Commits

Breadcrumbs

History for

on0192a52

User selector

All users

Datepicker

All time

Commit History

Commits on May 10, 2024

• Merge PR SigmaHQ#4845 from @ahmedfarou22 - Proxy WebDAV Rule Improvements/New Rule

  Show description for b175b15
  

  ahmedfarou22

  and

  nasbench

  authored
  b175b15

  Copy full SHA for b175b15

• Merge PR SigmaHQ#4843 from @frack113 - Add New-NetFirewallRule usage related rules

  Show description for 392e3a3
  

  frack113

  and

  nasbench

  authored
  392e3a3

  Copy full SHA for 392e3a3

Commits on May 2, 2024

• Merge PR SigmaHQ#4841 from @nasbench - Promote older rules status from experimental to test

  Show description for f7ec533
  github-actions[bot]

  authored
  f7ec533

  Copy full SHA for f7ec533

Commits on Apr 25, 2024

• Merge PR SigmaHQ#4827 from @netgrain - New analytic for python pth files

  Show description for 7a947f4
  

  netgrain

  and

  nasbench

  authored
  7a947f4

  Copy full SHA for 7a947f4

Commits on Apr 1, 2024

• Merge PR SigmaHQ#4791 from @nasbench - Promote older rules status from experimental to test

  Show description for a8e1ecd
  

  github-actions[bot]

  and

  nasbench

  authored
  a8e1ecd

  Copy full SHA for a8e1ecd

Commits on Mar 26, 2024

• Merge PR SigmaHQ#4774 from @nasbench - Fix and update multiple rules

  Show description for f0395b8
  

  nasbench

  and

  phantinuss

  authored
  f0395b8

  Copy full SHA for f0395b8

• Merge PR SigmaHQ#4783 from @nasbench - Update registry rules logic and fix some false positives

  Show description for 8cbcaea
  

  nasbench

  and

  phantinuss

  authored
  8cbcaea

  Copy full SHA for 8cbcaea

Commits on Mar 15, 2024

• Merge PR SigmaHQ#4767 from @frack113 - Update additional rules to use the windash modifier

  Show description for 33bed27
  frack113

  authored
  33bed27

  Copy full SHA for 33bed27

Commits on Mar 13, 2024

• Merge PR SigmaHQ#4765 from @frack113 - Update additional rules to use the cidr modifier

  Show description for 6abf058
  

  frack113

  and

  nasbench

  authored
  6abf058

  Copy full SHA for 6abf058

Commits on Mar 11, 2024

• Merge PR SigmaHQ#4762 from @nasbench - Fix false positives found in testing

  Show description for 1758511
  nasbench

  authored
  1758511

  Copy full SHA for 1758511

Commits on Mar 7, 2024

• Merge PR SigmaHQ#4757 from @nasbench - add new rules related to shell context tampering

  Show description for eea07fc
  nasbench

  authored
  eea07fc

  Copy full SHA for eea07fc

Commits on Feb 26, 2024

• Merge PR SigmaHQ#4738 from @nasbench - Small fixes and metadata updates

  Show description for 8af1ab8
  nasbench

  authored
  8af1ab8

  Copy full SHA for 8af1ab8

• Merge PR SigmaHQ#4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules

  Show description for 1fb3ce5
  

  qasimqlf

  and

  nasbench

  authored
  1fb3ce5

  Copy full SHA for 1fb3ce5

• Merge PR from SigmaHQ#4736 @RG9n - Add/Update ScreenConnect RMM Related Rules

  Show description for 4eccac5
  

  RG9n

  and

  nasbench

  authored
  4eccac5

  Copy full SHA for 4eccac5

Commits on Feb 12, 2024

• Merge PR SigmaHQ#4698 from @swachchhanda000 - Added rules that detect possible activities associated with services and modules enumeration

