Open-source detection rules, indexed and cross-referenced.
Sigma, YARA, Suricata, Elastic, Splunk, Falco, Wazuh and more, searchable from one box. One schema across formats, every rule linked back to the file it came from.
Tracked sources
sort
- 01 Azure/Azure-Sentinel 1927
- 02 Bert-JanP/Hunting-Queries-Detection-Rules 455
- 03 chainguard-dev/osquery-defense-kit 270
- 04 chronicle/detection-rules 410
- 05 elastic/detection-rules 2216
- 06 elastic/protections-artifacts 4416
- 07 Emerging Threats Open 51596
- 08 falcosecurity/rules 96
- 09 Neo23x0/signature-base 5906
- 10 panther-labs/panther-analysis 1024
- 11 reversinglabs/reversinglabs-yara-rules 1240
- 12 SigmaHQ/sigma 3807
- 13 socfortress/Wazuh-Rules 2235
- 14 splunk/security_content 2193
- 15 Wazuh Core Ruleset 4420
Newest detections
42876 et-open hidden · include- Process command line references a PowerShell probe-file name (possible payload hidden as __PSScriptPolicyTest_) · win.eventdata.commandLine = (?i)__PSScriptPolicyTest_ socfortress-wazuh-rules 2026-11-07
- Sysmon config reload failed at step '' · rule 200640 socfortress-wazuh-rules 2026-11-07
- Sysmon config reload warning at step '' · rule 200641 socfortress-wazuh-rules 2026-11-07
- Sysmon configuration changed: (hash ) · win.system.eventID = 16 socfortress-wazuh-rules 2026-11-07
- Sysmon fatal error () · win.system.eventID = 255, win.eventdata.description = Exit process|Failed to allocate socfortress-wazuh-rules 2026-11-07
- Sysmon lost events (driver queue full). · win.system.eventID = 255, win.eventdata.iD = QUEUE socfortress-wazuh-rules 2026-11-07
- Sysmon lost process telemetry (driver queue full). · win.system.eventID = 255, win.eventdata.iD = QUEUE socfortress-wazuh-rules 2026-11-07
- Sysmon service entered the stopped state · win.system.providerName = Service Control Manager, win.system.eventID = 7036 socfortress-wazuh-rules 2026-11-07
- Sysmon service state changed to Stopped (Sysmon ) · win.eventdata.state = Stopped socfortress-wazuh-rules 2026-11-07
- Sysmon service terminated unexpectedly (System event , crash count ). Endpoint telemetry is blind until it restarts. · win.system.providerName = Service Control Manager, win.system.eventID = 7031$|^7034 socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog alive; Sysmon still · sysmon_watchdog.heartbeat_due = true socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog applied SCM restart-on-failure to Sysmon on · win.eventdata.image = (?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\sc\.exe, win.eventdata.commandLine = (?i)^\\"C:\\\\Windows\\\\System32\\\\sc\.exe\\" (failure Sy… socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog could not configure SCM restart-on-failure for · sysmon_watchdog.recovery = failed socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog could not restart (state ) · sysmon_watchdog.status = restart_failed socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog failed to complete its checks · sysmon_watchdog.status = unknown_error socfortress-wazuh-rules 2026-11-07
Most-covered techniques
top 20One technique, every rule mapped to it, grouped by source.
T1190
Exploit Public-Facing Application
6711
T1568
Dynamic Resolution
5969
T1566
Phishing
1867
T1059
Command and Scripting Interpreter
1504
T1071
Application Layer Protocol
1119
T1027
Obfuscated Files or Information
906
T1078
Valid Accounts
772
T1041
Exfiltration Over C2 Channel
733
T1218
System Binary Proxy Execution
638
T1562
Impair Defenses
554
T1098
Account Manipulation
550
T1059.001
Command and Scripting Interpreter: PowerShell
535
T1105
Ingress Tool Transfer
442
T1003
OS Credential Dumping
378
T1685
Disable or Modify Tools
366
T1059.004
Command and Scripting Interpreter: Unix Shell
364
T1548
Abuse Elevation Control Mechanism
363
T1055
Process Injection
361
T1021
Remote Services
359
T1110
Brute Force
337
Most-covered CVEs
top 12Ranked by how many sources cover the CVE, not how many rules mention it.
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
8
CVE-2024-1709
Authentication bypass using an alternate path or channel
24
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
19
CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and…
16
CVE-2022-22965
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
14
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
14
CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
13
CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
13
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
109
CVE-2026-109618
RCE via OOM corruption
20
CVE-2026-109619
RCE via stale global state
18
CVE-2021-34527
Windows Print Spooler Remote Code Execution Vulnerability
17