All pull requests

Pull requests

• new: Cloud IMDS Credential Theft and Nsenter Container Escape detections

  LinuxReview NeededRules
  #6479·Gideon145 opened Oct 18, 2026·

  ·

• new: SSH Authorized Keys File Modification (T1098.004)

  LinuxReview NeededRules
  #6478·Gideon145 opened Oct 17, 2026·

  ·

• Add workflow to label stalled author-input PRs as Inactive

  MaintenanceReview Needed
  #6477·frack113 opened Oct 17, 2026Member·

  ·

• Add SLAPSHOT/WHIPSHOT implant detection rules for CVE-2026-88771/88772

  Emerging-ThreatsReview NeededRules
  #6476·SecureLinkSolutions opened Oct 16, 2026·

  ·

• fix: Sign-in Failure Due to Conditional Access Requirements Not Met - Fix ResultDescription field name casing

  Review NeededRules
  #6475·Salmanali9090 opened Oct 16, 2026·

  ·

• new: AOMEI Backupper supply chain compromise rules

  Review NeededRulesWindows
  #6474·veeramani-sl-12207 opened Oct 16, 2026·

  ·

• new: Web Static Asset Hotlinked From Non-Owned Origin

  Review NeededRules
  #6473·aazamil opened Oct 16, 2026·1 task done·

  ·

• Sigma Regression Testing Update

  MaintenanceReview Needed
  #6471·pH-T opened Oct 15, 2026Contributor·

  ·

• fix: HackTool - CrackMapExec File Indicators - anchor output-file regexes to the Temp root

  Review NeededRulesWindows
  #6470·redsand opened Oct 15, 2026Contributor·

  ·

• Archive New Rule References

  #6469·github-actions[bot] opened Oct 15, 2026Bot·

  ·

• fix: Legitimate Application Writing Files In Uncommon Location - filter Dell TechHub esentutl SRUDB repair

  Ready to MergeRulesWindows
  #6468·redsand opened Oct 14, 2026Contributor·

  ·

  · Sigma-next-Release-26
  5

• Fix Powershell Sensitive File Discovery - match ls/gci/Get-ChildItem as whole words

  Review NeededRulesWindows
  #6467·azullus opened Oct 14, 2026·

  ·

• Fix Powershell Sensitive File Discovery - stop .pass matching property access

  MaintenanceReview NeededRulesWindows
  #6466·azullus opened Oct 14, 2026·

  ·

• chore: add HAWK.io MDR to the list of tools supporting Sigma

  MaintenanceReview Needed
  #6465·redsand opened Oct 14, 2026Contributor·

  ·

• feat(windows): detect potential Veeam credential access via psql.exe

  Review NeededRulesWindows
  #6464·bran-dot-flake opened Oct 14, 2026·

  ·

• Fix PowerShell remoting rules - filter BcContainerHelper false positive

  Review NeededRulesWindows
  #6463·azullus opened Oct 14, 2026·

  ·

• Add LogTriage to Projects or Products that use or integrate Sigma rules

  MaintenanceReview Needed
  #6461·logtriage-cyber opened Oct 14, 2026·

  ·

• new: COM TypeLib hijack via scriptlet moniker + script runtime loaded by Explorer

  Review NeededRulesWindows
  #6459·redsand opened Oct 14, 2026Contributor·

  ·

• new: MSBuild Exec Task Temporary Batch File Executed Via Cmd

  Review NeededRulesThreat-HuntingWindows
  #6458·Al-Gharbi opened Oct 13, 2026·

  ·

• chore: README - add Huntbase to projects that use Sigma

  MaintenanceReview Needed
  #6457·toliver-hb opened Oct 13, 2026·

  ·

• new: Potential Launch Agent/Daemon Masquerading As Apple

  MacOSReview NeededRules
  #6456·Bouliw opened Oct 12, 2026·

  ·

• Add Azazel ransom note creation rule for Linux

  Emerging-ThreatsReview NeededRules
  #6452·yana-ivanov opened Oct 12, 2026·

  ·

• Add macOS encoded payload piped to shell rule

  MacOSReview NeededRules
  #6451·yana-ivanov opened Oct 11, 2026·

  ·

• Expand macOS keychain credential access coverage

  MacOSReview NeededRules
  #6450·yana-ivanov opened Oct 11, 2026·

  ·

• Add macOS browser credential and cookie store access rule

  MacOSReview NeededRules
  #6449·yana-ivanov opened Oct 11, 2026·

  ·
  1