# SigmaHQ TAKE list — one path per line, pinned to tag r2026-07-01 (https://github.com/SigmaHQ/sigma/blob/r2026-07-01/<path>). Source of record: SELECTION.md. Lines starting with # are comments.
rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml
rules/linux/builtin/syslog/lnx_syslog_susp_named.yml
rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml
rules/linux/builtin/lnx_clear_syslog.yml
rules/linux/builtin/lnx_privileged_user_creation.yml
rules/linux/builtin/lnx_buffer_overflows.yml
rules/linux/builtin/lnx_ldso_preload_injection.yml
rules/linux/builtin/lnx_potential_susp_ebpf_activity.yml
rules/linux/builtin/lnx_symlink_etc_passwd.yml
rules/linux/builtin/lnx_susp_dev_tcp.yml
rules/linux/builtin/lnx_shell_susp_rev_shells.yml
rules/linux/builtin/lnx_shell_susp_commands.yml
rules/linux/builtin/lnx_shell_clear_cmd_history.yml
rules/linux/builtin/lnx_shell_susp_log_entries.yml
rules/linux/builtin/lnx_shellshock.yml
rules/linux/builtin/lnx_susp_jexboss.yml
rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml
rules/network/fortinet/fortigate/fortinet_fortigate_new_admin_account_created.yml
rules/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml
rules/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml
rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml
rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml
rules/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml
rules/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml
rules/network/firewall/net_firewall_cleartext_protocols.yml
