sigma-rules

Files

T

Ruben Groenewoud 57599e3796 [New Rule] Curl SOCKS Proxy Detected via Defend for Containers (#5596 )

* [New Rule] Curl SOCKS Proxy Detected via Defend for Containers

* Added reference

* Update rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Update time range for cloud defend rule

* Update rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

2026-01-26 16:46:59 +01:00

aws

[Rule Tunings] AWS remove target.entity.id and actor.entity.id fields (#5603 )

2026-01-22 15:01:49 -05:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

[Rule Tuning] Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource (#5589 )

2026-01-24 08:51:23 -05:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )