Skip to content

Pull requests: SigmaHQ/sigma

New pull request New
188 Open 5,109 Closed
188 Open 5,109 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6231 opened Aug 14, 2026 by frack113 Member Loading…
new: silent-call rules Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6230 opened Aug 14, 2026 by mromanode Loading…
new: SSH Authorized Keys Made Immutable Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6229 opened Aug 14, 2026 by marvalous123 Loading…
new: user creation attempt via adsi Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6228 opened Aug 14, 2026 by swachchhanda000 Collaborator Loading…
1
fix: AWS IAM Backdoor Users Keys filter using |fieldref|contains Review Needed The PR requires review Rules
#6227 opened Aug 14, 2026 by swachchhanda000 Collaborator Loading…
1
docs: improve description of Sysmon File Executable Creation Detected Ready to Merge Rules Windows Pull request add/update windows related rules
#6226 opened Aug 13, 2026 by valmal04 Loading… Sigma-August-Release-26
1
2
🦺 update pySigma-validators-sigmahq to 0.21 Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6225 opened Aug 13, 2026 by frack113 Member Loading…
1
new: resetnightmare rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6224 opened Aug 13, 2026 by swachchhanda000 Collaborator Loading…
test: add regression data for 77 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6221 opened Aug 12, 2026 by frack113 Member Loading…
1 task done
Add New ChainDrop NPM Supply-Chain Attack Rules Emerging-Threats Review Needed The PR requires review Rules
#6219 opened Aug 11, 2026 by harshthakur6293 Loading…
Add Git configuration command execution rules Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6218 opened Aug 11, 2026 by signalblur Contributor Loading…
new: Command Execution via Git Ext Transport Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6217 opened Aug 11, 2026 by signalblur Contributor Loading…
test: add regression data for 82 existing rules Review Needed The PR requires review Rules Threat-Hunting Windows Pull request add/update windows related rules
#6213 opened Aug 8, 2026 by frack113 Member Loading…
1 task done
new: MFA Bypass via registry tampering and PowerShell requirement tam Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6212 opened Aug 8, 2026 by damnkrishna Loading…
macOS: cover launchctl bootstrap, add AMOS LaunchDaemon install and wallet replacement rules Emerging-Threats MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6209 opened Aug 7, 2026 by raimurokko Loading…
test: add regression data for 13 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6208 opened Aug 7, 2026 by frack113 Member Loading…
1 task done
Add rule: Cisco Duo Push Marked As Fraudulent By User Ready to Merge Rules
#6206 opened Aug 6, 2026 by Aymwvn Loading… Sigma-August-Release-26
5
macOS: cover xattr -c in the Gatekeeper bypass rule, add ClickFix stage-3 dropper
#6205 opened Aug 6, 2026 by raimurokko Loading…
1
chore: add json/ndjson/jsonl to regression test Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6203 opened Aug 6, 2026 by pH-T Contributor Loading…
15
Add rule: Sudo GTFOBins Shell Escape Privilege Escalation - Linux Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6201 opened Aug 5, 2026 by Aymwvn Loading…
Add ClickLock Stealer macOS Detection Rules Emerging-Threats Review Needed The PR requires review Rules
#6200 opened Aug 3, 2026 by warlocksmurf Loading…
Add rule: HackTool - SharpSCCM Execution Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6199 opened Aug 1, 2026 by ashish-cybersec Loading…
6
Update ATT&CK Heatmap Coverage
#6196 opened Aug 1, 2026 by github-actions Bot Loading…
Add rule: HackTool - Kerbrute Execution Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6195 opened Jul 31, 2026 by ashish-cybersec Loading…
Add Moodle detection rules (web server logs) - initial coverage Review Needed The PR requires review Rules
#6194 opened Jul 31, 2026 by sankettaware16 Loading…
ProTip! Type g p on any issue or pull request to go back to the pull request listing page.