Sigma Rule Library

Explore, search and understand Sigma detection rules

A fast, browsable library of community-maintained detection rules from theSigmaHQ repository — searchable by platform, log source, severity and MITRE ATT&CK.

3,791
Sigma rules
30
Products
171
ATT&CK techniques
2026-10-13
Last update
Browse the full library →

Browse by platform

windows2883linux248azure131macos75aws58gcp26zeek24okta24

Main logsource categories

process_creation1637file_event245registry_set225ps_script180image_load125webserver86network_connection68application64

Recently updated rules

Relevant Anti-Virus Signature Keywords In Application Log

high

windows · modified 2026-10-12

Suspicious Double Extension Files

high

windows · modified 2026-10-12

Disable of ETW Trace - Powershell

high

windows · modified 2026-10-12

ETW Trace Evasion Activity

high

windows · modified 2026-10-12

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script

medium

windows · modified 2026-10-06

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index

high

windows · modified 2026-10-06

Renamed Schtasks Execution

high

windows · modified 2026-10-02

Bitsadmin to Uncommon TLD

high

modified 2026-09-30

What is the Sigma Rule Library?

Sigma Rule Library provides a searchable interface for exploring community-maintained Sigma detection rules from theSigmaHQ repository. Security analysts, detection engineers and threat hunters can browse rules by operating system, log source, severity, MITRE ATT&CK technique and rule status. Each rule page includes the original Sigma YAML, detection logic, metadata, references, false positives and links to related detections.

Explore Sigma detections

BrowseWindows,Linux, cloud, network and application detections, search by ATT&CK technique such asT1059 orT1003, and inspect the original rule before using it in your detection engineering workflow.