1200KM / tag
low — severity tag
253 related reference pages for severity: low.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- A Member Was Added to a Security-Enabled Global Group · sigma-rule
- A Member Was Removed From a Security-Enabled Global Group · sigma-rule
- A Security-Enabled Global Group Was Deleted · sigma-rule
- Access To ADMIN$ Network Share · sigma-rule
- Active Directory Certificate Services Denied Certificate Enrollment Request · sigma-rule
- Active Directory Computers Enumeration With Get-AdComputer · sigma-rule
- Active Directory Group Enumeration With Get-AdGroup · sigma-rule
- AD Groups Or Users Enumeration Using PowerShell - PoshModule · sigma-rule
- AD Groups Or Users Enumeration Using PowerShell - ScriptBlock · sigma-rule
- Add or Remove Computer from DC · sigma-rule
- Admin User Remote Logon · sigma-rule
- Application Uninstalled · sigma-rule
- Audio Capture · sigma-rule
- Automated Collection Bookmarks Using Get-ChildItem PowerShell · sigma-rule
- AWS EC2 VM Export Failure · sigma-rule
- AWS EKS Cluster Created or Deleted · sigma-rule
- AWS ElastiCache Security Group Created · sigma-rule
- AWS ElastiCache Security Group Modified or Deleted · sigma-rule
- AWS Route 53 Domain Transfer Lock Disabled · sigma-rule
- AWS Route 53 Domain Transferred to Another Account · sigma-rule
- AWS S3 Data Management Tampering · sigma-rule
- AWS STS AssumeRole Misuse · sigma-rule
- AWS STS GetSessionToken Misuse · sigma-rule
- Azure AD Only Single Factor Authentication Required · sigma-rule
- Azure Container Registry Created or Deleted · sigma-rule
- Azure Kubernetes Cluster Created or Deleted · sigma-rule
- Bitbucket Project Secret Scanning Allowlist Added · sigma-rule
- Bitbucket Secret Scanning Rule Deleted · sigma-rule
- BitLockerTogo.EXE Execution · sigma-rule
- Browser Execution In Headless Mode · sigma-rule
- Capabilities Discovery - Linux · sigma-rule
- Change Default File Association Via Assoc · sigma-rule
- Cisco BGP Authentication Failures · sigma-rule
- Cisco Collect Data · sigma-rule
- Cisco Discovery · sigma-rule
- Cisco LDP Authentication Failures · sigma-rule
- Cisco Stage Data · sigma-rule
- Clipboard Collection of Image Data with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool · sigma-rule
- Clipboard Collection with Xclip Tool - Auditd · sigma-rule
- Compressed File Creation Via Tar.EXE · sigma-rule
- Compressed File Extraction Via Tar.EXE · sigma-rule
- Connection Proxy · sigma-rule
- Container Residence Discovery Via Proc Virtual FS · sigma-rule
- Container With A hostPath Mount Created · sigma-rule
- Creation Of A Local User Account · sigma-rule
- Crontab Enumeration · sigma-rule
- Curl Usage on Linux · sigma-rule
- Data Compressed · sigma-rule
- Data Copied To Clipboard Via Clip.EXE · sigma-rule
- DD File Overwrite · sigma-rule
- Decode Base64 Encoded Text · sigma-rule
- Decode Base64 Encoded Text -MacOs · sigma-rule
- Deployment Deleted From Kubernetes Cluster · sigma-rule
- Directory Removal Via Rmdir · sigma-rule
- DirLister Execution · sigma-rule
- Discovery of a System Time · sigma-rule
- DMSA Link Attributes Modified · sigma-rule
- DNS Events Related To Mining Pools · sigma-rule
- DNS Query Request By QuickAssist.EXE · sigma-rule
- DNS Query Request To OneLaunch Update Service · sigma-rule
- DNS Query To Ufile.io · sigma-rule
- DNS Query To Ufile.io - DNS Client · sigma-rule
