sigma-rules

credential_access_azure_arc_proxy_secret_configmap_access.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

credential_access_get_secrets_access.toml

Monthly Manifest and Schema Updation (#5920 )

2026-04-06 17:35:33 +05:30

defense_evasion_events_deleted.toml

[Rule Tuning] Removing host.os.type from K8s Rules (#5577 )

2026-01-23 10:41:20 +01:00

discovery_denied_service_account_request.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

discovery_endpoint_permission_enumeration_by_anonymous_user.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

discovery_endpoint_permission_enumeration_by_user_and_srcip.toml

[Rule Tuning] kubernetes.audit.userAgent --> user_agent.original Conversion (#5808 )

2026-03-05 14:13:30 +01:00

discovery_suspicious_self_subject_review.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

execution_anonymous_create_update_patch_pod_request.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

execution_forbidden_creation_request.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

execution_forbidden_request_from_unsual_user_agent.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

execution_unusual_request_response_by_user_agent.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

execution_user_exec_to_pod.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

initial_access_anonymous_request_authorized.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

persistence_cluster_admin_rolebinding_created.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

persistence_exposed_service_created_with_type_nodeport.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

persistence_sensitive_role_creation_or_modification.toml

[Rule Tuning] kubernetes.audit.userAgent --> user_agent.original Conversion (#5808 )

2026-03-05 14:13:30 +01:00

persistence_service_account_bound_to_clusterrole.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

privilege_escalation_container_created_with_excessive_linux_capabilities.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_pod_created_with_hostipc.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_hostnetwork.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_pod_created_with_hostpid.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_privileged_pod_created.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_sensitive_workload_modification_by_user_agent.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_service_account_rbac_write_operation.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

privilege_escalation_suspicious_assignment_of_controller_service_account.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00