Commits

Branch selector

 master

User selector

All users

Datepicker

All time

Commit History

Commits on Sep 6, 2024

• Merge PR SigmaHQ#5002 from @secDre4mer - Update Potential CommandLine Obfuscation Using Unicode Characters rules

  Show description for ab2fb36
  

  secDre4mer

  and

  nasbench

  authored
  ab2fb36

  Copy full SHA for ab2fb36

• Merge PR SigmaHQ#5001 from @joshnck - Add Startup/Logon Script Added to Group Policy Object

  Show description for 8288d4b
  

  joshnck

  and

  nasbench

  authored
  8288d4b

  Copy full SHA for 8288d4b

• Merge PR SigmaHQ#5000 from @joshnck - Update Persistence and Execution at Scale via GPO Scheduled Task

  Show description for ad84d82
  

  joshnck

  and

  nasbench

  authored
  ad84d82

  Copy full SHA for ad84d82

• Merge PR SigmaHQ#4999 from @joshnck - Add Group Policy Abuse for Privilege Addition

  Show description for 06b1166
  

  joshnck

  and

  nasbench

  authored
  06b1166

  Copy full SHA for 06b1166

• Merge PR SigmaHQ#4998 from @joshnck - Add DNS Request From Windows Script Host

  Show description for 06e3ce3
  

  joshnck

  and

  nasbench

  authored
  06e3ce3

  Copy full SHA for 06e3ce3

Commits on Sep 3, 2024

• Merge PR SigmaHQ#4995 from @secDre4mer - Add Process Deletion of Its Own Executable

  Show description for 9b39e26
  

  secDre4mer

  and

  nasbench

  authored
  9b39e26

  Copy full SHA for 9b39e26

• Merge PR SigmaHQ#4997 from @MHaggis - Add rules related to PowerShell Web Access

  Show description for b724a7f
  

  MHaggis

  and

  nasbench

  authored
  b724a7f

  Copy full SHA for b724a7f

Commits on Sep 2, 2024

• Merge PR SigmaHQ#4983 from @swachchhanda000 - Add Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location

  Show description for 7f0f7ee
  

  swachchhanda000

  and

  nasbench

  authored
  7f0f7ee

  Copy full SHA for 7f0f7ee

• Merge PR SigmaHQ#4993 from @nasbench - Fix Issues

  Show description for b86a494
  nasbench

  authored
  b86a494

  Copy full SHA for b86a494

• Merge PR SigmaHQ#4990 from @dan21san - Add Remote Access Tool - AnyDesk Incoming Connection

  Show description for bd284a9
  

  dan21san

  and

  nasbench

  authored
  bd284a9

  Copy full SHA for bd284a9

• Merge PR SigmaHQ#4975 from @Murphy0801 - Add new rules related to GTFOBins

  Show description for 3e2f8d5
  

  3 peopleauthored
  3e2f8d5

  Copy full SHA for 3e2f8d5

• Merge PR SigmaHQ#4991 from @nasbench - Promote older rules status from experimental to test

  Show description for 839f563
  

  github-actions[bot]

  and

  nasbench

  authored
  839f563

  Copy full SHA for 839f563

• Merge PR SigmaHQ#4992 from @nasbench - Archive new rule references and update cache file

  Show description for 9eb4dea
  

  github-actions[bot]

  and

  nasbench

  authored
  9eb4dea

  Copy full SHA for 9eb4dea

Commits on Aug 29, 2024

• Merge PR SigmaHQ#4986 from @djlukic - Multiple FP fixes

  Show description for 509120a
  

  djlukic

  and

  nasbench

  authored
  509120a

  Copy full SHA for 509120a

• Merge PR SigmaHQ#4987 from @peterydzynski - Fix System Network Discovery - macOS

  Show description for 9c7b8bc
  

  peterydzynski

  and

  nasbench

  authored
  9c7b8bc

  Copy full SHA for 9c7b8bc

• Merge PR SigmaHQ#4961 from @tsale - Add multiples rules and updates

  Show description for 2851ef5
  

  tsale

  and

  nasbench

  authored
  2851ef5

  Copy full SHA for 2851ef5

• Merge PR SigmaHQ#4937 from @nasbench - Multiple updates and fixes

  Show description for 4cd51a3
  nasbench

  authored
  4cd51a3

  Copy full SHA for 4cd51a3

Commits on Aug 27, 2024

• Merge PR SigmaHQ#4985 from @secDre4mer - Update Potential Active Directory Reconnaissance/Enumeration Via LDAP

