Skip to content

Pull requests: SigmaHQ/sigma

New pull request New
193 Open 5,109 Closed
193 Open 5,109 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

new: closes #4542 - add rules for IFEO Debugger tampering, disabling usb storage and windowsupdate Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6236 opened Aug 16, 2026 by swachchhanda000 Collaborator Loading…
update: expand sudoers file modification coverage Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6235 opened Aug 15, 2026 by Haseeb-1698 Loading…
Add macOS rule for sensitive data archived via ditto MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6234 opened Aug 15, 2026 by clivoa Loading…
Add macOS rule for browser credential database query via a database CLI utility MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6233 opened Aug 15, 2026 by clivoa Loading…
Archive New Rule References
#6232 opened Aug 15, 2026 by github-actions Bot Loading…
🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6231 opened Aug 14, 2026 by frack113 Member Loading…
5
new: silent-call rules Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6230 opened Aug 14, 2026 by mromanode Loading…
new: SSH Authorized Keys Made Immutable Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6229 opened Aug 14, 2026 by marvalous123 Loading…
new: user creation attempt via adsi Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6228 opened Aug 14, 2026 by swachchhanda000 Collaborator Loading…
1
fix: AWS IAM Backdoor Users Keys filter using |fieldref|contains Review Needed The PR requires review Rules
#6227 opened Aug 14, 2026 by swachchhanda000 Collaborator Loading…
1
docs: improve description of Sysmon File Executable Creation Detected Ready to Merge Rules Windows Pull request add/update windows related rules
#6226 opened Aug 13, 2026 by valmal04 Loading… Sigma-August-Release-26
1
2
🦺 update pySigma-validators-sigmahq to 0.21 Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6225 opened Aug 13, 2026 by frack113 Member Loading…
6
new: resetnightmare rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6224 opened Aug 13, 2026 by swachchhanda000 Collaborator Loading…
test: add regression data for 77 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6221 opened Aug 12, 2026 by frack113 Member Loading…
1 task done
Add New ChainDrop NPM Supply-Chain Attack Rules Emerging-Threats Review Needed The PR requires review Rules
#6219 opened Aug 11, 2026 by harshthakur6293 Loading…
Add Git configuration command execution rules Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6218 opened Aug 11, 2026 by signalblur Contributor Loading…
new: Command Execution via Git Ext Transport Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6217 opened Aug 11, 2026 by signalblur Contributor Loading…
test: add regression data for 82 existing rules Review Needed The PR requires review Rules Threat-Hunting Windows Pull request add/update windows related rules
#6213 opened Aug 8, 2026 by frack113 Member Loading…
1 task done
new: MFA Bypass via registry tampering and PowerShell requirement tam Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6212 opened Aug 8, 2026 by damnkrishna Loading…
macOS: cover launchctl bootstrap, add AMOS LaunchDaemon install and wallet replacement rules Emerging-Threats MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6209 opened Aug 7, 2026 by raimurokko Loading…
test: add regression data for 13 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6208 opened Aug 7, 2026 by frack113 Member Loading…
1 task done
Add rule: Cisco Duo Push Marked As Fraudulent By User Ready to Merge Rules
#6206 opened Aug 6, 2026 by Aymwvn Loading… Sigma-August-Release-26
5
macOS: cover xattr -c in the Gatekeeper bypass rule, add ClickFix stage-3 dropper
#6205 opened Aug 6, 2026 by raimurokko Loading…
1
chore: add json/ndjson/jsonl to regression test Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6203 opened Aug 6, 2026 by pH-T Contributor Loading…
15
Add rule: Sudo GTFOBins Shell Escape Privilege Escalation - Linux Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6201 opened Aug 5, 2026 by Aymwvn Loading…
ProTip! Adding no:label will show everything without a label.