All pull requests

Pull requests

• update: add FPs filters

  Review NeededRulesWindows
  #6430·Gude5 opened Oct 6, 2026Contributor·

  ·
  4

• Add rule: suspicious shadow file access via standard utilities

  LinuxReview NeededRules
  #6429·davidakanno56-bit opened Oct 5, 2026·1 task done·

  ·

• fix: improve ETW trace evasion detection scope

  Review NeededRulesWindows
  #6428·swachchhanda000 opened Oct 5, 2026Collaborator·

  ·
  2

• new: Correlation Rule for Potential SSH Brute-Force Activity

  LinuxReview NeededRules
  #6427·jbren4 opened Oct 5, 2026·

  ·

• New Rule: Suspicious Child Process Spawned By IntelliTrace.EXE

  Review NeededRulesWindows
  #6426·Diablo-research opened Oct 4, 2026Contributor·

  ·

• CredUI.DLL Loaded By Uncommon Process - add Spotify filter

  MaintenanceReview NeededRulesWindows
  #6425·JBoogieman opened Oct 4, 2026·

  ·

• fix: Remote Access Tool - ScreenConnect Installation Execution - remove optional '&c=' parameter

  Review NeededRulesWindows
  #6424·Securityinbits opened Oct 4, 2026Contributor·

  ·

• Remote File Download Via Xsd.EXE

  Review NeededRulesWindows
  #6423·Diablo-research opened Oct 3, 2026Contributor·

  ·

• New Rule: Potentially Suspicious Child Process Of VSLaunchBrowser

  Review NeededRulesWindows
  #6422·Diablo-research opened Oct 3, 2026Contributor·

  ·

• update: Hack Tool User Agent - add ARTEX user agent prefix

  Review NeededRules
  #6421·CloudSecLuke opened Oct 3, 2026·

  ·

• Detection testwindowremoteagent uncommon location

  Review NeededRulesWindows
  #6419·Diablo-research opened Oct 2, 2026Contributor·

  ·

• Detection texttransform suspicious child

  Review NeededRulesWindows
  #6418·Diablo-research opened Oct 2, 2026Contributor·

  ·

• Add restore point disable and PS history clearing rules; expand service tamper coverage

  Review NeededRulesWindows
  #6416·swachchhanda000 opened Oct 2, 2026Collaborator·

  ·

  · Sigma-August-Release-26
  2

• create-nightscreenshot-updater-rule

  Author Input RequiredEmerging-ThreatsRules
  #6414·i-eat-c3m3nt opened Oct 1, 2026·

  ·
  2

• new: TCC Permissions Reset Via Tccutil

  MacOSReview NeededRules
  #6362·Varunpoojari opened Oct 1, 2026·

  ·

• new: add self-deletion via choice/del command combination

  Review NeededRulesWindows
  #6359·vl43den opened Sep 30, 2026Contributor·

  ·

• Detection wslc host mount shell

  Review NeededRulesWindows
  #6358·Diablo-research opened Sep 30, 2026Contributor·

  ·

• chore: Move Certighost CDC Chase rules to placeholder and fix script interpreter rule metadat

  Review NeededRulesWindows
  #6357·swachchhanda000 opened Sep 30, 2026Collaborator·

  ·
  1

• Add rule: Suspicious Makecab/Diantz File Staging Or Ingress

  Review NeededRulesWindows
  #6356·h-sinad opened Sep 30, 2026·1 task done·

  ·

• add suspicious IEDiagCmd child process detection

  Review NeededRulesWindows
  #6354·Diablo-research opened Sep 29, 2026Contributor·

  ·

• update: CVE-2024-49113 LDAP Nightmare named fields, CVE-2024-49112 tag, MSRC/SafeBreach refs

  Emerging-ThreatsReview NeededRules
  #6353·Tito0015 opened Sep 29, 2026·2 tasks done·

  ·
  1

• new: add citrix netscaler exploitation detection rules

  Emerging-ThreatsLinuxReview NeededRules
  #6352·swachchhanda000 opened Sep 29, 2026Collaborator·

  ·
  7

• Add OpenAI Codex CLI approval and sandbox bypass detection

  Review NeededRulesWindows
  #6335·iampelumiade opened Sep 26, 2026·

  ·

• new: HttpClient Download With Expression Execution In PowerShell

  Review NeededRulesWindows
  #6333·duy-tu2005 opened Sep 26, 2026·

  ·

• new: Hidden Process Creation Via WMI From PowerShell

  Review NeededRulesWindows
  #6332·duy-tu2005 opened Sep 26, 2026·

  ·