sigma-rules

Files

T

Samirbous 2e223459c4 [New/Tuning] K8 RBAC Privs (#5987 )

* [New/Tuning] K8 RBAC Privs

- new rule with high severity for wildcards for both verb/resource
- added responseObject to an existing rule as on my testing it did not trigger on requestObject (unknown type of on EKS logs), also added few sensitive resources and adjusted logic to ignore list/get on things like roles/clusterroles etc.

* ++

* Rename persistence_kubernetes_role_patch_wildcard_verbs_resources_response.toml to  privilege_escalation_role_patch_wildcard_verbs_resources_response.toml

* Update and rename  privilege_escalation_role_patch_wildcard_verbs_resources_response.toml to privilege_escalation_role_patch_wildcard_verbs_resources_response.toml

* Update privilege_escalation_role_patch_wildcard_verbs_resources_response.toml

* Update privilege_escalation_role_patch_wildcard_verbs_resources_response.toml

* Update persistence_sensitive_role_creation_or_modification.toml

* Update persistence_sensitive_role_creation_or_modification.toml

* Update privilege_escalation_role_patch_wildcard_verbs_resources_response.toml

2026-05-02 15:08:00 +01:00

aws

[New] Diverse AWS rules (#5913 )

2026-05-01 21:57:28 +01:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.4 (#5965 )

2026-04-23 00:13:05 +05:30

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )