{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":77276660,"defaultBranch":"master","name":"sigma","ownerLogin":"SigmaHQ","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2016-12-24T09:48:49.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/79842123?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1716807194.0","currentOid":""},"activityList":{"items":[{"before":"56b77b745c0a8685ca1d02a9e523c1fdebd0d072","after":"e485963dbb979572c717df34174ea149f2d6d8d0","ref":"refs/heads/create-pull-request/reference-archiver","pushedAt":"2024-06-15T01:51:43.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore: archive new rule references and update cache file","shortMessageHtmlLink":"chore: archive new rule references and update cache file"}},{"before":"d7bd6001d1b109037a38e7e00d60d342d63cfa96","after":"0ccbda753afc3130a414d5131da378e16b5c03eb","ref":"refs/heads/master","pushedAt":"2024-06-05T21:17:16.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4873 from @ruppde - Add the string \"mikatz\" to relevant rules\n\nupdate: Antivirus Hacktool Detection - Add the string \"mikatz\" because of \"HackTool:Win32/Mikatz\"\r\nupdate: Antivirus Password Dumper Detection - Add the string \"mikatz\" because of \"HackTool:Win32/Mikatz\"\r\nupdate: Relevant Anti-Virus Signature Keywords In Application Log - Add the string \"mikatz\" because of \"HackTool:Win32/Mikatz\"\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2336635560\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4873\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4873/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4873\">#4873</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/ruppde/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/ruppde\">@ruppde</a> - Add the string \"mikatz\" to relevant rules"}},{"before":"06eaf2c1de673613a742bc6227caefb1dd19c31e","after":"d7bd6001d1b109037a38e7e00d60d342d63cfa96","ref":"refs/heads/master","pushedAt":"2024-06-05T08:22:39.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4773 from @DefenderDaniel - Add rules covering Nscurl usage\n\nnew: File Download Via Nscurl - MacOS \r\n\r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2189748267\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4773\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4773/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4773\">#4773</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/DefenderDaniel/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/DefenderDaniel\">@DefenderDaniel</a> - Add rules covering Nscurl usage"}},{"before":"09b822cfec932b39f9aa47ffcde39171959af0c3","after":"06eaf2c1de673613a742bc6227caefb1dd19c31e","ref":"refs/heads/master","pushedAt":"2024-06-03T12:23:51.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4778 from @faisalusuf - Add new rule covering suspicious usage of Qemu\n\nnew: Potentially Suspicious Usage Of Qemu\r\n\r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>\r\nCo-authored-by: threatHNTR","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2199978248\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4778\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4778/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4778\">#4778</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/faisalusuf/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/faisalusuf\">@faisalusuf</a> - Add new rule covering suspicious us…"}},{"before":"c4c836aa33cbe90af3b50bd4c3cc4358f4937004","after":"09b822cfec932b39f9aa47ffcde39171959af0c3","ref":"refs/heads/master","pushedAt":"2024-06-03T10:13:50.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4869 from @ssnkhan - Add new rules detecting `Windows Recall` feature enabling\n\nnew: Windows Recall Feature Enabled Via Reg.EXE\r\nnew: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted\r\nnew: Windows Recall Feature Enabled - Registry \r\n\r\n---------\r\n\r\nCo-authored-by: Sajid Nawaz Khan <snkhan@Sajids-MacBook-Pro.local>\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2329727629\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4869\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4869/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4869\">#4869</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/ssnkhan/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/ssnkhan\">@ssnkhan</a> - Add new rules detecting `Windows Recal…"}},{"before":"d84959e50fd57add2dff990ff70b594fbd60077d","after":"c4c836aa33cbe90af3b50bd4c3cc4358f4937004","ref":"refs/heads/master","pushedAt":"2024-06-03T08:32:29.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4870 from @himynamesdave - Fix broken link in README.md\n\nchore: fixing broken link in README.md","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2330388974\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4870\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4870/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4870\">#4870</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/himynamesdave/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/himynamesdave\">@himynamesdave</a> - Fix broken link in README.md"}},{"before":"3be29eb79ef40e5e8f8dce1249f29c20091ae930","after":"d84959e50fd57add2dff990ff70b594fbd60077d","ref":"refs/heads/master","pushedAt":"2024-06-03T08:29:22.