Skip to content

Pull requests: SigmaHQ/sigma

New pull request New
182 Open 5,101 Closed
182 Open 5,101 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

new: Mirai Telnet Scanning Detection Rule Emerging-Threats Review Needed The PR requires review Rules
#6216 opened Aug 11, 2026 by Gideon145 Loading…
test: add regression data for 82 existing rules Review Needed The PR requires review Rules Threat-Hunting Windows Pull request add/update windows related rules
#6213 opened Aug 8, 2026 by frack113 Member Loading…
1 task done
new: MFA Bypass via registry tampering and PowerShell requirement tam Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6212 opened Aug 8, 2026 by damnkrishna Loading…
fix: correct regression test match counts Review Needed The PR requires review
#6211 opened Aug 8, 2026 by frack113 Member Loading… Sigma-August-Release-26
macOS: cover launchctl bootstrap, add AMOS LaunchDaemon install and wallet replacement rules Emerging-Threats MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules
#6209 opened Aug 7, 2026 by raimurokko Loading…
test: add regression data for 13 existing rules Emerging-Threats Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6208 opened Aug 7, 2026 by frack113 Member Loading…
1 task done
Add rule: Cisco Duo Push Marked As Fraudulent By User Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules
#6206 opened Aug 6, 2026 by Aymwvn Loading…
3
macOS: cover xattr -c in the Gatekeeper bypass rule, add ClickFix stage-3 dropper
#6205 opened Aug 6, 2026 by raimurokko Loading…
fix: mofcomp rule Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6204 opened Aug 6, 2026 by swachchhanda000 Collaborator Loading… Sigma-August-Release-26
chore: add json/ndjson/jsonl to regression test Maintenance Related to additions and update of the repository features Review Needed The PR requires review
#6203 opened Aug 6, 2026 by pH-T Contributor Loading…
4
🩹 add SystemApps filter Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6202 opened Aug 6, 2026 by frack113 Member Loading…
Add rule: Sudo GTFOBins Shell Escape Privilege Escalation - Linux Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6201 opened Aug 5, 2026 by Aymwvn Loading…
Add ClickLock Stealer macOS Detection Rules Emerging-Threats Review Needed The PR requires review Rules
#6200 opened Aug 3, 2026 by warlocksmurf Loading…
Add rule: HackTool - SharpSCCM Execution Author Input Required changes the require information from original author of the rules Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6199 opened Aug 1, 2026 by ashish-cybersec Loading…
6
Update ATT&CK Heatmap Coverage
#6196 opened Aug 1, 2026 by github-actions Bot Loading…
Add rule: HackTool - Kerbrute Execution Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6195 opened Jul 31, 2026 by ashish-cybersec Loading…
Add Moodle detection rules (web server logs) - initial coverage Review Needed The PR requires review Rules
#6194 opened Jul 31, 2026 by sankettaware16 Loading…
Add requestrepo.com to DNS Query to External Service Interaction Domains Ready to Merge Rules
#6193 opened Jul 30, 2026 by darses Contributor Loading… Sigma-August-Release-26
4
feat(windows): add Remote Registry service start detection (T1003.002) Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6191 opened Jul 30, 2026 by sebafvs Loading…
Add detection for remote thread creation targeting explorer.exe Review Needed The PR requires review Rules Windows Pull request add/update windows related rules
#6189 opened Jul 29, 2026 by mugheeskhan5 Loading…
Typo in proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml Emerging-Threats Review Needed The PR requires review Rules
#6188 opened Jul 29, 2026 by epuni Loading…
new: Suspicious Bpftool State Modification Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6187 opened Jul 28, 2026 by Char0n1507 Loading…
new: SSH Authorized Keys Modification Linux Pull request add/update linux related rules Review Needed The PR requires review Rules
#6186 opened Jul 28, 2026 by Char0n1507 Loading…
Add CrashStealer macOS Detection Rules Additional Data Needed Author Input Required changes the require information from original author of the rules Emerging-Threats Review Needed The PR requires review Rules
#6184 opened Jul 28, 2026 by warlocksmurf Loading…
2
Add PamStealer macOS Detection Rules Author Input Required changes the require information from original author of the rules Emerging-Threats Review Needed The PR requires review Rules
#6183 opened Jul 28, 2026 by warlocksmurf Loading…
3
ProTip! Type g i on any issue or pull request to go back to the issue listing page.