Skip to content

Pull requests: SigmaHQ/sigma

New pull request New
195 Open 5,156 Closed
195 Open 5,156 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

ci: chore: Optimize goodlog tests: matrix strategy, caching, and Python validation Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6284 opened Sep 9, 2026 by swachchhanda000 Collaborator • Draft
Fix Initiatied.By and Sucess typos in Account Created Or Deleted By Non Approved Actor Review Needed The PR requires review Rules
#6283 opened Sep 8, 2026 by descambiado Contributor Loading…
1 task done
@swachchhanda000
3
New rule: Authentication Method Registered From Outside Corporate Network Additional Data Needed Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules
#6282 opened Sep 8, 2026 by roromer0 Loading…
2
New rule: Suspicious Inbox Forwarding Rule Created Post-AiTM Session Hijack Additional Data Needed Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules
#6281 opened Sep 8, 2026 by roromer0 Loading…
3
new: PackClient malware detections Emerging-Threats Review Needed The PR requires review Rules
#6280 opened Sep 8, 2026 by ivanimmanuel-dev Loading…
🩺 add regression data from evtx-attack-samples Emerging-Threats Review Needed The PR requires review Rules Threat-Hunting Windows Pull request add/update windows related rules
#6279 opened Sep 7, 2026 by frack113 Member Loading…
new: Federated Identity Credential Added To Entra Application Or Managed Identity Additional Data Needed Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules
#6278 opened Sep 6, 2026 by earbona23 Loading…
2
rules/azure: End-user consent to app with mailbox + offline_access delegated scopes Review Needed The PR requires review Rules
#6277 opened Sep 3, 2026 by earbona23 Loading…
Add detection for owner added to service principal Review Needed The PR requires review Rules
#6276 opened Sep 2, 2026 by descambiado Contributor Loading… Sigma-August-Release-26
2
Add 3 rules from a PyArmor-obfuscated PyInstaller loader detonation Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6274 opened Sep 2, 2026 by dclayton454 Loading…
Add AmnesiaStealer macOS Detection Rules Emerging-Threats Review Needed The PR requires review Rules
#6273 opened Sep 2, 2026 by warlocksmurf Loading…
New Rule: Potential Indirect Command Execution Via XBootMgr.EXE Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6264 opened Aug 28, 2026 by COMPUMAX-EC Loading…
3 tasks done
new: add coverage for schtasks creation via Schedule.Service ComObject Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6262 opened Aug 28, 2026 by swachchhanda000 Collaborator Loading…
1
New rule: Potential Virtualization/Sandbox Evasion Via WMI Or Registry Recon Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6258 opened Aug 26, 2026 by Ruben-PO Loading…
rules: add AWS Secrets Manager batch secret retrieval detection Review Needed The PR requires review Rules
#6257 opened Aug 26, 2026 by ChrisJr404 Loading…
new: BTR Reforged Exploit Review Needed The PR requires review Windows Pull request add/update windows related rules
#6255 opened Aug 26, 2026 by swachchhanda000 Collaborator Loading…
new: potential steam phishing domain rule Review Needed The PR requires review Rules
#6253 opened Aug 24, 2026 by OmereKurt Loading…
new: Applaunch ClickOnce Activation Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6252 opened Aug 24, 2026 by JirayuThongchotchaung Loading…
Add Administrator Changed Authentication Method Of Another User Review Needed The PR requires review Rules
#6243 opened Aug 20, 2026 by descambiado Contributor Loading…
update: linux anti forensics rules Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6242 opened Aug 19, 2026 by swachchhanda000 Collaborator Loading…
Replace legacy rule with a new one Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6241 opened Aug 18, 2026 by norbert791 Contributor Loading…
1
Fix renamed PowerShell detection in decryption pattern rule Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6240 opened Aug 18, 2026 by khoi-arch Loading…
Add Kerberos Pre-Authentication Disabled On A User Account Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6238 opened Aug 16, 2026 by mmadersbacher Loading…
feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) Maintenance Related to additions and update of the repository features Review Needed The PR requires review Rules
#6237 opened Aug 16, 2026 by AAH20 Loading…
new: closes #4542 - add rules for IFEO Debugger tampering, disabling usb storage and windowsupdate Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6236 opened Aug 16, 2026 by swachchhanda000 Collaborator Loading…
1
ProTip! no:milestone will show everything without a milestone.