Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Jan 6, 2025

• Merge PR SigmaHQ#5149 from @nasbench - Promote older rules status from experimental to test

  Show description for 8734022
  

  github-actions[bot]

  and

  nasbench

  authored
  8734022

• Merge PR SigmaHQ#5150 from @nasbench - Archive new rule references and update cache file

  Show description for 952d518
  

  github-actions[bot]

  and

  nasbench

  authored
  952d518

Commits on Dec 28, 2024

• Merge PR SigmaHQ#5145 from @djlukic - Update Regex of some rules

  Show description for fa68da9
  

  djlukic

  and

  nasbench

  authored
  fa68da9

Commits on Dec 27, 2024

• Merge PR SigmaHQ#5144 from @djlukic - Fix multiple FPs

  Show description for 1df3c34
  djlukic

  authored
  1df3c34

• Merge PR SigmaHQ#5138 from @DanielKoifman - Update Suspicious Windows Service Tampering

  Show description for 7c83045
  DanielKoifman

  authored
  7c83045

Commits on Dec 19, 2024

• Merge PR SigmaHQ#5132 from @Neo23x0 - Update DNS Query To Remote Access Software Domain From Non-Browser App

  Show description for e8a6894
  

  Neo23x0

  and

  nasbench

  authored
  e8a6894

• Merge PR SigmaHQ#5016 from @saakovv - Add New AWS Lambda Function URL Configuration Created

  Show description for aec72e1
  

  4 peopleauthored
  aec72e1

• Merge PR SigmaHQ#5015 from @saakovv - Add AWS SAML Provider Deletion Activity

  Show description for a8d8dcf
  

  3 peopleauthored
  a8d8dcf

• Merge PR SigmaHQ#5041 from @Koifman - Update tags for Register new Logon Process by Rubeus

  Show description for 3449958
  Koifman

  authored
  3449958

• Merge PR SigmaHQ#5023 from @saakovv - Add AWS Key Pair Import Activity

  Show description for 2c13dba
  

  3 peopleauthored
  2c13dba

• Merge PR SigmaHQ#5095 from @faisalusuf - Add new rules related to QuickAssist usage

  Show description for 8e8b86a
  

  faisalusuf

  and

  nasbench

  authored
  8e8b86a

• Merge PR SigmaHQ#5123 from @jstnk9 - Add new sigma rules related to lummac and RATs behaviors observed ITW

  Show description for a9423d6
  

  3 peopleauthored
  a9423d6

Commits on Dec 16, 2024

• Merge PR SigmaHQ#5130 from @nasbench - Archive new rule references and update cache file

  Show description for 0cb8e32
  

  github-actions[bot]

  and

  nasbench

  authored
  0cb8e32

Commits on Dec 14, 2024

• Merge PR SigmaHQ#5122 from @djlukic - Fix bXOR Operator Usage In PowerShell Command Line - PowerShell Classic

  Show description for 9f54b01
  

  4 peopleauthored
  9f54b01

• Merge PR SigmaHQ#5116 from @Neo23x0 - Add rules and updates related to Cleo exploitation

  Show description for 17dcad4
  

  Neo23x0

  and

  nasbench

  authored
  17dcad4

• Merge PR SigmaHQ#5119 from @CheraghiMilad - Update Terminate Linux Process Via Kill

  Show description for 957c1fc
  

  CheraghiMilad

  and

  nasbench

  authored
  957c1fc

• Merge PR SigmaHQ#5117 from @CheraghiMilad - Update Process Discovery

  Show description for 44775b8
  

  3 peopleauthored
  44775b8

• Merge PR SigmaHQ#5125 from @randomaccess3 - Update Potential Secure Deletion with SDelete

  Show description for a290d22
  

  randomaccess3

  and

  nasbench

  authored
  a290d22

• Merge PR SigmaHQ#5126 from @MalGamy12 - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value

  Show description for 9b67acf
  

  MalGamy12

  and

  frack113

  authored
  9b67acf

• Merge PR SigmaHQ#5099 from @CheraghiMilad - Update Local System Accounts Discovery - Linux

  Show description for c6b7a19
  CheraghiMilad

  authored
  c6b7a19

Commits on Dec 7, 2024

• Merge PR SigmaHQ#5110 from @Neo23x0 - Update Remote Access Tool Services Have Been Installed - Security

  Show description for ee821b8
  Neo23x0

  authored
  ee821b8

Commits on Dec 6, 2024

• Merge PR SigmaHQ#5017 from @saakovv - Add Modification or Deletion of an AWS RDS Cluster

  Show description for 58017b6
  

  4 peopleauthored
  58017b6

Commits on Dec 3, 2024

• fix: FPs with NetNTLM downgrade attack (SigmaHQ#5108)

  Show description for 6fd57da
  

  Neo23x0

  and

  nasbench

  authored
  6fd57da

• Merge PR SigmaHQ#5107 from @mgreen27 - Update Potential Defense Evasion Via Rename Of Highly Relevant Binaries

  Show description for 2a0c9b5
  mgreen27

  authored
  2a0c9b5

Commits on Dec 1, 2024

• Merge PR SigmaHQ#5106 from @nasbench - Add SID version of integrity levels

  Show description for 6048be5
  nasbench

  authored
  6048be5

• Merge PR SigmaHQ#5046 from @frack113 - Add Setup16.EXE Execution With Custom .Lst File

  Show description for 6e71f6a
  

  frack113

  and

  nasbench

  authored
  6e71f6a

• Merge PR SigmaHQ#5082 from @swachchhanda000 - Add Suspicious ShellExec_RunDLL Call Via Ordinal

  Show description for f39c9ac
  

  4 peopleauthored
  f39c9ac

• Merge PR SigmaHQ#5102 from @CheraghiMilad - Update Password Policy Discovery - Linux

  Show description for aac4335
  

  CheraghiMilad

  and

  nasbench

  authored
  aac4335

• Merge PR SigmaHQ#5091 from @CheraghiMilad - Update File and Directory Discovery - Linux

  Show description for c8e1d66
  

  3 peopleauthored
  c8e1d66

• Merge PR SigmaHQ#5097 from @CheraghiMilad - Update System Owner or User Discovery - Linux

  Show description for af41386
  

  CheraghiMilad

  and

  nasbench

  authored
  af41386

• Merge PR SigmaHQ#5084 from @MalGamy12 - Update COM Object Hijacking Via Modification Of Default System CLSID Default Value

  Show description for 995dac1
  

  MalGamy12

  and

  nasbench

  authored
  995dac1

• Merge PR SigmaHQ#5101 from @nasbench - Promote older rules status from experimental to test

  Show description for 9367349
  

  github-actions[bot]

  and

  nasbench

  authored
  9367349

• Merge PR SigmaHQ#5101 from @nasbench - Archive new rule references and update cache file

  Show description for 4075c50
  

  github-actions[bot]

  and

  nasbench

  authored
  4075c50

Commits on Nov 29, 2024

• Merge PR SigmaHQ#5093 from @Neo23x0 - Fix Creation of WerFault.exe/Wer.dll in Unusual Folder

  Show description for 374f003
  

  Neo23x0

  and

  nasbench

  authored
  374f003

Commits on Nov 25, 2024

• Merge PR SigmaHQ#5088 from @frack113 - Remove custom dedicated hash fields from sigmac

  Show description for d804e9c
  

  frack113

  and

  nasbench

  authored
  d804e9c

Pagination

PreviousNext