Detection Rules

A free, growing library of Sigma detection rules. Every rule is grounded in a real attack LogTriage detects, mapped to its log format and MITRE ATT&CK technique, and validated against real sample logs — it has to fire on the malicious sample and stay quiet on the benign one before it ships.

New rules added regularly. Copy any rule into your SIEM — or upload your logs to LogTriage and let it detect these automatically.

MEDIUM CEF (Common Event Format) ✓ validated

Detect Blocked Exploits, Spyware and Malware in Palo Alto PAN-OS CEF Logs

LTR-0024 · T1190, T1071
HIGH Cisco ASA / FTD ✓ validated

Detect Botnet Traffic Filter Blacklist Hits in Cisco ASA Logs

LTR-0025 · T1071
MEDIUM CrowdStrike Falcon ✓ validated

Detect Encoded PowerShell Commands in CrowdStrike Falcon Process Events

LTR-0026 · T1059.001, T1027.010
CRITICAL Carbon Black ✓ validated

Detect Mimikatz Credential Dumping in Carbon Black EDR Process Events

LTR-0023 · T1003.001, T1003.006, T1558.001
MEDIUM AWS WAF ✓ validated

Detect Managed Rule Group Exploit Blocks in AWS WAF Logs (SQLi, Log4Shell, XSS)

LTR-0021 · T1190
HIGH Azure Activity Log ✓ validated

Detect Owner and User Access Administrator Role Assignments in Azure Activity Logs

LTR-0022 · T1098.003
HIGH AWS Config ✓ validated

Detect CloudTrail Deletion and All-Traffic Security Groups in AWS Config History

LTR-0020 · T1562.007, T1562.008
MEDIUM AWS ALB / ELB ✓ validated

Detect Web Attack Tools (sqlmap, Nikto, Nmap) in AWS ALB / ELB Access Logs

LTR-0019 · T1595.002, T1190
HIGH Google Workspace ✓ validated

Detect Admin Grants and 2-Step Verification Removal in Google Workspace Audit Logs

LTR-0017 · T1098, T1556.006, T1078.004
HIGH AWS S3 Server Access Logs ✓ validated

Detect Anonymous S3 Object Reads in Server Access Logs

LTR-0016 · T1530
HIGH nginx / Apache access logs ✓ validated

Detect SQL Injection Probing and sqlmap in nginx Access Logs

LTR-0015 · T1190, T1595.002
HIGH Zeek ✓ validated

Detect Web Attack Recon and SQL Injection in Zeek HTTP Logs

LTR-0018 · T1595.002, T1595.003, T1190
HIGH Duo Security ✓ validated

Detect MFA Fatigue and Bypass Abuse in Duo Security Logs

LTR-0013 · T1621, T1078.004, T1556.006
MEDIUM Linux auth.log / secure ✓ validated

Detect SSH Brute Force and User Enumeration in Linux auth.log

LTR-0011 · T1110.001, T1110.003
HIGH GitHub Audit Log ✓ validated

Detect Two-Factor Authentication Being Disabled in GitHub Audit Logs

LTR-0014 · T1556.006
HIGH Windows Event Log ✓ validated

Detect Windows Password Spraying with Event ID 4625

LTR-0012 · T1110.003
HIGH Okta System Log ✓ validated

Detect Credential Stuffing in Okta System Log

LTR-0007 · T1110.004, T1110.001
HIGH GCP Cloud Audit Log ✓ validated

Detect IAM Privilege Escalation in GCP Cloud Audit Logs

LTR-0008 · T1098, T1078.004
HIGH Kubernetes Audit Log ✓ validated

Detect Kubernetes Secret Exfiltration in Audit Logs

LTR-0009 · T1552.007, T1078
MEDIUM Cloudflare Logs ✓ validated

Detect Path Traversal & Sensitive-File Recon in Cloudflare Logs

LTR-0010 · T1190, T1595.003
HIGH Microsoft 365 Unified Audit Log ✓ validated

Detect Business Email Compromise via Forwarding and Deleting Inbox Rules (Microsoft 365)

LTR-0006 · T1114.003, T1564.008
HIGH Azure AD Sign-In Logs ✓ validated

Detect Legacy-Protocol Sign-Ins With a Correct Password in Entra ID Logs

LTR-0004 · T1078.004
MEDIUM AWS VPC Flow Logs ✓ validated

Detect Port Scanning in AWS VPC Flow Logs

LTR-0005 · T1046, T1595.001
HIGH nginx / Apache access logs ✓ validated

Detect Credential Stuffing Against Authentication Endpoints (nginx / web logs)

LTR-0001 · T1110.004, T1110.001
HIGH AWS CloudTrail ✓ validated

Detect IAM Privilege Escalation in AWS CloudTrail

LTR-0002 · T1098, T1078.004, T1484
HIGH Microsoft Sysmon ✓ validated

Detect LSASS Credential Dumping with Sysmon

LTR-0003 · T1003.001