All pull requests

Pull requests

• Add macOS encoded payload piped to shell rule

  MacOSReview NeededRules
  #6451·yana-ivanov opened Oct 11, 2026·

  ·

• Expand macOS keychain credential access coverage

  MacOSReview NeededRules
  #6450·yana-ivanov opened Oct 11, 2026·

  ·

• Add macOS browser credential and cookie store access rule

  MacOSReview NeededRules
  #6449·yana-ivanov opened Oct 11, 2026·

  ·
  1

• fix: Correct W3C webserver header fields and ReGeorg empty-header matching

  MaintenanceReview NeededRules
  #6445·leela-padala opened Oct 10, 2026·

  ·
  1

  1

• new: papercut exploitation rules for CVE-2026-81578 and CVE-2026-82078

  Author Input RequiredEmerging-ThreatsReview NeededRules
  #6444·swachchhanda000 opened Oct 9, 2026Collaborator·

  ·
  25

• Detection vstest susp location

  Review NeededRulesWindows
  #6443·Diablo-research opened Oct 8, 2026Contributor·

  ·

• new: Mirai iptables port-kill and loader download-exec rules

  Emerging-ThreatsReview NeededRules
  #6442·Gideon145 opened Oct 8, 2026·

  ·

• chore: workflow - fix the CONTRIBUTING.md link in the first PR greeting

  MaintenanceReview Needed
  #6441·arelove opened Oct 7, 2026·

  ·

• fix: AWS SAML Provider Deletion Activity - use errorCode instead of status

  Review NeededRules
  #6440·arelove opened Oct 7, 2026·

  ·
  1

• Entra ID: password-spray tooling, risky sign-in from hosting ASN, rejected session token from hosting ASN

  Review NeededRulesThreat-Hunting
  #6439·redsand opened Oct 7, 2026Contributor·

  ·

• Add Linux rule: Potential Shell Or Command Execution Via Xargs

  LinuxReview NeededRules
  #6438·defamp opened Oct 7, 2026·1 task done·

  ·

• Add Linux rule: Potential Shell Or Command Execution Via GDB

  LinuxReview NeededRules
  #6437·defamp opened Oct 7, 2026·1 task done·

  ·

• Add Linux rule: Potential Command Execution Via Tcpdump Postrotate Command

  LinuxReview NeededRules
  #6436·defamp opened Oct 7, 2026·1 task done·

  ·

• Add Linux rule: Potential Command Execution Via Tar Checkpoint Or To-Command

  LinuxReview NeededRules
  #6435·defamp opened Oct 7, 2026·1 task done·

  ·

• Add Linux rule: Potential Execution Or Persistence Via Systemd-Run

  LinuxReview NeededRules
  #6434·defamp opened Oct 7, 2026·1 task done·

  ·

• new: Correlation Rule for Potential Successful MFA Fatigue Attack

  Review NeededRules
  #6433·jbren4 opened Oct 7, 2026·

  ·

• Improve detection for obfuscated pathtraversal

  Review NeededRules
  #6432·Dev2023-Op opened Oct 6, 2026·

  ·

• update: add FPs filters

  Review NeededRulesWindows
  #6430·Gude5 opened Oct 6, 2026Contributor·

  ·

  · Sigma-August-Release-26
  16

• Add rule: suspicious shadow file access via standard utilities

  LinuxReview NeededRules
  #6429·davidakanno56-bit opened Oct 5, 2026·1 task done·

  ·

• fix: improve ETW trace evasion detection scope

  Review NeededRulesWindows
  #6428·swachchhanda000 opened Oct 5, 2026Collaborator·

  ·
  2

• new: Correlation Rule for Potential SSH Brute-Force Activity

  LinuxReview NeededRules
  #6427·jbren4 opened Oct 5, 2026·

  ·

• New Rule: Suspicious Child Process Spawned By IntelliTrace.EXE

  Review NeededRulesWindows
  #6426·Diablo-research opened Oct 4, 2026Contributor·

  ·

• CredUI.DLL Loaded By Uncommon Process - add Spotify filter

  MaintenanceReview NeededRulesWindows
  #6425·JBoogieman opened Oct 4, 2026·

  ·

• fix: Remote Access Tool - ScreenConnect Installation Execution - remove optional '&c=' parameter

  Review NeededRulesWindows
  #6424·Securityinbits opened Oct 4, 2026Contributor·

  ·

• Remote File Download Via Xsd.EXE

  Review NeededRulesWindows
  #6423·Diablo-research opened Oct 3, 2026Contributor·

  ·