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4867 from @nasbench - Promote older rules status from `experimental` to `test`\n\nchore: promote older rules status from experimental to test\r\n\r\nCo-authored-by: nasbench <nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2328758367\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4867\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4867/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4867\">#4867</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/nasbench/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/nasbench\">@nasbench</a> - Promote older rules status from `expe…"}},{"before":"48f2d096991a9ae89fd2710804901d1cd88d9746","after":"3be29eb79ef40e5e8f8dce1249f29c20091ae930","ref":"refs/heads/master","pushedAt":"2024-06-03T08:28:40.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4868 from @nasbench - Archive new rule references and update cache file\n\nchore: archive new rule references and update cache file\r\n\r\nCo-authored-by: nasbench <nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2328812418\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4868\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4868/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4868\">#4868</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/nasbench/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/nasbench\">@nasbench</a> - Archive new rule references and updat…"}},{"before":"b27593d1e65ad8e193f9e2c4343cac2c8edbf34d","after":"56b77b745c0a8685ca1d02a9e523c1fdebd0d072","ref":"refs/heads/create-pull-request/reference-archiver","pushedAt":"2024-06-01T01:53:07.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore: archive new rule references and update cache file","shortMessageHtmlLink":"chore: archive new rule references and update cache file"}},{"before":"5c56c7777aeeaab35061b1d81c7508a3874e2d84","after":"d18aad25b4cc85a902d13cb78164b57e74b5afcc","ref":"refs/heads/create-pull-request/rule-promotion","pushedAt":"2024-06-01T00:19:30.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"github-actions[bot]","name":null,"path":"/apps/github-actions","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/15368?s=80&v=4"},"commit":{"message":"chore: promote older rules status from `experimental` to `test`","shortMessageHtmlLink":"chore: promote older rules status from <code>experimental</code> to <code>test</code>"}},{"before":"2bf502fb9ce764cea8adcbc1b40b720226596439","after":"48f2d096991a9ae89fd2710804901d1cd88d9746","ref":"refs/heads/master","pushedAt":"2024-05-31T12:53:22.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4784 from @tomaszdyduch - Add new DarkGate activity related rule\n\nnew: DarkGate - Drop DarkGate Loader In C:\\Temp Directory\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2208037455\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4784\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4784/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4784\">#4784</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/tomaszdyduch/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/tomaszdyduch\">@tomaszdyduch</a> - Add new DarkGate activity related…"}},{"before":"9bfe3d6e6204dd04d4859c2944c270dcaaad8d2a","after":"2bf502fb9ce764cea8adcbc1b40b720226596439","ref":"refs/heads/master","pushedAt":"2024-05-31T11:53:53.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4866 from @Neo23x0 - Update network connection rules\n\nnew: Network Connection Initiated From Users\\Public Folder\r\nupdate: Outbound Network Connection Initiated By Cmstp.EXE - Exclude local IPs and ranges\r\nupdate: Network Connection Initiated To Mega.nz - Reduce level to \"low\"\r\nnew: Network Communication Initiated To Portmap.IO Domain\r\nupdate: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - Add additional file paths\r\nupdate: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - Add additional file paths\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2320358915\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4866\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4866/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4866\">#4866</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/Neo23x0/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/Neo23x0\">@Neo23x0</a> - Update network connection rules"}},{"before":"9ba9bd973ff25e6976425449a6caaf5afba26e3e","after":"2dc22ee761b049ef91de8f3f799af8d5e935ed10","ref":"refs/heads/rule-devel","pushedAt":"2024-05-31T11:46:46.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Update net_connection_win_susp_file_sharing_domains_susp_folders.yml","shortMessageHtmlLink":"Update net_connection_win_susp_file_sharing_domains_susp_folders.yml"}},{"before":"50cc5d1d4b201bf5a70e76eba174d0b0a2348ff8","after":"9ba9bd973ff25e6976425449a6caaf5afba26e3e","ref":"refs/heads/rule-devel","pushedAt":"2024-05-31T11:45:06.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"more updates","shortMessageHtmlLink":"more updates"}},{"before":"ae45e83c73fa2c7bca828e359998bcf8c97e2b92","after":"9bfe3d6e6204dd04d4859c2944c270dcaaad8d2a","ref":"refs/heads/master","pushedAt":"2024-05-31T10:52:55.