sigma-rules

defense_evasion_events_deleted.toml

[Rule Tuning] Removing host.os.type from K8s Rules (#5577 )

2026-01-23 10:41:20 +01:00

discovery_denied_service_account_request.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

discovery_endpoint_permission_enumeration_by_anonymous_user.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

discovery_endpoint_permission_enumeration_by_user_and_srcip.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

discovery_suspicious_self_subject_review.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

execution_anonymous_create_update_patch_pod_request.toml

[New Rules] Misc. D4C Rules re: (un)Authenticated API Access (#5661 )

2026-02-04 09:58:42 +01:00

execution_forbidden_creation_request.toml

[Rule Tuning] Removing host.os.type from K8s Rules (#5577 )

2026-01-23 10:41:20 +01:00

execution_forbidden_request_from_unsual_user_agent.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

execution_unusual_request_response_by_user_agent.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

execution_user_exec_to_pod.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

initial_access_anonymous_request_authorized.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

persistence_cluster_admin_rolebinding_created.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

persistence_exposed_service_created_with_type_nodeport.toml

[Rule Tuning] Sharpening Kubernetes Rules Indices (#4822 )

2025-06-24 14:11:31 +02:00

persistence_sensitive_role_creation_or_modification.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

persistence_service_account_bound_to_clusterrole.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

privilege_escalation_container_created_with_excessive_linux_capabilities.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_hostipc.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_hostnetwork.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_hostpid.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_privileged_pod_created.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00

privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

privilege_escalation_service_account_rbac_write_operation.toml

Monthly Manifest and Schema Updation (#5697 )

2026-02-10 09:17:04 +05:30

privilege_escalation_suspicious_assignment_of_controller_service_account.toml

[Rule Tuning] Full Kubernetes Ruleset (#5659 )

2026-02-04 10:42:41 +01:00