sigma-rules

Files

T

Samirbous a892cd1b6d [New] Kubernetes Multi-Resource Discovery (#5971 )

* [New] Kubernetes Multi-Resource Setup and RBAC Discovery Burst

detects k8 multi-resource (at least 3 unique) discovery in 1m time interval from same user/ip/user_agent :

* Update discovery_kubernetes_multi_resource_setup_recon.toml

* Update discovery_kubernetes_multi_resource_setup_recon.toml

* Update discovery_kubernetes_multi_resource_setup_recon.toml

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

2026-05-02 10:32:50 +01:00

aws

[New] Diverse AWS rules (#5913 )

2026-05-01 21:57:28 +01:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.4 (#5965 )

2026-04-23 00:13:05 +05:30

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )