Merge PR #6118 from @ShobanChiddarth - Add AWS Cloudtrail S3 bucket Block Public Access settings weakened new: AWS Bucket Block Public Access Weakened --------- Co-authored-by: Nasreddine Bencherchali <[email protected]> Co-authored-by: Swachchhanda Shrawan Poudel <[email protected]>
Merge PR #5987 from @fukusuket - Align detection fields of Azure Rules to Event Hub format update: Azure Active Directory Hybrid Health AD FS New Server - add refs and align fields to Event Hub format update: Azure Active Directory Hybrid Health AD FS Service Delete - add refs and align fields to Event Hub format…
Merge PR #5646 from @swachchhanda000 - Add rules to detect goldendMSA attack new - Potential Delegated Managed Service Account (dMSA) Enumeration on Windows System new - Potential KDS Root Key Access on Windows System new - Potential Kerberos Pre-Authentication Failure for Machine Accounts new - HackTool - GoldenDMSA…
Merge PR #6467 from @azullus - Fix `Powershell Sensitive File Discovery` - match ls/gci/Get-ChildItem as whole words fix: Powershell Sensitive File Discovery - match ls/gci/Get-ChildItem/dir as whole words instead of substrings --------- Co-authored-by: Swachchhanda Shrawan Poudel…
Merge PR #6483 from @memx13 - Fix Image path separator in `Shai-Hulud 2.0 Malicious NPM Package Installation - Linux` fix: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux - use the Linux path separator in the Image filter
Merge PR #6485 from @swachchhanda000 - Fix False Positives Reported By THOR Across Multiple Rules fix: A Rule Has Been Deleted From The Windows Firewall Exception List - add filter for Local System (S-1-5-18), msiexec, Google Updater in SystemTemp; promote MsMpEng to main filter fix: Alternate PowerShell Hosts -…
Merge PR #6489 from @swachchhanda000 - Update sigma-rules-validator to fix Ubuntu 26 sudo env propagation fix: ci: update sigma-rules-validator to fix Ubuntu 26 sudo env propagation issue
fix: remove SYNCHRONIZE from suspicious lsass access (#6490) * fix: remove SYNCHRONIZE from suspicious lsass access Remove 0x100000 (SYNCHRONIZE) from the detection for suspicious process access to LSASS. SYNCHRONIZE can't be used for reading LSASS memory or copying handles and is therefore not really suspicious. *…
Merge PR #6475 from @Salmanali9090 - Fix ResultDescription field name casing fix: Sign-in Failure Due to Conditional Access Requirements Not Met - Fix ResultDescription field name casing --------- Co-authored-by: Swachchhanda Shrawan Poudel <[email protected]>
Merge PR #5872 from @ksyeung - Add Zillya Antivirus DLL Sideloading Detection update: Potential AV Software DLL Sideloading - add Zillya Antivirus sideloading SystemStatus.dll --------- Co-authored-by: Swachchhanda Shrawan Poudel <[email protected]>
Merge PR #5469 from @swachchhanda000 - Hacktool - Defendnot Execution new: Hacktool - Defendnot Default Scheduled Task Activity new: Hacktool - DefendNot Installation via PowerShell One-Liner new: Hacktool - Defendnot Execution new: Microsoft Security Center AV Registry Modification --------- Co-authored-by:…
Merge PR #6469 from @nasbench - Archive new rule references and update cache file chore: archive new rule references and update cache file
Merge PR #6468 from @redsand - Fix Legitimate Application Writing Files In Uncommon Location - filter Dell TechHub esentutl SRUDB repair fix: Legitimate Application Writing Files In Uncommon Location - filter Dell TechHub esentutl SRUDB repair and copy --------- Co-authored-by: Swachchhanda Shrawan Poudel…
Merge PR #6180 from @munzzyy - Fix macOS netcat listen filter fix: MacOS Network Service Scanning - filter matched any letter 'l' instead of the netcat listen flag --------- Co-authored-by: frack113 <[email protected]> Co-authored-by: Swachchhanda Shrawan Poudel…
Merge PR #6082 from @Swarup-Ingale - Add `Lynx Ransomware Execution Pattern` new: Lynx Ransomware Execution Pattern --------- Co-authored-by: Swachchhanda Shrawan Poudel <[email protected]> Co-authored-by: frack113 <[email protected]>
Merge PR #5808 from @swachchhanda000 - Add and expand Internal Tools Registry Tampering detection new: Registry Tampering Of Internal Tools Settings remove: Registry Explorer Policy Modification - deprecate in favour of e2482f8d-3443-4237-b906-cc145d87a076 update: Disable Internal Tools or Feature in Registry - add…
Merge PR #6460 from @redsand - Fix Rundll32 Execution With Uncommon DLL Extension fix: Rundll32 Execution With Uncommon DLL Extension - Exclude the Windows streamci StreamingDeviceSetup class installer
Merge PR #6120 from @Batina-Jennifer - Add Celery worker shell-spawn detection new: Shell Spawned by Celery Worker Process --------- Co-authored-by: Nasreddine Bencherchali <[email protected]> Co-authored-by: frack113 <[email protected]> Co-authored-by: Swachchhanda Shrawan…
Merge PR #6151 from @xuanxuan0 - Add missing Acronis Cyber Protect service names to `Suspicious Windows Service Tampering` update: Suspicious Windows Service Tampering - add missing Acronis Cyber Protect service-names --------- Co-authored-by: Swachchhanda Shrawan Poudel…
Merge PR #6472 from @Neo23x0 - Refactor detection logic to regex and broaden extension/filter scope fix: Suspicious Double Extension Files - Convert to regex, expand extensions and filters --------- Co-authored-by: Swachchhanda Shrawan Poudel <[email protected]>