  Show description for 7509f6a
  

  swachchhanda000

  and

  nasbench

  authored
  7509f6a

  Copy full SHA for 7509f6a

• Merge PR SigmaHQ#4702 from @nasbench - Rule tuning and updates

  Show description for 2acebc9
  nasbench

  authored
  2acebc9

  Copy full SHA for 2acebc9

Commits on Feb 8, 2024

• Merge PR SigmaHQ#4692 from @jstnk9 - Add new rules related to IExpress abuse

  Show description for 5fac8cb
  

  3 peopleauthored
  5fac8cb

  Copy full SHA for 5fac8cb

Commits on Jan 29, 2024

• Merge PR SigmaHQ#4681 from @nasbench - Add Missing Ref & Tags

  Show description for be359ef
  

  nasbench

  and

  phantinuss

  authored
  be359ef

  Copy full SHA for be359ef

Commits on Jan 24, 2024

• Merge PR SigmaHQ#4691 from @qasimqlf - Fix typo in wmic process name

  Show description for 24f3228
  qasimqlf

  authored
  24f3228

  Copy full SHA for 24f3228

Commits on Jan 23, 2024

• Merge PR SigmaHQ#4684 from @phantinuss - Multiple FP fixes & rule updates

  Show description for 399cca3
  

  phantinuss

  and

  nasbench

  authored
  399cca3

  Copy full SHA for 399cca3

Commits on Jan 22, 2024

• Merge PR SigmaHQ#4682 from @jstnk9 - Add new rules related to MODE.COM usage in changing code pages

  Show description for 8cc9841
  

  3 peopleauthored
  8cc9841

  Copy full SHA for 8cc9841

Commits on Jan 15, 2024

• Merge PR SigmaHQ#4672 from @tr0mb1r - move to TH and filter vmware tools

  Show description for feded2f
  

  tr0mb1r

  and

  nasbench

  authored
  feded2f

  Copy full SHA for feded2f

Commits on Jan 1, 2024

• chore: promote older rules status from experimental to test (SigmaHQ#4651)

  Show description for c3fe2da
  

  github-actions[bot]

  and

  nasbench

  authored
  c3fe2da

  Copy full SHA for c3fe2da

Commits on Dec 21, 2023

• Merge PR SigmaHQ#4577 from @nasbench - Multiple Fixes & Updates

  Show description for e052677
  

  nasbench

  and

  phantinuss

  authored
  e052677

  Copy full SHA for e052677

• Merge PR SigmaHQ#4536 from @frack113 - Add New Rules Related To Sysvol Access

  Show description for 2cb6ccd
  

  frack113

  and

  nasbench

  authored
  2cb6ccd

  Copy full SHA for 2cb6ccd

Commits on Dec 18, 2023

• Merge PR SigmaHQ#4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates

  Show description for 412edd1
  

  nasbench

  and

  phantinuss

  authored
  412edd1

  Copy full SHA for 412edd1

• Merge PR SigmaHQ#4618 from @ruppde - Filter out Webex binary

  Show description for d652a9e
  ruppde

  authored
  d652a9e

  Copy full SHA for d652a9e

Commits on Dec 4, 2023

• Merge PR SigmaHQ#4597 from @nasbench - Update Process Access Rules

  Show description for 19d271b
  

  nasbench

  and

  phantinuss

  authored
  19d271b

  Copy full SHA for 19d271b

Commits on Dec 1, 2023

• Merge PR SigmaHQ#4607 from @netgrain - Adding TH Detections For Powershell Cypto Namespace Usage

  Show description for c9054fa
  

  3 peopleauthored
  c9054fa

  Copy full SHA for c9054fa

• Merge PR SigmaHQ#4611 from @nasbench - Promote Older Rules Status From experimental To test

  Show description for ae960f0
  

  github-actions[bot]

  and

  nasbench

  authored
  ae960f0

  Copy full SHA for ae960f0

Commits on Nov 21, 2023

• Merge PR SigmaHQ#4585 from @phantinuss - Update evtx-baseline to v0.8 and fix FP found in baseline

  Show description for 2c24b24
  phantinuss

  authored
  2c24b24

  Copy full SHA for 2c24b24

Commits on Nov 20, 2023

• Merge PR SigmaHQ#4532 from @alwashali - Update EventLog Query Related Rules

  Show description for bb97300
  

  3 peopleauthored
  bb97300

  Copy full SHA for bb97300

Commits on Nov 15, 2023

• Merge PR SigmaHQ#4564 from @nasbench - Fix Further FPs Found In Testing

  Show description for c125ae7
  phantinuss

  committed
  c125ae7

  Copy full SHA for c125ae7

• Revert "Merge PR SigmaHQ#4564 from @nasbench - Fix Further FPs Found In Testing"

  Show description for 8dbf7b9
  phantinuss

  committed
  8dbf7b9

  Copy full SHA for 8dbf7b9

• Merge PR SigmaHQ#4564 from @nasbench - Fix Further FPs Found In Testing

  Show description for dddd7cd
  phantinuss

  committed
  dddd7cd

  Copy full SHA for dddd7cd

Pagination

Previous

Next