Swachchhanda Shrawan Poudel 8372e76e9b Merge PR #5629 from @swachchhanda000 - increase rule coverage ...

update: Regsvr32 DLL Execution With Suspicious File Extension - add coverage for regsvr executing '.log' extension
update: Suspicious Windows Service Tampering - add coverage for Windows service tampering through wmic and PowerShell WMI module

2025-09-22 12:18:11 +02:00

..

builtin

Merge PR #5644 from @M1ra1B0T - Update Provider Name for Kerberos based rules

2025-09-22 11:50:48 +02:00

create_remote_thread

Merge PR #5513 from @swachchhanda000 - fix FPs observed via Aurora

2025-07-08 10:29:01 +02:00

create_stream_hash

Merge PR #5637 from @nasbench - Promote older rules status from experimental to test

2025-09-22 11:41:37 +02:00

dns_query

Merge PR #5579 from @Liran017 - Update MITRE ATT&CK tags for multiple rules

2025-08-14 14:08:21 +02:00

driver_load

Merge PR #5088 from @frack113 - Remove custom dedicated hash fields from sigmac

2024-11-25 09:30:14 +01:00

file

Merge PR #5639 from @swachchhanda000 - Fix some more fps found in prod

2025-09-22 11:46:48 +02:00

image_load

Merge PR #5637 from @nasbench - Promote older rules status from experimental to test

2025-09-22 11:41:37 +02:00

network_connection

Merge PR #5572 from @nasbench - Promote older rules status from experimental to test

2025-08-14 14:05:46 +02:00

pipe_created

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

powershell

Merge PR #5557 from @phantinuss - Bump pySigma-validators-sigmahq to 0.10

2025-08-14 14:29:11 +02:00

process_access

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

process_creation

Merge PR #5629 from @swachchhanda000 - increase rule coverage

2025-09-22 12:18:11 +02:00

process_tampering

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

raw_access_thread

Merge PR #5639 from @swachchhanda000 - Fix some more fps found in prod

2025-09-22 11:46:48 +02:00

registry

Merge PR #5557 from @phantinuss - Bump pySigma-validators-sigmahq to 0.10

2025-08-14 14:29:11 +02:00

sysmon

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

wmi_event

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00