Repository Issue Activity (beta)

#6256 Goodlog Tests: the check-baseline-win7 job scans nothing (path mismatch since evtx-baseline v0.8.4)

#6250 A typo for dig.pm maps '.ddns.1443.eu.org'. Should be '.ddns.1433.eu.org' instead

#6249 Coverage Gap: proc_creation_win_schtasks_creation — Schedule.Service COM Object Bypass

#5422 Enhancement on rule promotions

#6132 [Rule modification] Testing Usage of Uncommonly Used Port

#6056 False-Positive: net_connection_win_powershell_network_connection legitimate Azure traffic outside filter_main_msrange

#6057 Coverage gap: posh_ps_create_local_user.yml misses local account creation via ADSI/WinNT provider

#6067 Potential FP on Windows certificate store addition

#6077 [Rule Proposal] Potential Browser Cache Smuggling Payload Extraction

#6223 aws_iam_backdoor_users_keys.yml: filter still uses |contains where |fieldref is required (same bug fixed in #4836 for a sibling rule)

#6058 Fals positive Report on Simple-Help.com

#6153 Rule idea: Potential Proxy Execution Via SetupUGC

#6117 Rule idea: Linux/OpenSSH sshd DEBUG logs for SSH TCP forwarding channel activity

#6215 evtx-sigma-checker (THOR backend) incorrectly coerces hex strings to integers, breaking rule matches

#6170 Add gobygo.net to rule DNS Query to External Service Interaction Domains

#6096 Add an exception for vmmemwsl for suspicious process image path missing

#6101 Improved phishing detection

#6059 Second False Positive on Simple-Help.com

#5963 `cmd /c` with *no* argument is falsely marked as missing a space for its argument

#5590 Changelog: add guid's?

#5920 Add MCP (Model Context Protocol) security detection rules

#5786 Old fallback url referenced for sigma_schema_url in validation tests

#4197 Detect PowerShell w/o PowerShell Execution via RunDLL32 and various other methods

#5825 Sqlwriter Executed from Non-Standard Directory

#5034 Remove ending spaces from selection in posh_ps_susp_invocation_generic.yml