Open source
25 pull requests merged into 7 upstream projects, mostly detection content and the tooling around it.
SigmaHQ/sigma
7 merged ↗New detection rules and fixes to existing ones in the main Sigma rule repository.
- New rule: self-deletion via choice/del command combination
- New rule: bindfltapi.dll execution by suspicious process
- Suspicious Kerberos Ticket Request (ScriptBlock + CLI): remove the .GetRequest() requirement
- UFW Disable Attempt: fix broken ufw-init detection and broaden coverage
- New rule: Chaos/Darkside ransomware-style hidden cmd launching suspicious targets
- Syslog clearing: add variants and empty-file idioms
- LSASS procdump: additional flags and service names
- Modify System Firewall: add nftables delete/flush to the selection set
- PowerShell script rules: add CIM alias
redcanaryco/atomic-red-team
8 merged ↗Atomic tests mapped to MITRE ATT&CK techniques, across Windows, Linux, macOS and FreeBSD.
- T1546.005: add Trap DEBUG atomic test
- T1027 / T1027.013: character array and password-protected ZIP obfuscation tests
- T1496 Resource Hijacking: Windows CPU load simulation
- T1113: RDP bitmap cache extraction test
- T1003.007: refactor FreeBSD heap memory dumping in dump_heap.py
- T1652: device driver discovery for Linux and macOS
- T1049: process-aware, cross-platform network discovery
- T1007: service discovery methods across platforms
logpoint/pySigma-backend-logpoint
3 merged ↗The pySigma backend that converts Sigma rules into Logpoint queries.
NVIDIA/NemoClaw
3 merged ↗Reliability fixes and docs for NVIDIA's plugin for secure OpenClaw installs.
Azure/Azure-Sentinel
2 merged ↗Hunting queries, analytics and validation tooling for Microsoft Sentinel.
SigmaHQ/pySigma
1 merged ↗The core library that parses Sigma rules and converts them to queries.
SigmaHQ/pySigma-backend-elasticsearch
1 merged ↗The Elasticsearch backend for pySigma.