Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Jan 15, 2024

• Merge PR SigmaHQ#4675 from @X-Junior - New Emerging Threat Rules For Peach Sandstorm APT

  Show description for 3fb5392
  

  3 peopleauthored
  3fb5392

  Copy full SHA for 3fb5392

• Merge PR SigmaHQ#4672 from @tr0mb1r - move to TH and filter vmware tools

  Show description for feded2f
  

  tr0mb1r

  and

  nasbench

  authored
  feded2f

  Copy full SHA for feded2f

• Merge PR SigmaHQ#4674 from @Neo23x0 - Increase hack tool coverage

  Show description for e6e0ffb
  

  3 peopleauthored
  e6e0ffb

  Copy full SHA for e6e0ffb

• Merge PR SigmaHQ#4671 from @nasbench - Archive new rule references and update the cache file

  Show description for 16adc03
  github-actions[bot]

  authored
  16adc03

  Copy full SHA for 16adc03

• Merge PR SigmaHQ#4673 from @Neo23x0 - Update broken reference link

  Show description for 8e064aa
  Neo23x0

  authored
  8e064aa

  Copy full SHA for 8e064aa

Commits on Jan 12, 2024

• Merge PR SigmaHQ#4621 from @zestsg - Add New GCP / Google Workspace Related Rules

  Show description for 24b9ed7
  

  3 peopleauthored
  24b9ed7

  Copy full SHA for 24b9ed7

• Merge PR SigmaHQ#4530 from @frack113 - Pingcastle PUA

  Show description for a2f8a82
  

  3 peopleauthored
  a2f8a82

  Copy full SHA for a2f8a82

Commits on Jan 11, 2024

• Merge PR SigmaHQ#4668 from @joshnck - Remove SOFTWARE registry key prefix

  Show description for 9bde39e
  

  joshnck

  and

  nasbench

  authored
  9bde39e

  Copy full SHA for 9bde39e

• Merge PR SigmaHQ#4665 from @Tuutaans - Add Rule CPL Load From Non Default Location

  Show description for 49a1b4a
  

  4 peopleauthored
  49a1b4a

  Copy full SHA for 49a1b4a

• Merge PR SigmaHQ#4664 from @danielgottt - Windows Filtering Platform Blocked Connection From EDR Agent Binary

  Show description for 60f4234
  

  danielgottt

  and

  nasbench

  authored
  60f4234

  Copy full SHA for 60f4234

Commits on Jan 10, 2024

• Merge PR SigmaHQ#4662 from @nasbench - Updated and added new rules

  Show description for d906eb0
  

  nasbench

  and

  phantinuss

  authored
  d906eb0

  Copy full SHA for d906eb0

• Merge PR SigmaHQ#4663 from @slincoln-aiq - Update Disable Windows Defender Features Rules

  Show description for 7a8672f
  

  3 peopleauthored
  7a8672f

  Copy full SHA for 7a8672f

• Merge PR SigmaHQ#4667 from @MrSeccubus - Fix error in extension check in sigma-logsource-checker.py

  Show description for 1a22365
  

  MrSeccubus

  and

  nasbench

  authored
  1a22365

  Copy full SHA for 1a22365

• Merge PR SigmaHQ#4654 from @qasimqlf - replace hardcoded C: with wildcard

  Show description for c3463f8
  

  qasimqlf

  and

  nasbench

  authored
  c3463f8

  Copy full SHA for c3463f8

• Merge PR SigmaHQ#4661 from @Tuutaans - Suspicious forfiles Child processes

  Show description for 2b90adc
  

  3 peopleauthored
  2b90adc

  Copy full SHA for 2b90adc

• Merge PR SigmaHQ#4650 from @ahouspan - Process Creation Cmdline Matches Patterns Observed in Pikabot Infections

  Show description for ff4dee3
  

  3 peopleauthored
  ff4dee3

  Copy full SHA for ff4dee3

• Merge PR SigmaHQ#4649 from @slincoln-aiq - System Information Discovery Using System_Profiler

