sigma rule #867 | ScratchStats