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4865 from @pratinavchandra - Add new rules related to \"tmutil\" potential abuse\n\nnew: Time Machine Backup Deletion Attempt Via Tmutil - MacOS\r\nnew: Time Machine Backup Disabled Via Tmutil - MacOS\r\nnew: New File Exclusion Added To Time Machine Via Tmutil - MacOS\r\n\r\n---------\r\n\r\nCo-authored-by: frack113 <62423083+frack113@users.noreply.github.com>\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2319972630\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4865\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4865/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4865\">#4865</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/pratinavchandra/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/pratinavchandra\">@pratinavchandra</a> - Add new rules related to \"tmut…"}},{"before":"9d0fc9531ef80844c44bfbb3d34a12b1340b265d","after":"50cc5d1d4b201bf5a70e76eba174d0b0a2348ff8","ref":"refs/heads/rule-devel","pushedAt":"2024-05-31T10:51:35.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"chore: update net connection rules","shortMessageHtmlLink":"chore: update net connection rules"}},{"before":"0e45bf61360c422940df285a37ecf24b530a2a26","after":"9d0fc9531ef80844c44bfbb3d34a12b1340b265d","ref":"refs/heads/rule-devel","pushedAt":"2024-05-29T12:55:18.000Z","pushType":"push","commitsCount":2,"pusher":{"login":"Neo23x0","name":"Florian Roth","path":"/Neo23x0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/2851492?s=80&v=4"},"commit":{"message":"Merge branch 'master' into rule-devel","shortMessageHtmlLink":"Merge branch 'master' into rule-devel"}},{"before":"6a5cf5c37c5c8aba2c810b3b2bdbfbd6bc262bfb","after":"ae45e83c73fa2c7bca828e359998bcf8c97e2b92","ref":"refs/heads/master","pushedAt":"2024-05-28T13:20:18.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4864 from @cygnetix - Update `CA Policy Updated by Non Approved Actor`\n\nupdate: CA Policy Updated by Non Approved Actor - detect using a map of fields instead of a list","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2319946376\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4864\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4864/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4864\">#4864</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/cygnetix/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/cygnetix\">@cygnetix</a> - Update `CA Policy Updated by Non Appr…"}},{"before":"a72043338783f8c623c68589e1e06f6d709bdbde","after":"0e45bf61360c422940df285a37ecf24b530a2a26","ref":"refs/heads/rule-devel","pushedAt":"2024-05-28T07:38:55.000Z","pushType":"push","commitsCount":130,"pusher":{"login":"Neo23x0","name":"Florian Roth","path":"/Neo23x0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/2851492?s=80&v=4"},"commit":{"message":"Merge branch 'master' into rule-devel","shortMessageHtmlLink":"Merge branch 'master' into rule-devel"}},{"before":"dcc4291de62f51091e6f91104df6bb6697b7881a","after":"a72043338783f8c623c68589e1e06f6d709bdbde","ref":"refs/heads/rule-devel","pushedAt":"2024-05-28T07:38:43.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"Neo23x0","name":"Florian Roth","path":"/Neo23x0","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/2851492?s=80&v=4"},"commit":{"message":"add: portmap.io domain","shortMessageHtmlLink":"add: portmap.io domain"}},{"before":"9f1034507615e0f1b81ba5866d5302fc3cf474bd","after":"6a5cf5c37c5c8aba2c810b3b2bdbfbd6bc262bfb","ref":"refs/heads/master","pushedAt":"2024-05-27T16:05:09.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4785 from @pratinavchandra - add `System Information Discovery Via Sysctl - MacOS`\n\nnew: System Information Discovery Via Sysctl - MacOS \r\n\r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2209404239\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4785\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4785/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4785\">#4785</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/pratinavchandra/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/pratinavchandra\">@pratinavchandra</a> - add `System Information Discov…"}},{"before":"92fd446b7dd134cab0dc92e92d02c541ee17a031","after":"9f1034507615e0f1b81ba5866d5302fc3cf474bd","ref":"refs/heads/master","pushedAt":"2024-05-27T14:48:55.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4840 from @skaynum - Add new rules related to MySQL daemon and potential phishing attempts\n\nnew: Uncommon File Creation By Mysql Daemon Process\r\nnew: Potential Suspicious Browser Launch From Document Reader Process\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2272458821\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4840\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4840/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4840\">#4840</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/skaynum/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/skaynum\">@skaynum</a> - Add new rules related to MySQL daemon …"}},{"before":"4163fde77f70fc8e0d211b78ac400fcb8b5de1dc","after":"92fd446b7dd134cab0dc92e92d02c541ee17a031","ref":"refs/heads/master","pushedAt":"2024-05-27T12:33:46.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4859 from @vburov - Update casing of `Win32_ShadowCopy` for multiple rules\n\nchore: update casing of `Win32_ShadowCopy` for multiple rules\r\n\r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2306479871\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4859\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4859/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4859\">#4859</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/vburov/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/vburov\">@vburov</a> - Update casing of <code>Win32_ShadowCopy</code> for…"}},{"before":"1c1081d87a437dbef89468f4c1a1eab71b32a132","after":"4163fde77f70fc8e0d211b78ac400fcb8b5de1dc","ref":"refs/heads/master","pushedAt":"2024-05-27T12:27:34.