Samirbous

[New] Windows Sandbox with Sensitive Configuration

2

https://blog-en.itochuci.co.jp/entry/2025/03/12/140000

[New] RemoteMonologue Attack rules

5

https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions#1 https://github.com/xforcered/RemoteMonologue 

[New] Potential SAP NetWeaver Exploitation rules

9

https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

[New] Microsoft Entra ID Protection Alert and Device Registration

3

https://github.com/elastic/ia-trade-team/issues/590#issuecomment-2839484140

[New] Multiple Cloud Secrets Accessed by Source Address

10

This rule detects authenticated sessions accessing secret stores across multiple cloud providers from the same source address within a short period of time. Adversaries with access to compromised credentials or...

[New/Tuning] NPM Shai-Hulud coverage

18

https://socket.dev/blog/shai-hulud-strikes-again-v2