Skip to content

Pull requests: SigmaHQ/sigma

New pull request New
188 Open 5,122 Closed
188 Open 5,122 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Add Administrator Changed Authentication Method Of Another User Review Needed The PR requires review Rules
#6243 opened Aug 20, 2026 by descambiado Loading…
update: linux anti forensics rules Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6242 opened Aug 19, 2026 by swachchhanda000 Collaborator Loading…
Replace legacy rule with a new one Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6241 opened Aug 18, 2026 by norbert791 Contributor Loading…
1
Fix renamed PowerShell detection in decryption pattern rule Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6240 opened Aug 18, 2026 by khoi-arch Loading…
chore(tests): fix get_level in deprecated_rules and optimize test_rules execution Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6239 opened Aug 16, 2026 by Shaivarth Loading…
Add Kerberos Pre-Authentication Disabled On A User Account Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6238 opened Aug 16, 2026 by mmadersbacher Loading…
feat: dual-signal IDS triage (SnortML GID411 ≠ signature TP) Maintenance Related to additions and update of the repository features Review Needed The PR requires review Rules
#6237 opened Aug 16, 2026 by AAH20 Loading…
new: closes #4542 - add rules for IFEO Debugger tampering, disabling usb storage and windowsupdate Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6236 opened Aug 16, 2026 by swachchhanda000 Collaborator Loading…
update: expand sudoers file modification coverage Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6235 opened Aug 15, 2026 by Haseeb-1698 Loading…
Add macOS rule for sensitive data archived via ditto MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6234 opened Aug 15, 2026 by clivoa Loading…
Add macOS rule for browser credential database query via a database CLI utility MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6233 opened Aug 15, 2026 by clivoa Loading…
Archive New Rule References
#6232 opened Aug 15, 2026 by github-actions Bot Loading…
🧪 Add simulation sections (Atomic Red Team) to 34 registry_set rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6231 opened Aug 14, 2026 by frack113 Member Loading…
9
new: silent-call rules Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6230 opened Aug 14, 2026 by mromanode Loading…
new: SSH Authorized Keys Made Immutable Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6229 opened Aug 14, 2026 by marvalous123 Loading…
fix: AWS IAM Backdoor Users Keys filter using |fieldref|contains Review Needed The PR requires review Rules
#6227 opened Aug 14, 2026 by swachchhanda000 Collaborator Loading…
1
docs: improve description of Sysmon File Executable Creation Detected Ready to Merge Rules Windows Pull request add/update windows related rules
#6226 opened Aug 13, 2026 by valmal04 Loading… Sigma-August-Release-26
1
3
🦺 update pySigma-validators-sigmahq to 0.21 Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6225 opened Aug 13, 2026 by frack113 Member Loading…
6
new: resetnightmare rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6224 opened Aug 13, 2026 by swachchhanda000 Collaborator Loading…
test: add regression data for 77 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6221 opened Aug 12, 2026 by frack113 Member Loading…
1 task done
Add New ChainDrop NPM Supply-Chain Attack Rules Emerging-Threats Review Needed The PR requires review Rules
#6219 opened Aug 11, 2026 by harshthakur6293 Loading…
1
Add Git configuration command execution rules Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6218 opened Aug 11, 2026 by signalblur Contributor Loading…
new: Command Execution via Git Ext Transport Linux Pull request add/update linux related rules MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6217 opened Aug 11, 2026 by signalblur Contributor Loading…
test: add regression data for 82 existing rules Review Needed The PR requires review Rules Threat-Hunting Windows Pull request add/update windows related rules
#6213 opened Aug 8, 2026 by frack113 Member Loading…
1 task done
new: MFA Bypass via registry tampering and PowerShell requirement tam Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6212 opened Aug 8, 2026 by damnkrishna Loading…
ProTip! What’s not been updated in a month: updated:<2026-07-20.