  Show description for 5550ccd
  secDre4mer

  authored
  5550ccd

  Copy full SHA for 5550ccd

Commits on Aug 26, 2024

• Merge PR SigmaHQ#4982 from @X-Junior - Update scheduled task related rules

  Show description for 5c4f599
  

  X-Junior

  and

  nasbench

  authored
  5c4f599

  Copy full SHA for 5c4f599

Commits on Aug 23, 2024

• Merge PR SigmaHQ#4947 from @omaramin17 - Add DNS Query To Put.io - DNS Client

  Show description for 29dce31
  

  omaramin17

  and

  nasbench

  authored
  29dce31

  Copy full SHA for 29dce31

• Merge PR SigmaHQ#4954 from @omaramin17 - Update multiple rules with additional sharing domains

  Show description for 9b3c363
  

  omaramin17

  and

  nasbench

  authored
  9b3c363

  Copy full SHA for 9b3c363

Commits on Aug 22, 2024

• Merge PR SigmaHQ#4969 from @Mahir-Ali-khan - Add Potential File Override/Append Via SET Command

  Show description for 17d1977
  

  Mahir-Ali-khan

  and

  nasbench

  authored
  17d1977

  Copy full SHA for 17d1977

Commits on Aug 21, 2024

• Merge PR SigmaHQ#4965 from @omaramin17 - Add Driver Added To Disallowed Images In HVCI - Registry

  Show description for b1a2d41
  

  omaramin17

  and

  nasbench

  authored
  b1a2d41

  Copy full SHA for b1a2d41

• Merge PR SigmaHQ#4951 from @omaramin17 - Add Hidden Flag Set On File/Directory Via Chflags - MacOS

  Show description for a21ab67
  

  omaramin17

  and

  nasbench

  authored
  a21ab67

  Copy full SHA for a21ab67

• Merge PR SigmaHQ#4977 from @cyb3rjy0t - Add User Risk and MFA Registration Policy Updated

  Show description for 78abfd5
  

  cyb3rjy0t

  and

  nasbench

  authored
  78abfd5

  Copy full SHA for 78abfd5

• Merge PR SigmaHQ#4978 from @cyb3rjy0t - Add Multi Factor Authentication Disabled For User Account

  Show description for d114395
  

  cyb3rjy0t

  and

  nasbench

  authored
  d114395

  Copy full SHA for d114395

Commits on Aug 20, 2024

• Merge PR SigmaHQ#4948 from @omaramin17 - Add Data Export From MSSQL Table Via BCP.EXE

  Show description for 0504f18
  

  omaramin17

  and

  nasbench

  authored
  0504f18

  Copy full SHA for 0504f18

Commits on Aug 16, 2024

• Merge PR SigmaHQ#4974 from @tsale - Add Potentially Suspicious Rundll32.EXE Execution of UDL File

  Show description for 7e93682
  

  tsale

  and

  nasbench

  authored
  7e93682

  Copy full SHA for 7e93682

• Merge PR SigmaHQ#4973 from @frack113 - Fix date format for some rules along with a broken logsource field

  Show description for adff65f
  frack113

  authored
  adff65f

  Copy full SHA for adff65f

Commits on Aug 15, 2024

• Merge PR SigmaHQ#4970 from @nasbench - Archive new rule references and update cache file

  Show description for 8bf0ef1
  

  github-actions[bot]

  and

  nasbench

  authored
  8bf0ef1

  Copy full SHA for 8bf0ef1

Commits on Aug 13, 2024

• Merge PR SigmaHQ#4967 from @nasbench - Revert accidental change introduced in SigmaHQ#4950

  Show description for 6901221
  nasbench

  authored
  6901221

  Copy full SHA for 6901221

Commits on Aug 12, 2024

• Merge PR SigmaHQ#4923 from frack113 - Update test_rules.py to remove the tests covered by pySigma-validators-sigmahq v0.7.0

  Show description for 760597d
  frack113

  authored
  760597d

  Copy full SHA for 760597d

• Merge PR SigmaHQ#4956 from @frack113 - Update promote_rules_status script to use the native datetime.date

  Show description for 4c01702
  frack113

  authored
  4c01702

  Copy full SHA for 4c01702

• Merge PR SigmaHQ#4950 from @nasbench - Comply With v2 Spec Changes

  Show description for 598d29f
  nasbench

  authored
  598d29f

  Copy full SHA for 598d29f

Commits on Aug 11, 2024

• Merge PR SigmaHQ#4964 from @fukusuket - Fix rules to not use Lookahead regex

  Show description for c8a3761
  

  fukusuket

  and

  nasbench

  authored
  c8a3761

  Copy full SHA for c8a3761

Pagination

Previous

Next