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4860 from @CR-OfirTal - Fix a typo in the regex of some rules\n\nremove: Potential NT API Stub Patching\r\nfix: Dynamic .NET Compilation Via Csc.EXE - Fix typo in regex\r\nfix: Csc.EXE Execution Form Potentially Suspicious Parent - Fix typo in regex\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2307135892\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4860\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4860/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4860\">#4860</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/CR-OfirTal/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/CR-OfirTal\">@CR-OfirTal</a> - Fix a typo in the regex of some rules"}},{"before":"2fcf250978a988de7ac7c8577cf8295b18214c80","after":"1c1081d87a437dbef89468f4c1a1eab71b32a132","ref":"refs/heads/master","pushedAt":"2024-05-27T12:23:52.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4862 from @frack113 - Add `Uncommon Process Access Rights For Target Image`\n\nnew: Uncommon Process Access Rights For Target Image\r\n\r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2313578068\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4862\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4862/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4862\">#4862</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/frack113/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/frack113\">@frack113</a> - Add `Uncommon Process Access Rights F…"}},{"before":"e9cb6fc4003f8da888acde1d857b1557eae8b625","after":"2fcf250978a988de7ac7c8577cf8295b18214c80","ref":"refs/heads/master","pushedAt":"2024-05-27T11:10:06.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4863 from @deFr0ggy - Add network connection counterpart rule for cloudflare tunnels\n\nupdate: Cloudflared Tunnels Related DNS Requests - Update description and related field\r\nnew: Network Connection Initiated To Cloudflared Tunnels Domains\r\n \r\n---------\r\n\r\nCo-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2317871644\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4863\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4863/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4863\">#4863</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/deFr0ggy/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/deFr0ggy\">@deFr0ggy</a> - Add network connection counterpart ru…"}},{"before":"f334abfd29d37f9a73b219219fa3f92ac14253d7","after":"e9cb6fc4003f8da888acde1d857b1557eae8b625","ref":"refs/heads/master","pushedAt":"2024-05-27T10:53:54.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"nasbench","name":"Nasreddine Bencherchali","path":"/nasbench","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/8741929?s=80&v=4"},"commit":{"message":"Merge PR #4855 from @nasbench - Update rule ref archive cache\n\nchore: archive new rule references and update cache file\r\n\r\nCo-authored-by: nasbench <nasbench@users.noreply.github.com>","shortMessageHtmlLink":"Merge PR <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2296688985\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4855\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4855/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4855\">#4855</a> from <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/nasbench/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/nasbench\">@nasbench</a> - Update rule ref archive cache"}},{"before":"d010432114e8c6f9f36bbcbe28ba954824a02969","after":null,"ref":"refs/heads/dependabot/pip/requests-2.32.0","pushedAt":"2024-05-27T10:53:14.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"}},{"before":null,"after":"d010432114e8c6f9f36bbcbe28ba954824a02969","ref":"refs/heads/dependabot/pip/requests-2.32.0","pushedAt":"2024-05-21T05:31:10.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"dependabot[bot]","name":null,"path":"/apps/dependabot","primaryAvatarUrl":"https://avatars.githubusercontent.com/in/29110?s=80&v=4"},"commit":{"message":"---\nupdated-dependencies:\n- dependency-name: requests\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>","shortMessageHtmlLink":"---"}},{"before":"ed789f54cee7ad915b7b8b4b0a3cb938e23ae36d","after":"f334abfd29d37f9a73b219219fa3f92ac14253d7","ref":"refs/heads/master","pushedAt":"2024-05-15T20:21:50.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"frack113","name":null,"path":"/frack113","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/62423083?s=80&v=4"},"commit":{"message":"Remove smart quotes from file_event_win_iphlpapi_dll_sideloading.yml (#4856)","shortMessageHtmlLink":"Remove smart quotes from file_event_win_iphlpapi_dll_sideloading.yml (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2296693297\" data-permission-text=\"Title is private\" data-url=\"https://github.com/SigmaHQ/sigma/issues/4856\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/SigmaHQ/sigma/pull/4856/hovercard\" href=\"https://github.com/SigmaHQ/sigma/pull/4856\">#…</a>"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAEZfU8PgA","startCursor":null,"endCursor":null}},"title":"Activity · SigmaHQ/sigma"}