All pull requests

Pull requests

• Add Radmin DLL sideloading detection rule

  Review NeededRulesWindows
  #6502·brandolphj opened Oct 22, 2026·

  ·

• new: AWS IAM Policy Version With Wildcard Actions Set As Default

  Review NeededRules
  #6501·abayate opened Oct 21, 2026·1 task done·

  ·

• new: Contagious Interview (DPRK) EtherHiding Chain - Emerging Threat And Hunting Rules

  Emerging-ThreatsReview NeededRulesThreat-HuntingWindows
  #6500·popkir opened Oct 21, 2026·

  ·

• new: Potentially Suspicious Ephemeral Container Added To Pod

  Review NeededRules
  #6499·HimanshuJha-2005 opened Oct 21, 2026·

  ·
  1

• update: Connection Proxy - add all_proxy/ftp_proxy and references

  LinuxReview NeededRules
  #6498·alifmuhammedn opened Oct 21, 2026·

  ·

• fix: align the GCP audit rules on the event field names and populate the auditlog field list

  MaintenanceReview NeededRules
  #6497·frack113 opened Oct 21, 2026Member·

  ·

• Fix Apache Spark Shell Command Injection rules - bash Image filter and CVE number

  Emerging-ThreatsReview NeededRules
  #6495·memx13 opened Oct 21, 2026Contributor·

  ·

• fix: CMSTP App Paths Registry Key Modification and Uncommon Svchost Parent Process FPs

  Awaiting Second ReviewRulesWindows
  #6494·swachchhanda000 opened Oct 21, 2026Collaborator·

  ·

  · Sigma-next-Release-26

• Add DECTRAX Active Deception Platform Detection Rules

  Review NeededRules
  #6492·Sadman-TheDentian opened Oct 20, 2026·3 tasks done·

  ·

• Add GitHub - Sensitive API Route Enumeration

  Review NeededRules
  #6491·st0pp3r opened Oct 20, 2026Contributor·

  ·

• new: Cisco IOS Login Brute Force Quiet Mode Triggered

  Review NeededRules
  #6488·darthsteven444-code opened Oct 19, 2026·1 task done·

  ·

• Add Kerberos PKINIT replay detections for CVE-2026-69676

  Additional Data NeededAuthor Input RequiredReview NeededRulesWindows
  #6487·4ndr3w6 opened Oct 19, 2026·

  ·
  1

• Add AD FS October 2026 spoofing CVE detections (CVE-2026-108131, CVE-2026-96222)

  Emerging-ThreatsReview NeededRules
  #6486·4ndr3w6 opened Oct 19, 2026·

  ·
  1

• new: ClickFix Operation String in Registry

  Review NeededRulesWindows
  #6484·joshnck opened Oct 19, 2026Contributor·

  ·

• Add Kubernetes ephemeral container injection detection

  Review NeededRules
  #6482·A3NG3L opened Oct 18, 2026·

  ·

• new: Cloud IMDS Credential Theft and Nsenter Container Escape detections

  LinuxReview NeededRules
  #6479·Gideon145 opened Oct 18, 2026·

  ·

• new: SSH Authorized Keys File Modification (T1098.004)

  LinuxReview NeededRules
  #6478·Gideon145 opened Oct 17, 2026·

  ·

• Add workflow to label stalled author-input PRs as Inactive

  MaintenanceReview Needed
  #6477·frack113 opened Oct 17, 2026Member·

  ·

• Add SLAPSHOT/WHIPSHOT implant detection rules for CVE-2026-88771/88772

  Emerging-ThreatsReview NeededRules
  #6476·SecureLinkSolutions opened Oct 16, 2026·

  ·

• new: AOMEI Backupper supply chain compromise rules

  Review NeededRulesWindows
  #6474·veeramani-sl-12207 opened Oct 16, 2026·

  ·

• new: Web Static Asset Hotlinked From Non-Owned Origin

  Review NeededRules
  #6473·aazamil opened Oct 16, 2026·1 task done·

  ·

• Sigma Regression Testing Update

  MaintenanceReview Needed
  #6471·pH-T opened Oct 15, 2026Contributor·

  ·
  2

• fix: HackTool - CrackMapExec File Indicators - anchor output-file regexes to the Temp root

  Review NeededRulesWindows
  #6470·redsand opened Oct 15, 2026Contributor·

  ·

• Fix Powershell Sensitive File Discovery - stop .pass matching property access

  MaintenanceReview NeededRulesWindows
  #6466·azullus opened Oct 14, 2026Contributor·

  ·

• chore: add HAWK.io MDR to the list of tools supporting Sigma

  MaintenanceReview Needed
  #6465·redsand opened Oct 14, 2026Contributor·

  ·