Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

crowdstrike-falcon-queries

crowdstrike-falcon-queries Una colección del Lenguaje de Procesamiento de Búsquedas SPL de Splunk para la caza de amenazas con CrowdStrike Falcon Desarrollado y mantenido por el equipo Intelligent Response de i-secure co., Ltd. crowdstrike-falcon-queries Ejecución de ejecutables renombrados Lista...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...