Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Oct 8, 2024

• Merge PR SigmaHQ#4994 from @djlukic - Multiple FP fixes

  Show description for f33530e
  

  djlukic

  and

  nasbench

  authored
  f33530e

• Merge PR SigmaHQ#5040 from @ruppde - Update Antivirus Password Dumper Detection

  Show description for 7ddc551
  ruppde

  authored
  7ddc551

• Merge PR SigmaHQ#5008 from @BlackB0lt - Update HackTool - Certipy Execution

  Show description for 86989a0
  

  BlackB0lt

  and

  nasbench

  authored
  86989a0

• Merge PR SigmaHQ#5036 from @dan21san - Update Alternate PowerShell Hosts Pipe

  Show description for b063a9d
  

  dan21san

  and

  nasbench

  authored
  b063a9d

• Merge PR SigmaHQ#5039 from @CheraghiMilad - Update Local System Accounts Discovery - Linux

  Show description for d270dc5
  

  3 peopleauthored
  d270dc5

• Merge PR SigmaHQ#5037 from @MalGamy12 - Update Disable Windows Defender Functionalities Via Registry Keys

  Show description for f472015
  

  MalGamy12

  and

  nasbench

  authored
  f472015

• Merge PR SigmaHQ#5038 from @Neo23x0 - Update LSASS Process Memory Dump Files

  Show description for a997d62
  

  Neo23x0

  and

  nasbench

  authored
  a997d62

Commits on Oct 6, 2024

• Merge PR SigmaHQ#5012 from @ionsor - Update Potentially Suspicious JWT Token Search Via CLI

  Show description for 5b59c6d
  

  ionsor

  and

  nasbench

  authored
  5b59c6d

• Merge PR SigmaHQ#5031 from @swachchhanda000 - Add Potential Python DLL SideLoading

  Show description for d1f1fc7
  

  3 peopleauthored
  d1f1fc7

• Merge PR SigmaHQ#4935 from @frack113 - Add new IIS logsource and related rules

  Show description for c70fff4
  

  frack113

  and

  nasbench

  authored
  c70fff4

• Merge PR SigmaHQ#5033 from @MalGamy12 - Update Process Terminated Via Taskkill

  Show description for 8a3f074
  

  MalGamy12

  and

  nasbench

  authored
  8a3f074

Commits on Oct 1, 2024

• Merge PR SigmaHQ#5026 from @X-Junior - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value

  Show description for 1f1f31e
  

  X-Junior

  and

  nasbench

  authored
  1f1f31e

• Merge PR SigmaHQ#5027 from @nasbench - Promote older rules status from experimental to test

  Show description for 08c52c3
  

  github-actions[bot]

  and

  nasbench

  authored
  08c52c3

• Merge PR SigmaHQ#5028 from @nasbench - Archive new rule references and update cache file

  Show description for 8ebc58c
  

  github-actions[bot]

  and

  nasbench

  authored
  8ebc58c

Commits on Sep 22, 2024

• Merge PR SigmaHQ#5013 from @ruppde - Update linux scanning rules

  Show description for 35a5eb9
  ruppde

  authored
  35a5eb9

• Merge PR SigmaHQ#5020 from @tsale - Add Remote Access Tool - MeshAgent Command Execution via MeshCentral

  Show description for 014d169
  

  3 peopleauthored
  014d169

• Merge PR SigmaHQ#5022 from @jaegeral - Fix some typos in rules metadata

  Show description for 9db7e07
  jaegeral

  authored
  9db7e07

Commits on Sep 18, 2024

• Merge PR SigmaHQ#5009 from @nasbench - Archive new rule references and update cache file

  Show description for 23c4c0b
  

  github-actions[bot]

  and

  nasbench

  authored
  23c4c0b

Commits on Sep 13, 2024

• Merge PR SigmaHQ#4980 from @Mahir-Ali-khan - Update DNS Query To Remote Access Software Domain From Non-Browser App

  Show description for 99a47e4
  

  Mahir-Ali-khan

  and

  nasbench

  authored
  99a47e4

• Merge PR SigmaHQ#5003 from @deFr0ggy - Add Network Connection Initiated To BTunnels Domains

  Show description for 71be3c7
  

  3 peopleauthored
  71be3c7

• Merge PR SigmaHQ#5005 from @bharat-arora-magnet - Fix PwnKit Local Privilege Escalation

  Show description for fedc6f4
  bharat-arora-magnet

  authored
  fedc6f4

• Merge PR SigmaHQ#5006 from @frack113 - Fix UNC2452 Process Creation Patterns

  Show description for 236db73
  frack113

  authored
  236db73

• Merge PR SigmaHQ#5007 from @fukusuket - Fix unreachable GitHub URL references

  Show description for 1324828
  fukusuket

  authored
  1324828

Commits on Sep 6, 2024

• Merge PR SigmaHQ#5002 from @secDre4mer - Update Potential CommandLine Obfuscation Using Unicode Characters rules

  Show description for ab2fb36
  

  secDre4mer

  and

  nasbench

  authored
  ab2fb36

• Merge PR SigmaHQ#5001 from @joshnck - Add Startup/Logon Script Added to Group Policy Object

  Show description for 8288d4b
  

  joshnck

  and

  nasbench

  authored
  8288d4b

• Merge PR SigmaHQ#5000 from @joshnck - Update Persistence and Execution at Scale via GPO Scheduled Task

  Show description for ad84d82
  

  joshnck

  and

  nasbench

  authored
  ad84d82

• Merge PR SigmaHQ#4999 from @joshnck - Add Group Policy Abuse for Privilege Addition

  Show description for 06b1166
  

  joshnck

  and

  nasbench

  authored
  06b1166

• Merge PR SigmaHQ#4998 from @joshnck - Add DNS Request From Windows Script Host

  Show description for 06e3ce3
  

  joshnck

  and

  nasbench

  authored
  06e3ce3

Commits on Sep 3, 2024

• Merge PR SigmaHQ#4995 from @secDre4mer - Add Process Deletion of Its Own Executable

  Show description for 9b39e26
  

  secDre4mer

  and

  nasbench

  authored
  9b39e26

• Merge PR SigmaHQ#4997 from @MHaggis - Add rules related to PowerShell Web Access

  Show description for b724a7f
  

  MHaggis

  and

  nasbench

  authored
  b724a7f

Commits on Sep 2, 2024

• Merge PR SigmaHQ#4983 from @swachchhanda000 - Add Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location

  Show description for 7f0f7ee
  

  swachchhanda000

  and

  nasbench

  authored
  7f0f7ee

• Merge PR SigmaHQ#4993 from @nasbench - Fix Issues

  Show description for b86a494
  nasbench

  authored
  b86a494

• Merge PR SigmaHQ#4990 from @dan21san - Add Remote Access Tool - AnyDesk Incoming Connection

  Show description for bd284a9
  

  dan21san

  and

  nasbench

  authored
  bd284a9

• Merge PR SigmaHQ#4975 from @Murphy0801 - Add new rules related to GTFOBins

  Show description for 3e2f8d5
  

  3 peopleauthored
  3e2f8d5

• Merge PR SigmaHQ#4991 from @nasbench - Promote older rules status from experimental to test

  Show description for 839f563
  

  github-actions[bot]

  and

  nasbench

  authored
  839f563

Pagination

PreviousNext