Skip to content
View vl43den's full-sized avatar
:copilot:
things are going real fast take care of backups
:copilot:
things are going real fast take care of backups
5 followers · 9 following

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx2Achievement: QuickdrawAchievement: YOLO

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx2Achievement: QuickdrawAchievement: YOLO

Highlights

  • Pro

Block or report vl43den

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
vl43den/README.md

Hi!

Detection engineering and security research: Sigma rules, Atomic Red Team tests, Sentinel hunting queries + the pySigma tooling around them.

Contributions

Highlights below. Full list of merged PRs: vl43den.github.io/contributions

SigmaHQ/sigma

  • Suspicious Kerberos Ticket Request (ScriptBlock + CLI): removed .GetRequest() requirement (#6296)
  • UFW Disable Attempt: fixed broken ufw-init detection and broadened UFW disable coverage (#5978)
  • fix: Suspicious Kerberos Ticket Request (Scriptblock + CLI) - remove .GetRequest() requirement (#6296)

pySigma and backends

  • SigmaHQ/pySigma: stopped re-parsing SigmaString entries in values (#433)
  • logpoint/pySigma-backend-logpoint: added a Linux/auditd pipeline (#33) and upgraded to pySigma v1.0.0 (#28)
  • SigmaHQ/pySigma-backend-elasticsearch: fixed SigmaNull conversion in the ECS Windows pipeline (#174)

redcanaryco/atomic-red-team

  • T1546.005: added Trap DEBUG atomic test (#3338)
  • T1027/T1027.013: added character array and password-protected ZIP obfuscation tests (#3279)
  • T1496 (Resource Hijacking): added Windows CPU load simulation (#3275)

Azure/Azure-Sentinel

  • KqlValidations schema: added Sentinel IdentityInfo columns (#15418)
  • hunt_LOLBins.yaml: repaired entity mappings (#15144)

NVIDIA/NemoClaw

  • Fixed file descriptor leak in acquireOnboardLock (#1052)
  • Preflight: auto-create swap on low-memory VMs to prevent OOM during sandbox build (#419)

Pinned Loading

  1. sigma sigma Public

    Forked from SigmaHQ/sigma

    Main Sigma Rule Repository

    Python 4

  2. atomic-red-team atomic-red-team Public

    Forked from redcanaryco/atomic-red-team

    Small and highly portable detection tests based on MITRE's ATT&CK.

    C 1

  3. pySigma-backend-logpoint pySigma-backend-logpoint Public

    Forked from logpoint/pySigma-backend-logpoint

    Logpoint backend for pySigma that enables seamless conversion of Sigma rules into Logpoint queries.

    Python

  4. azure-sigma-lab azure-sigma-lab Public

    Bicep 1