-
-
Notifications
You must be signed in to change notification settings - Fork 2.8k
OpenAug 14, 2026
Overdue by 15 day(s)
•Due by August 1, 2026
•Last updated 34% complete
List view
0 of 31 selected 0 issues of 31 selected
Improved Linux local account discovery detection and false positives
LinuxPull request add/update linux related rulesPull request add/update linux related rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).Tamper firewall by Registry
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).update: Potential Netcat Reverse Shell Execution - add nc.openbsd and nc.traditional binary matches
LinuxPull request add/update linux related rulesPull request add/update linux related rulesStatus: Open (in progress).Add new powershell rule
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).new: windows discovery rules
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).new: susp package execution
LinuxPull request add/update linux related rulesPull request add/update linux related rulesReview NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Add rule for Win connection to suspicious WiFi
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).new: Rules for AWS Bedrock LLMJacking
Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).Wsl rules
WindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Update Clearing Windows Console History with Extended Coverage
Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rulesReview NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).fix: Install Root Certificate - Match Certificate Trust Utilities In CommandLine
LinuxPull request add/update linux related rulesPull request add/update linux related rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).New rules: Microsoft Defender for Office 365
Review NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).new: AWS Cloudtrail S3 bucket Block Public Access settings weakened
Review NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).update: multiple regsvr32 rules tuning
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Add rule: HackTool - PrintSpoofer Execution
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Add Celery worker shell-spawn detection (rev. of #6108)
LinuxPull request add/update linux related rulesPull request add/update linux related rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).fix: net user rules coverage and deprecate redundant rule
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).new: EDRChoker QoS ThrottleRate Set by WMI
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).new: edrchoker qos throttle rate modification rules
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).feat: Add Azure application using authentication transfer flow
Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).update: Azure Rules(
activity_logsfolder) - align detection fields to Event Hub formatReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).fix: macOS network service scanning filter matches any 'l', not the netcat listen flag
Author Input Requiredchanges the require information from original author of the ruleschanges the require information from original author of the rulesMacOSPull request add/update macos related rulesPull request add/update macos related rulesReview NeededThe PR requires reviewThe PR requires reviewStatus: Open (in progress).update: Add current Acronis Cyber Protect service names to proc_creation_win_susp_service_tamper
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Add detection for Lynx Ransomware execution flags
Review NeededThe PR requires reviewThe PR requires reviewWindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).Add rule for arbitrary file download via msoxmled.exe (LOLBAS)
WindowsPull request add/update windows related rulesPull request add/update windows related rulesStatus: Open (in progress).