- DNS Server Discovery Via LDAP Query · sigma-rule
- Docker Container Discovery Via Dockerenv Listing · sigma-rule
- Download From Suspicious TLD - Blacklist · sigma-rule
- Download From Suspicious TLD - Whitelist · sigma-rule
- Dynamic CSharp Compile Artefact · sigma-rule
- End User Consent · sigma-rule
- ETW Logging Disabled For rpcrt4.dll · sigma-rule
- ETW Logging Disabled For SCM · sigma-rule
- Exports Registry Key To a File · sigma-rule
- External Disk Drive Or USB Storage Device Was Recognized By The System · sigma-rule
- Failed Authentications From Countries You Do Not Operate Out Of · sigma-rule
- File And SubFolder Enumeration Via Dir Command · sigma-rule
- File Deletion Via Del · sigma-rule
- File or Folder Permissions Change · sigma-rule
- Files Added To An Archive Using Rar.EXE · sigma-rule
- Firewall Configuration Discovery Via Netsh.EXE · sigma-rule
- Fsutil Drive Enumeration · sigma-rule
- Gatekeeper Bypass via Xattr · sigma-rule
- Github New Secret Created · sigma-rule
- Github Push Protection Bypass Detected · sigma-rule
- GitHub Repository Pages Site Changed to Public · sigma-rule
- Github Self Hosted Runner Changes Detected · sigma-rule
- Guest Account Enabled Via Sysadminctl · sigma-rule
- GUI Input Capture - macOS · sigma-rule
- HH.EXE Execution · sigma-rule
- Hidden Files and Directories · sigma-rule
- Huawei BGP Authentication Failures · sigma-rule
- Indirect Command Execution By Program Compatibility Wizard · sigma-rule
- Insensitive Subfolder Search Via Findstr.EXE · sigma-rule
- Install Root Certificate · sigma-rule
- Interesting Service Enumeration Via Sc.EXE · sigma-rule
- JScript Compiler Execution · sigma-rule
- Juniper BGP Missing MD5 · sigma-rule
- Kubernetes Secrets Enumeration · sigma-rule
- Linux Capabilities Discovery · sigma-rule
- Linux Doas Tool Execution · sigma-rule
- Linux Network Service Scanning - Auditd · sigma-rule
- Linux Network Service Scanning Tools Execution · sigma-rule
- Linux Package Uninstall · sigma-rule
- Linux Remote System Discovery · sigma-rule
- Linux Setgid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Setuid Capability Set on a Binary via Setcap Utility · sigma-rule
- Linux Sudo Chroot Execution · sigma-rule
- Load Of RstrtMgr.DLL By An Uncommon Process · sigma-rule
- Local Accounts Discovery · sigma-rule
- Local Groups Discovery - Linux · sigma-rule
- Local Groups Reconnaissance Via Wmic.EXE · sigma-rule
- Local System Accounts Discovery - Linux · sigma-rule
- Local System Accounts Discovery - MacOs · sigma-rule
- Local User Creation · sigma-rule
- MacOS Network Service Scanning · sigma-rule
- Malicious Windows Script Components File Execution by TAEF Detection · sigma-rule
- MaxMpxCt Registry Value Changed · sigma-rule
- Measurable Increase Of Successful Authentications · sigma-rule
- Modification of IE Registry Settings · sigma-rule
- MSSQL Server Failed Logon · sigma-rule
- Mstsc.EXE Execution With Local RDP File · sigma-rule
- Network Connection Initiated To Mega.nz · sigma-rule
- Network Sniffing - Linux · sigma-rule
- New BITS Job Created Via Bitsadmin · sigma-rule
- New BITS Job Created Via PowerShell · sigma-rule
- New Cron File Created · sigma-rule
- New Kubernetes Service Account Created · sigma-rule
- New Network ACL Entry Added · sigma-rule
- New Process Created Via Taskmgr.EXE · sigma-rule
- New Service Creation Using PowerShell · sigma-rule
- New Service Creation Using Sc.EXE · sigma-rule
