Commits

Branch selector

 master

User selector

swachchhanda000

Datepicker

All time

Commit History

Commits on Oct 6, 2024

• Merge PR SigmaHQ#5031 from @swachchhanda000 - Add Potential Python DLL SideLoading

  Show description for d1f1fc7
  

  3 peopleauthored
  d1f1fc7

  Copy full SHA for d1f1fc7

Commits on Sep 2, 2024

• Merge PR SigmaHQ#4983 from @swachchhanda000 - Add Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location

  Show description for 7f0f7ee
  

  swachchhanda000

  and

  nasbench

  authored
  7f0f7ee

  Copy full SHA for 7f0f7ee

Commits on Aug 7, 2024

• Merge PR SigmaHQ#4946 from @swachchhanda000 - Add Suspicious Process Masquerading As SvcHost.EXE

  Show description for 4989d43
  

  swachchhanda000

  and

  nasbench

  authored
  4989d43

  Copy full SHA for 4989d43

Commits on Aug 1, 2024

• Merge PR SigmaHQ#4763 from @swachchhanda000 - New rules related to Raspberry Robin TTPs

  Show description for 3359340
  

  3 peopleauthored
  3359340

  Copy full SHA for 3359340

Commits on Jul 3, 2024

• Merge PR SigmaHQ#4831 from @swachchhanda000 - Add Kapeka backdoor related Sigma rules

  Show description for 0bb6f0c
  

  swachchhanda000

  and

  nasbench

  authored
  0bb6f0c

  Copy full SHA for 0bb6f0c

Commits on May 13, 2024

• Merge PR SigmaHQ#4818 from @swachchhanda000 - Add Potentially Suspicious Child Process Of KeyScrambler.exe

  Show description for bd454b6
  

  swachchhanda000

  and

  nasbench

  authored
  bd454b6

  Copy full SHA for bd454b6

Commits on Apr 15, 2024

• Merge PR SigmaHQ#4806 from @swachchhanda000 - Potential KeyScrambler.exe DLL Side-loading

  Show description for b40d865
  

  swachchhanda000

  and

  nasbench

  authored
  b40d865

  Copy full SHA for b40d865

Commits on Mar 7, 2024

• Merge PR SigmaHQ#4751 from @swachchhanda000 - Add Potential Raspberry Robin CPL Execution Activity rule

  Show description for 4384ce7
  

  swachchhanda000

  and

  nasbench

  authored
  4384ce7

  Copy full SHA for 4384ce7

Commits on Feb 12, 2024

• Merge PR SigmaHQ#4698 from @swachchhanda000 - Added rules that detect possible activities associated with services and modules enumeration

  Show description for 7509f6a
  

  swachchhanda000

  and

  nasbench

  authored
  7509f6a

  Copy full SHA for 7509f6a

Commits on Jan 29, 2024

• Merge PR SigmaHQ#4678 from @swachchhanda000 - Adds and updates Pikabot and rundll32 related rules

  Show description for 2fc5330
  

  3 peopleauthored
  2fc5330

  Copy full SHA for 2fc5330

Commits on Jan 22, 2024

• Merge PR SigmaHQ#4679 from @swachchhanda000 - Suspicious unsigned DLL Loaded by RunDLL32/RegSvr32

  Show description for 2ee4323
  

  swachchhanda000

  and

  nasbench

  authored
  2ee4323

  Copy full SHA for 2ee4323

Commits on Dec 4, 2023

• Merge PR SigmaHQ#4529 from @swachchhanda000 - Add New Rules Related To WinPwn Execution

  Show description for f07e2b3
  

  swachchhanda000

  and

  nasbench

  authored
  f07e2b3

  Copy full SHA for f07e2b3

Commits on Nov 14, 2023

• Merge PR SigmaHQ#4557 from @swachchhanda000 - Multiple Rule Updates & New Rules

  Show description for fc716d1
  

  3 peopleauthored
  fc716d1

  Copy full SHA for fc716d1

Commits on Oct 19, 2023

• Merge PR SigmaHQ#4493 From @swachchhanda000

  Show description for 4dc36bf
  

  3 peopleauthored
  4dc36bf

  Copy full SHA for 4dc36bf

Commits on Aug 11, 2023

• Added two new lolbas rules and slight modifications on exisiting rules

  swachchhanda000

  committed
  32e0100

  Copy full SHA for 32e0100

Commits on Aug 2, 2023

• Merge pull request SigmaHQ#2 from swachchhanda000/provlaunch

  Show description for c785def
  swachchhanda000

  authored
  c785def

  Copy full SHA for c785def

• Capitalized title

  swachchhanda000

  committed
  64ff613

  Copy full SHA for 64ff613

• Merge pull request SigmaHQ#1 from swachchhanda000/provlaunch

  Show description for c0d0b14
  swachchhanda000

  authored
  c0d0b14

  Copy full SHA for c0d0b14

• Added rules to detect lolbas provlaunch.exe

  swachchhanda000

  committed
  c3bb062

  Copy full SHA for c3bb062

• Merge branch 'SigmaHQ:master' into master

  swachchhanda000

  authored
  a3f2c76

  Copy full SHA for a3f2c76

Commits on Jun 16, 2023

• Added filter to reduce false-positives from legitimate processes

  swachchhanda000

  committed
  f99229f

  Copy full SHA for f99229f

Commits on Jun 5, 2023

• corrected the date

  swachchhanda000

  committed
  4bcd3c3

  Copy full SHA for 4bcd3c3

Commits on May 10, 2023

• Extended the coverage of existing defender tampering related rules

  swachchhanda000

  committed
  d56c9d9

  Copy full SHA for d56c9d9

Commits on Apr 24, 2023

• Added detection to detect every possible way of execution through rdrleakdiag

  swachchhanda000

  committed
  fc8c66b

  Copy full SHA for fc8c66b

Commits on Apr 20, 2023

• Merge branch 'SigmaHQ:master' into master

  swachchhanda000

  authored
  6e6b570

  Copy full SHA for 6e6b570

Commits on Apr 7, 2023

• Update rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml

  Show description for 3785bb3
  

  swachchhanda000

  and

  nasbench

  authored
  3785bb3

  Copy full SHA for 3785bb3

• Update rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml

  Show description for 4bf6677
  

  swachchhanda000

  and

  nasbench

  authored
  4bf6677

  Copy full SHA for 4bf6677

Commits on Mar 29, 2023

• Merge branch 'SigmaHQ:master' into master

  swachchhanda000

  authored
  960bb60

  Copy full SHA for 960bb60