Skip to content

Actions: SigmaHQ/sigma

Actions

PR Labeler Workflow

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
pr-labeler.yml
632 workflow runs
632 workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
Add rule detecting inbound SSH drops on MikroTik WAN PR Labeler Workflow #1267: Pull request #6105 opened by OriolesMagic333
7s
7s
Add rule: indirect command execution via scp.exe PR Labeler Workflow #1266: Pull request #6104 opened by ashish-cybersec
10s
10s
Add rule: arbitrary command execution via git config override PR Labeler Workflow #1265: Pull request #6103 opened by ashish-cybersec
7s
7s
improve phishing detection PR Labeler Workflow #1264: Pull request #6102 opened by Dev2023-Op
10s
10s
new: wmi activity ntEventLogFile ClearEventLog failed attempts PR Labeler Workflow #1263: Pull request #6100 opened by swachchhanda000
10s
10s
Add detection for PnPUtil driver and device removal activity PR Labeler Workflow #1262: Pull request #6099 opened by Kvvvvvvvvv
7s
7s
Add cross-platform discovery/collection rules PR Labeler Workflow #1261: Pull request #6095 opened by einlamye
10s
10s
Add Sysinternals tooling and driver/UAC detection rules PR Labeler Workflow #1260: Pull request #6094 opened by einlamye
10s
10s
Add Active Directory / Kerberos attack detection rules PR Labeler Workflow #1259: Pull request #6093 opened by einlamye
9s
9s
Add ADS abuse and signed-binary LOLBIN detection rules PR Labeler Workflow #1258: Pull request #6092 opened by einlamye
8s
8s
Enrich ATT&CK tags (T1654/T1652) and dedupe bcdedit safeboot logic PR Labeler Workflow #1257: Pull request #6091 opened by einlamye
11s
11s
Sysinternals: add ARM64 (*64a.exe) binary coverage PR Labeler Workflow #1256: Pull request #6090 opened by einlamye
10s
10s
rules/windows: add Dev Tunnel hosting or creation process_creation rule PR Labeler Workflow #1255: Pull request #6089 opened by BL3IP
9s
9s
detect phishing and scam websites PR Labeler Workflow #1254: Pull request #6088 opened by Dev2023-Op
10s
10s
Add UNC2814 LLM API abuse Gemini C2 from scripting host PR Labeler Workflow #1253: Pull request #6087 opened by WRG-11
7s
7s
rules: add AWS Secrets Manager BatchGetSecretValue bulk retrieval (T1555.006) PR Labeler Workflow #1252: Pull request #6086 opened by adamalizeerj
7s
7s
new: bruteforce detection for a single account based on Event 4625 PR Labeler Workflow #1251: Pull request #6085 opened by Hydra2113
7s
7s
Add DDoS attack detection rules PR Labeler Workflow #1250: Pull request #6084 opened by jacob-masse
7s
7s
new: Dindoor Backdoor Malware rule PR Labeler Workflow #1249: Pull request #6083 opened by marcopedrinazzi
8s
8s
Add detection for Lynx Ransomware execution flags PR Labeler Workflow #1248: Pull request #6082 opened by Swarup-Ingale
9s
9s
Add Sigma rule for AWS Bedrock model invocation logging config deletion PR Labeler Workflow #1247: Pull request #6081 opened by ahmed-raza-shaikh
10s
10s
ci: pin and cache Python dependencies for reproducible builds PR Labeler Workflow #1246: Pull request #6080 opened by a0merr
9s
9s
new: Remote Management Tool - Ninite Execution From Suspicious Context & improve: End User Consent To Application - context, references, FP guidance PR Labeler Workflow #1245: Pull request #6079 opened by Lorygold
8s
8s
new: Potential Browser Cache Smuggling Payload Extraction PR Labeler Workflow #1244: Pull request #6078 opened by Tetryl12
10s
10s
Add APT36/SideCopy detection rules: CrimsonRAT persistence, XenoRAT task, mshta index.php chain PR Labeler Workflow #1243: Pull request #6076 opened by Pyhroff
12s
12s