sigma-ai

AgentShield Sigma Rules What is This Repository? This repository contains detection rules that help identify when an AI agent is being attacked or manipulated. Think of it as a library of "threat signatures" -- each rule describes a pattern that, when matched against an agent's log data, signals...

cve-2023-23397-purple-team

CVE-2023-23397 — Purple Team: Exploit + Detection Two halves of one project against the same Outlook NTLM-leak vulnerability CVE-2023-23397: Red team done: phishing delivery + exploitation of CVE-2023-23397 against a Windows 10 victim VM, full writeup in FINALPROJECTREPORT.pdf, walkthrough in...

pySigma-backend-opensearch

pySigma OpenSearch Backend This is the OpenSearch backend for pySigma. It provides the package sigma.backends.opensearch with two backend classes: OpensearchLuceneBackend - Converts Sigma rules to Lucene query syntax OpenSearchPPLBackend - Converts Sigma rules to PPL Piped Processing Language...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

DFIRHub

DFIRHub DFIRHub is a reference for Windows forensic artifacts. It lists the KAPE targets from Eric Zimmerman's KapeFiles repository, shows what each one collects, and gives you the command to run. It also converts Sigma rules into queries for your SIEM. What it does You can search artifacts by...

Cisa-KEV-Threat-Intel-Orchestrator

CISA KEV Threat Intel Orchestrator Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities KEV catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow:...

Sigma-Rule-for-CVE-2022-30190

This repository does not have a README...

c2detect

c2detect Fingerprint the C2 server behind the beacon. Point it at network telemetry and it names the command-and-control framework — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel, and 11+ more — with a confidence score and the exact indicators that matched. -success Blue-team / defensive:...

BloodSOCer

BloodSOCer BloodSOCer is a Python automation tool that aggregates threat intelligence data from multiple sources Mitre ATT&CK, Sigma rules, Atomic Red Team and produces JSON files to ingest in BloodHound in OpenGraph format. BloodSOCer can also upload the files to BloodHound and set the icons for...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

Sigma-Rule-for-CVE-2021-40438-exploitation-attempt

This repository does not have a README...

Sigma-Rule-for-CVE-2021-41773-and-CVE-2021-42013-exploitation-attempt

This repository does not have a README...

CVE-2026-98677

A flaw was found in the Linux kernel's Analog-to-Digital Converter ADC Sigma-Delta driver. Due to an improper resource cleanup sequence when a device is unbound or disconnected, the internal sample buffer is freed before interrupt handling is disabled. A local attacker with administrative...

CVE-2026-111936

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

CVE-2026-111936 Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

EUVD-2026-104315

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

CVE-2026-111936 Sigma File Manager through 2.2.0 SSRF via Extension Download Commands

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

CVE-2026-111936

Sigma File Manager versions through 2.2.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The root cause is that the validate_remote_url() function in security.rs fails to validate resolved IP addresses during extension download commands. An attacker can exploit this by usin...

CVE-2026-111936: Server-Side Request Forgery (SSRF)

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

PT-2026-116896

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad sigma delta: fix use-after-free on unbind ad sd buffer postenable allocates sigma delta-samples buf with devm krealloc at runtime, so its devres entry sits after all probe-time entries of the driver. devm resources a...