- Nltest.EXE Execution · sigma-rule
- No Suitable Encryption Key Found For Generating Kerberos Ticket · sigma-rule
- NodeJS Execution of JavaScript File · sigma-rule
- Non Interactive PowerShell Process Spawned · sigma-rule
- Non-Mail Client IMAP Connection Hunt Starter · sigma-rule
- Notepad Password Files Discovery · sigma-rule
- NTDS.DIT Created · sigma-rule
- NTLM Logon · sigma-rule
- Office Macro File Creation · sigma-rule
- Office Macro File Download · sigma-rule
- OS Architecture Discovery Via Grep · sigma-rule
- Outgoing Logon with New Credentials · sigma-rule
- Overwriting the File with Dev Zero or Null · sigma-rule
- Password Policy Discovery - Linux · sigma-rule
- Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy · sigma-rule
- Potential 7za.DLL Sideloading · sigma-rule
- Potential Azure Browser SSO Abuse · sigma-rule
- Potential Bucket Enumeration on AWS · sigma-rule
- Potential Container Discovery Via Inodes Listing · sigma-rule
- Potential Defense Evasion Via Raw Disk Access By Uncommon Tools · sigma-rule
- Potential Encoded PowerShell Patterns In CommandLine · sigma-rule
- Potential Execution of Sysinternals Tools · sigma-rule
- Potential PowerShell Obfuscation Using Alias Cmdlets · sigma-rule
- Potential PowerShell Obfuscation Using Character Join · sigma-rule
- Potentially Suspicious Network Connection To Notion API · sigma-rule
- PowerShell Download Via Net.WebClient - PowerShell Classic · sigma-rule
- PowerShell Script Change Permission Via Set-Acl - PsScript · sigma-rule
- PowerShell Script With File Upload Capabilities · sigma-rule
- Powershell Suspicious Win32_PnPEntity · sigma-rule
- Previously Installed IIS Module Was Removed · sigma-rule
- Privileged Container Deployed · sigma-rule
- PsExec Service File Creation · sigma-rule
- PUA - Adidnsdump Execution · sigma-rule
- PUA - Sysinternal Tool Execution - Registry · sigma-rule
- Python Image Load By Non-Python Process · sigma-rule
- QuickAssist Execution · sigma-rule
- RBAC Permission Enumeration Attempt · sigma-rule
- RegAsm.EXE Execution Without CommandLine Flags or Files · sigma-rule
- Registry Modification Via Regini.EXE · sigma-rule
- Remote Access Tool - ScreenConnect Command Execution · sigma-rule
- Remote Access Tool - ScreenConnect File Transfer · sigma-rule
- Remote Access Tool - ScreenConnect Remote Command Execution · sigma-rule
- Remote Access Tool - ScreenConnect Temporary File · sigma-rule
- Remote Access Tool - Team Viewer Session Started On Linux Host · sigma-rule
- Remote Access Tool - Team Viewer Session Started On MacOS Host · sigma-rule
- Remote Access Tool - Team Viewer Session Started On Windows Host · sigma-rule
- Remote File Copy · sigma-rule
- Remote PowerShell Session (PS Classic) · sigma-rule
- Renamed Powershell Under Powershell Channel · sigma-rule
- Replace Desktop Wallpaper by Powershell · sigma-rule
- Run Once Task Execution as Configured in Registry · sigma-rule
- Scheduled Task Creation Via Schtasks.EXE · sigma-rule
- Scheduled Task/Job At · sigma-rule
- Screen Capture - macOS · sigma-rule
- Screen Capture with Import Tool · sigma-rule
- Screen Capture with Xwd · sigma-rule
- Security Software Discovery - Linux · sigma-rule
- Service Registry Key Read Access Request · sigma-rule
- Service Reload or Start - Linux · sigma-rule
- Setuid and Setgid · sigma-rule
- Share And Session Enumeration Using Net.EXE · sigma-rule