  Show description for e62c700
  

  3 peopleauthored
  e62c700

  Copy full SHA for e62c700

• Merge PR SigmaHQ#4648 from @danielgottt - EDRSilencer Execution

  Show description for 561bab0
  

  3 peopleauthored
  561bab0

  Copy full SHA for 561bab0

• Merge PR SigmaHQ#4647 from @Neo23x0 - add new hack tool by imphash

  Show description for 2535a61
  

  3 peoplecommitted
  2535a61

  Copy full SHA for 2535a61

• Merge PR SigmaHQ#4646 from @qasimqlf - fix the wrong image name

  Show description for 8b09c05
  

  qasimqlf

  and

  nasbench

  authored
  8b09c05

  Copy full SHA for 8b09c05

• Merge PR SigmaHQ#4645 from @slincoln-aiq - Update: System Information Discovery Using Ioreg

  Show description for 2abda43
  

  slincoln-systemtwo

  and

  nasbench

  authored
  2abda43

  Copy full SHA for 2abda43

• Merge PR SigmaHQ#4643 from @bohops - Adding dotnet-trace LOLBIN

  Show description for 303cb49
  

  3 peopleauthored
  303cb49

  Copy full SHA for 303cb49

• Merge PR SigmaHQ#4640 from @jstnk9 - Add new rules related to System Integrity Protection (SIP) enumeration and tamper

  Show description for 1e37964
  

  4 peopleauthored
  1e37964

  Copy full SHA for 1e37964

• Merge PR SigmaHQ#4641 from @Tuutaans - Update some rules with additional cases

  Show description for 16f9991
  

  3 peopleauthored
  16f9991

  Copy full SHA for 16f9991

• Merge PR SigmaHQ#4638 from @st0pp3r - HackTool NoFilter Execution

  Show description for 0fa10fa
  

  st0pp3r

  and

  nasbench

  authored
  0fa10fa

  Copy full SHA for 0fa10fa

Commits on Jan 3, 2024

• Merge PR SigmaHQ#4659 from @nasbench - Reduce Remote PowerShell Session (PS Classic) Level

  Show description for 36290c5
  nasbench

  authored
  36290c5

  Copy full SHA for 36290c5

• Merge PR SigmaHQ#4658 from @nasbench - Update Products Sigma List In README.md

  Show description for 9988614
  nasbench

  authored
  9988614

  Copy full SHA for 9988614

Commits on Jan 1, 2024

• chore: archive new rule references and update cache file (SigmaHQ#4652)

  Show description for aaebc73
  

  github-actions[bot]

  and

  nasbench

  authored
  aaebc73

  Copy full SHA for aaebc73

• chore: promote older rules status from experimental to test (SigmaHQ#4651)

  Show description for c3fe2da
  

  github-actions[bot]

  and

  nasbench

  authored
  c3fe2da

  Copy full SHA for c3fe2da

Commits on Dec 28, 2023

• Merge PR SigmaHQ#4644 from @qasimqlf - Add Missing CommandLine Field Selection

  Show description for 17b87ec
  

  qasimqlf

  and

  frack113

  authored
  17b87ec

  Copy full SHA for 17b87ec

Commits on Dec 22, 2023

• Merge PR SigmaHQ#4636 from @slincoln-aiq - Fix Typo In Enable LM Hash Storage - ProcCreation

  Show description for e0cf5f3
  

  slincoln-systemtwo

  and

  nasbench

  authored
  e0cf5f3

  Copy full SHA for e0cf5f3

Commits on Dec 21, 2023

• Merge PR SigmaHQ#4577 from @nasbench - Multiple Fixes & Updates

  Show description for e052677
  

  nasbench

  and

  phantinuss

  authored
  e052677

  Copy full SHA for e052677

• Merge PR SigmaHQ#4536 from @frack113 - Add New Rules Related To Sysvol Access

  Show description for 2cb6ccd
  

  frack113

  and

  nasbench

  authored
  2cb6ccd

  Copy full SHA for 2cb6ccd

• Merge PR SigmaHQ#4635 from @qasimqlf - Fix error in modifier usage

  Show description for efb67a3
  

  qasimqlf

  and

  nasbench

  authored
  efb67a3

  Copy full SHA for efb67a3

• Merge PR SigmaHQ#4628 from @ssnkhan - New: Detect Creation of Cloudflared Quick Tunnels

  Show description for d88e556
  

  3 peopleauthored
  d88e556

  Copy full SHA for d88e556

Pagination

Previous

Next