All pull requests

Pull requests

• Add rule: Suspicious Makecab/Diantz File Staging Or Ingress

  Review NeededRulesWindows
  #6356·h-sinad opened Sep 30, 2026·

  ·

• fix: Bitsadmin to Uncommon TLD - add .microsoft to false positives

  Review NeededRules
  #6355·redsand opened Sep 30, 2026Contributor·

  ·

• add suspicious IEDiagCmd child process detection

  Review NeededRulesWindows
  #6354·Diablo-research opened Sep 29, 2026·

  ·

• update: CVE-2024-49113 LDAP Nightmare named fields, CVE-2024-49112 tag, MSRC/SafeBreach refs

  Emerging-ThreatsReview NeededRules
  #6353·Tito0015 opened Sep 29, 2026·

  ·
  1

• new: add citrix netscaler exploitation detection rules

  Emerging-ThreatsLinuxReview NeededRules
  #6352·swachchhanda000 opened Sep 29, 2026Collaborator·

  ·
  7

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 3/7

  LinuxMacOSReview NeededRulesWindows
  #6351·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct T1574-family technique tags for ATT&CK v19.2 (pack 4/4)

  Review NeededRulesWindows
  #6350·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct T1574-family technique tags for ATT&CK v19.2 (pack 3/4)

  Review NeededRulesWindows
  #6349·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct T1574-family technique tags for ATT&CK v19.2 (pack 2/4)

  Review NeededRulesWindows
  #6348·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct T1574-family technique tags for ATT&CK v19.2 (pack 1/4)

  Emerging-ThreatsLinuxReview NeededRules
  #6347·elhoim opened Sep 28, 2026Contributor·

  ·

• [cosmetic] Remove deprecated ATT&CK data source tag from Create Volume Shadow Copy with Powershell

  Review NeededRulesWindows
  #6346·elhoim opened Sep 28, 2026Contributor·

  ·

• [medium] Close detection bypasses in Sigma rule filters and case-sensitive regexes

  Emerging-ThreatsLinuxMacOSReview NeededRulesThreat-HuntingWindows
  #6345·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 7/7

  Review NeededRulesWindows
  #6344·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 6/7

  Review NeededRulesWindows
  #6343·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 5/7

  Review NeededRulesWindows
  #6342·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 4/7

  Review NeededRulesWindows
  #6341·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 2/7

  Emerging-ThreatsMacOSReview NeededRulesThreat-HuntingWindows
  #6340·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Correct unbacked ATT&CK tactic tags (v19.2), pack 1/7

  Emerging-ThreatsReview NeededRules
  #6339·elhoim opened Sep 28, 2026Contributor·

  ·

• [low] Reduce false positives and correct field names and metadata in Sigma rules

  Emerging-ThreatsLinuxReview NeededRulesWindows
  #6338·elhoim opened Sep 28, 2026Contributor·

  ·

• [high] Fix Sigma rules that can never fire (wrong modifiers, typos, wrong fields and event sources)

  Review NeededRulesThreat-HuntingWindows
  #6337·elhoim opened Sep 28, 2026Contributor·

  ·

• new: suspicious child process from XBootMgrSleep

  Review NeededRulesWindows
  #6336·Diablo-research opened Sep 27, 2026·

  ·

• Add OpenAI Codex CLI approval and sandbox bypass detection

  Review NeededRulesWindows
  #6335·iampelumiade opened Sep 26, 2026·

  ·

• new: HttpClient Download With Expression Execution In PowerShell

  Review NeededRulesWindows
  #6333·duy-tu2005 opened Sep 26, 2026·

  ·

• new: Hidden Process Creation Via WMI From PowerShell

  Review NeededRulesWindows
  #6332·duy-tu2005 opened Sep 26, 2026·

  ·

• new: BITS Notification Command Configured With A Shell Via PowerShell

  Review NeededRulesWindows
  #6331·duy-tu2005 opened Sep 26, 2026·

  ·