- Sign-ins by Unknown Devices · sigma-rule
- Space After Filename - macOS · sigma-rule
- Special File Creation via Mknod Syscall · sigma-rule
- Split A File Into Pieces · sigma-rule
- Split A File Into Pieces - Linux · sigma-rule
- Start Windows Service Via Net.EXE · sigma-rule
- Startup Item File Created - MacOS · sigma-rule
- Steganography Extract Files with Steghide · sigma-rule
- Steganography Hide Files with Steghide · sigma-rule
- Steganography Hide Zip Information in Picture File · sigma-rule
- Steganography Unzip Hidden Information From Picture File · sigma-rule
- Stop Windows Service Via Net.EXE · sigma-rule
- Stop Windows Service Via PowerShell Stop-Service · sigma-rule
- Stop Windows Service Via Sc.EXE · sigma-rule
- Successful Account Login Via WMI · sigma-rule
- Suspicious Connection to Remote Account · sigma-rule
- Suspicious Deno File Written from Remote Source · sigma-rule
- Suspicious Execution of Hostname · sigma-rule
- Suspicious Execution of Systeminfo · sigma-rule
- Suspicious File Access to Browser Credential Storage · sigma-rule
- Suspicious Get Information for SMB Share · sigma-rule
- Suspicious Get Information for SMB Share - PowerShell Module · sigma-rule
- Suspicious Get Local Groups Information · sigma-rule
- Suspicious Get Local Groups Information - PowerShell · sigma-rule
- Suspicious GPO Discovery With Get-GPO · sigma-rule
- Suspicious Inbox Forwarding · sigma-rule
- Suspicious Mount-DiskImage · sigma-rule
- Suspicious Network Command · sigma-rule
- Suspicious Network Communication With IPFS · sigma-rule
- Suspicious PowerShell Get Current User · sigma-rule
- Suspicious Process Discovery With Get-Process · sigma-rule
- Suspicious Query of MachineGUID · sigma-rule
- Suspicious SSL Connection · sigma-rule
- Suspicious Where Execution · sigma-rule
- System Info Discovery via Sysinfo Syscall · sigma-rule
- System Information Discovery - Auditd · sigma-rule
- System Information Discovery via Registry Queries · sigma-rule
- System Integrity Protection (SIP) Enumeration · sigma-rule
- System Network Connections Discovery - Linux · sigma-rule
- System Network Connections Discovery Via Net.EXE · sigma-rule
- System Owner or User Discovery - Linux · sigma-rule
- Tap Driver Installation - Security · sigma-rule
- TeamViewer Log File Deleted · sigma-rule
- The Windows Defender Firewall Service Failed To Load Group Policy · sigma-rule
- Unauthorized System Time Modification · sigma-rule
- Uncommon Process Access Rights For Target Image · sigma-rule
- Unmount Share Via Net.EXE · sigma-rule
- USB Device Plugged · sigma-rule
- Use Get-NetTCPConnection · sigma-rule
- Use Get-NetTCPConnection - PowerShell Module · sigma-rule
- Use Of Hidden Paths Or Files · sigma-rule
- Virtualbox Driver Installation or Starting of VMs · sigma-rule
- Volume Shadow Copy Mount · sigma-rule
- Vulnerable Driver Load By Name · sigma-rule
- WebDav Put Request · sigma-rule
- Windows Defender Firewall Has Been Reset To Its Default Configuration · sigma-rule
- Windows Defender Submit Sample Feature Disabled · sigma-rule
- Windows Event Auditing Disabled · sigma-rule
- Windows Firewall Settings Have Been Changed · sigma-rule
- Windows MSIX Package Support Framework AI_STUBS Execution · sigma-rule
- Windows Processes Suspicious Parent Directory · sigma-rule
- Windows Share Mount Via Net.EXE · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.