All pull requests

Pull requests

• Update attachment_romance_scam_image_lure.yml

  in-test-rules
  #5474·IndiaAce opened Sep 27, 2026Member·

  ·

• Create attachment_filename_rcpt_localpart_pattern.yml

  in-test-rulesreview-needed
  #5473·zoomequipd opened Sep 27, 2026Member·

  ·

• Update observed IOC rules - 2026-09-27

  shared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5472·github-actions[bot] opened Sep 26, 2026Bot·

  ·
  2

• Create link_new_domain_reference_lure.yml

  in-test-rules
  #5469·D-Bolton opened Sep 25, 2026Member·

  ·

• Update attachment_callback_phish_via_text_file.yml

  in-test-rules
  #5464·D-Bolton opened Sep 24, 2026Member·

  ·

• Update suspicious_request_for_quote_or_purchase.yml

  in-test-rules
  #5463·JFarina5 opened Sep 24, 2026Member·

  ·

• Update link_credential_phishing_secure_message.yml

  hunting-requiredreview-neededtest-rules:excluded:link_analysis
  #5462·JFarina5 opened Sep 24, 2026Member·

  ·
  2

  

• Rename DLP discovery rules directory

  #5461·rw-access opened Sep 24, 2026Member·

  ·

• Create brand_impersonation_google_authenticator.yml

  in-test-rules
  #5456·markmsublime opened Sep 24, 2026Member·

  ·

• Create brand_impersonation_siteground.yml

  in-test-rules
  #5455·markmsublime opened Sep 24, 2026Member·

  ·

• Add ASR-style Feed Rule for Purview sensitivity labels

  review-neededshared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5446·Jummyberry opened Sep 23, 2026Contributor·

  ·
  4

  

• Create attachment_pdf_partial_obj_hash_RFP_template.yml

  in-test-rules
  #5439·keaton-sublime opened Sep 22, 2026Member·

  ·

• Create attachment_mobileconfig_uuid_hash.yml

  in-test-rules
  #5438·zoomequipd opened Sep 22, 2026Member·

  ·
  1

• Create attachment_mobileconfig_malformed.yml

  in-test-rules
  #5437·zoomequipd opened Sep 22, 2026Member·

  ·
  1

• Create attachment_mobileconfig_unrelated_email.yml

  in-test-rules
  #5436·zoomequipd opened Sep 22, 2026Member·

  ·
  1

• GA rename: remove beta. prefix from all DLP discovery rules

  review-neededshared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5430·Jummyberry opened Sep 22, 2026Contributor·

  ·
  2

• Add DLP rules for Spain and Sweden driver's licenses

  review-neededshared-samples:excluded:author_membershiptest-rules:excluded:author_membership
  #5428·Jummyberry opened Sep 22, 2026Contributor·

  ·
  2

• Create spam_foundationapi_default_name_server.yml

  in-test-rules
  #5421·missingn0pe opened Sep 21, 2026Member·

  ·

• Create attachment_pdf_blurred_lure.yml

  in-test-rules
  #5408·keaton-sublime opened Sep 21, 2026Member·

  ·

• Create attachment_pdf_msft_signature_yara.yml

  in-test-rules
  #5407·keaton-sublime opened Sep 21, 2026Member·

  ·

• Create link_monday_hosted_suspicious_content.yml

  in-test-rulesreview-needed
  #5406·missingn0pe opened Sep 19, 2026Member·

  ·
  3

  

• Add DLP High Volume rule

  #5398·randypargman opened Sep 17, 2026Member·

  ·
  5

  

• Create attachment_pdf_w9_signature_reuse.yml

  in-test-rules
  #5393·keaton-sublime opened Sep 17, 2026Member·

  ·

• Create abuse_filemail_file_share_notification.yml

  in-test-rules
  #5392·IndiaAce opened Sep 17, 2026Member·

  ·

• Create attachment_meetergo_booking_link.yml

  in-test-rulesreview-needed
  #5386·missingn0pe opened Sep 16, 2026Member·

  ·
  3