All pull requests

Pull requests

• Link: add msi, hta and ps1 to suspicious download file types

  review-neededshared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5622·yana-ivanov opened Oct 10, 2026Contributor·

  ·
  1

• Create attachment_pdf_phish_kit.yml

  in-test-rules
  #5621·IndiaAce opened Oct 10, 2026Member·

  ·

• Update observed IOC rules - 2026-10-13

  shared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5620·github-actions[bot] opened Oct 10, 2026Bot·

  ·
  4

• Create attachment_pdf_ssa_lure.yml

  in-test-rules
  #5617·keaton-sublime opened Oct 9, 2026Member·

  ·

• Create attachment_pdf_onedrive_blue_lure.yml

  in-test-rules
  #5616·keaton-sublime opened Oct 9, 2026Member·

  ·

• Create prompt injection rules for instructions addressed to an AI

  in-test-rules
  #5592·IndiaAce opened Oct 7, 2026Member·

  ·

• Create link_self_sender_cred_theft_min_js.yml

  hunting-requiredtest-rules:excluded:link_analysis
  #5591·D-Bolton opened Oct 7, 2026Member·

  ·
  1

• Update link_credential_phishing_voicemail_language.yml

  in-test-rules
  #5581·markmsublime opened Oct 6, 2026Member·

  ·

• Create headers_ref_msgid_history_new_sender.yml

  in-test-rules
  #5557·zoomequipd opened Oct 5, 2026Member·

  ·

• Create link_fake_attachment_cred_theft.yml

  hunting-requiredtest-rules:excluded:link_analysis
  #5553·IndiaAce opened Oct 4, 2026Member·

  ·
  1

• Update credential_phishing_email_delivery_failure_impersonation.yml

  in-test-rules
  #5547·markmsublime opened Oct 2, 2026Member·

  ·

• Update impersonation_google_drive_file_share.yml

  in-test-rules
  #5542·markmsublime opened Oct 2, 2026Member·

  ·

• Update link_self_sender_org_subject_cred_theft.yml

  in-test-rules
  #5529·markmsublime opened Oct 1, 2026Member·

  ·

• Add CVE-2026-20841 rule

  in-test-rules
  #5526·randypargman opened Oct 1, 2026Member·

  ·

• Update evasion_suspicious_tld_redirecting_wikipedia.yml

  hunting-requiredtest-rules:excluded:link_analysis
  #5505·D-Bolton opened Sep 29, 2026Member·

  ·
  1

• Create spam_foundationapi_default_name_server.yml

  in-test-rules
  #5421·missingn0pe opened Sep 21, 2026Member·

  ·

• Add DLP High Volume rule

  #5398·randypargman opened Sep 17, 2026Member·

  ·
  5

  

• Create abuse_filemail_file_share_notification.yml

  in-test-rules
  #5392·IndiaAce opened Sep 17, 2026Member·

  ·

• Create impersonate_zoho_document_request.yml

  in-test-rules
  #5377·IndiaAce opened Sep 16, 2026Member·

  ·
  2

  

• Create impersonate_microsoft_document_share_pdf.yml

  in-test-rules
  #5375·IndiaAce opened Sep 16, 2026Member·

  ·

• Add beta DLP rule stubs for EU driver's licenses (DE, PL, NL, GR, FI)

  review-neededshared-samples:excluded:author_membership
  #5374·Jummyberry opened Sep 16, 2026Contributor·

  ·
  1

• Create link_disguised_as_pdf.yml

  in-test-rulesreview-needed
  #5373·keaton-sublime opened Sep 16, 2026Member·

  ·
  1

  

• Enhance description for Australia ABN detection rule

  #5369·randypargman opened Sep 15, 2026Member·

  ·
  

• Rename Fuzzy Attack Score on Graymail

  in-test-rules
  #5332·dlynch-sublime opened Sep 11, 2026Member·

  ·
  1

• Add beta DLP rule for MSIP sensitivity label outbound detection

  review-neededshared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5330·Jummyberry opened Sep 11, 2026Contributor·

  ·
  3