThis rule detects when IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
sigmaWeb2026-01-10Download from Suspicious Dyndns Hosts (via proxy)
mediumThis rule detects download of certain file types from hosts with dynamic DNS names (selected list)
sigmaWeb2026-01-08Suspicious Apache Threading Error (via apache)
mediumThis rule detects an issue in apache logs that reports threading related errors
sigmaWeb2026-01-05Suspicious Crypto Miner User Agent (via proxy)
highThis rule detects anomalous user agent strings used by crypto miners in proxy logs
sigmaWebPaid2026-01-01