phantinuss retweeted
New Sigma release r2025-12-01 is available for download.
🌟35 New Rules
🛡️21 Rule updates
🔬30 Rule Fixes
Explore the full release -> github.com/SigmaHQ/sigma/rel…
The major update of this release is the introduction of windows regression testing in the CI. We now highly encourage providing evtx files with each PR, and will make mandatory over time.
As always, this release comes with a bunch of new rules and updates. Here are some highlights
- New FortiGate rules, covering the creation of users and modification of firewall objects.
- New rules covering variations of the FileFix/ClickFix technique
- New rules covering Atomic MacOS Stealer, CVE-2025-20333, CVE-2025-59287 and more
- As well as multiple FP fixes and updates.
A special thanks to the many contributors that helped shape this release, specifically
darses, Javier Bruno, @_ezlucky_ @frack113 @hullabrian InTheCyber Group, Tommaso Tosi, JasonPhang98, @Joseliyo_Jstnk @KoifSec Liran Ravich, @_montysecurity @phantinuss, RiqTam, Seth Hanford, suKTech24, @_swachchhanda_, @IntelScott, @Kostastsale, YxinMiracle
phantinuss retweeted
New Sigma release r2025-10-01 is available for download.
🌟43 New Rules
🛡️34 Rule updates
🔬27 Rule Fixes
Explore the full release -> github.com/SigmaHQ/sigma/rel…
This release introduces a bunch of new rules and updates
- A bunch of CVE detections including CVE-2025-54309, CVE-2025-53770 and CVE-2025-24054.
- SAP NetWeaver and SharePoint detections covering suspicious child processes and other activity.
- A bunch of updates to file sharing domain based rules.
- Additional Cmdlets and variants to PowerShell based rules.
And much more
A special thanks to the many contributors that helped shape this release, specifically
0xbcf, 0xPrashanthSec, egycondor, EzLucky, @frack113, Gene Kazimiarovich, JasonPhang98, josamontiel, @KoifSec, Liran Ravich, M1ra1B0T, @nosecurething, @cyb3rops, Andreas Braathen, Nisarg Suthar, norbert791, peterydzynski, @phantinuss, resp404nse, Arnim Rupp, @_swachchhanda_, Renan LAVAREC, Vladan Sekulic, YxinMiracle
phantinuss retweeted
New Sigma release r2025-07-08 is available for download.
🌟43 New Rules
🛡️34 Rule updates
🔬27 Rule Fixes
Explore the full release -> github.com/SigmaHQ/sigma/rel…
This release introduces a bunch of new rules including detections for
- Katz Stealer
- MeshAgent usage
- CVE-2025-33053 and CVE-2025-49144 (Notepad++)
- Kerberos Coercion Via DNS SPN Spoofing
An much more
We've also introduced a new Github action to automate the generation of MITRE heatmaps every month.
A special thanks to the many contributors that helped shape this release, specifically
@0xFustang @ajpc500 Ariel Otilibili, Milad Cheraghi, @d4ns4n_ david-syk, egycondor, @_ezlucky_ @frack113 Grégory Wychowaniec, GrepItAll, hashdr1ft, Josh Nickels, @JrOrOneEquals1 David Faiß @MalGamy12 Nik Stuckenbrock, norbert791 @phantinuss @_swachchhanda_ unicornofhunt, vx3r, wieso-itzi @X__Junior @lazarg_
phantinuss retweeted
New Sigma release r2025-05-21 is available for download.
🌟15 New Rules
🛡️47 Rule updates
🔬13 Rule Fixes
Explore the full release -> github.com/SigmaHQ/sigma/rel…
This release focused mainly on updates and tunings of older rules, with newer detections covering NimScan, AdFind, Kalambur Backdoor and more.
Without forgetting, a special thanks to the many contributors that helped shape this release, specifically
Milad Cheraghi, @OrOneEqualsOne, david-syk, @TheDFIRReport, Derek Armstrong, Isaac Fernandes, @frack113, Gude5, Hannes Widéen, Allan Monteiro, Jason Mull, @KoifSec, @MalGamy12, @cyb3rops, Nick Lupien, @phantinuss, RG9n, signalblur, @_swachchhanda_, Arda Büyükkaya, @X__Junior
phantinuss retweeted
curl is so versatile
curl is an alias for invoke-webrequest when called from PowerShell, a binary when called from cmd.exe, and part of a malware when called from a temporary folder
by @phantinuss & @nas_bench
phantinuss retweeted
New blog post: Connecting Sigma Rule Sets to your Environment with Processing Pipelines
medium.com/sigma-hq/connecti…
If you convert Sigma rules into queries you should read this, especially if you never heard about processing pipelines before.
phantinuss retweeted
Demystifying SIGMA Log Sources
We‘re glad to announce a new contribution called log-source guides.
The idea behind it is to provide specific guides on configuring a system’s audit policies so that the system actually creates the logs needed by the rules.
nextron-systems.com/2023/03/…
TIL: make doesn't fail if there is an error in the beginning of a pipeline (by default).
It is true for bash in general, but probably most dangerous for make.
more on stackoverflow: stackoverflow.com/questions/…
Verifying myself: I am phantinuss on Keybase.io. sm-4I1TEwDnTruUoV-0sti8BC04XhZ7ykyup / keybase.io/phantinuss/sigs/s…
phantinuss retweeted
As promised at the Mandiant Security Summit, a Golang reversing methodology with IDApython scripts to match each step of the way! Walkthrough blog–
sentinelone.com/labs/alphago…
