Pull requests

• Add check heap flags rule

  #1203·Pratham21223 opened Oct 20, 2026·

  ·
  1

  1

• rule: add access VM device (#1188)

  #1201·ninadgowdru opened Oct 18, 2026Contributor·

  ·
  1

• Jwt no signature verification

  #1198·shishir-cyber opened Oct 3, 2026·

  ·
  1

• rule: update dynamic feature for hide graphical window

  #1194·ninadgowdru opened Aug 31, 2026Contributor·

  ·
  1

  4

• Add bash rules

  #1192·saniyafatima07 opened Aug 17, 2026Contributor·2 tasks done·

  ·

• Detect Windows Security Center COM call

  #1173·Still34 opened Jul 22, 2026Contributor·

  ·
  9

• Support for systemd-related behaviors

  #1171·Still34 opened Jul 19, 2026Contributor·

  ·
  1

  2

• feat: strengthen spoof parent PID rule with full PPID spoofing flow

  #1167·itxsamad1 opened Jun 26, 2026·1 task·

  ·
  1

  6

• Add rule for LZMA decompression

  #1152·edeca opened Apr 13, 2026Contributor·

  ·
  3

• update screenshot rule: add display regex and GDI+ routines

  #1148·cipherBT opened Mar 23, 2026·

  ·
  1

  3

• add general BITS usage detection

  #1132·akshat4703 opened Mar 9, 2026Contributor·

  ·
  19

• persistence: restrict registry-based service detection to service-specific values (fix #1100)

  #1126·reyyanxahmed opened Feb 25, 2026·

  ·
  1

• add word boundaries to regex patterns to reduce false positives

  #1125·Shaktisinhchavda opened Feb 24, 2026·

  ·
  1

  15

• reduce false positives in credential manager, credit-card parsing, an…

  #1123·akshat4703 opened Feb 23, 2026Contributor·

  ·
  4

  5

• Add new rule to detect ransomware disabling backup/recovery services

  #1122·0ameyasr opened Feb 22, 2026·

  ·
  5

• warn if latest release and rules are not compatible

  #933·mr-tz opened Sep 24, 2024Collaborator·

  ·

• Additional rules to support capa-scripts.

  dont merge
  #603·adamstorek opened Aug 4, 2022·

  ·
  19