6 Pull requests merged by 2 people

• fix(filter): Allow interpolation for fields with underscore characters

  #480 merged Apr 2, 2025

• fix(symbolizer): Lookup live modules

  #478 merged Mar 31, 2025

• fix(rules): Exclusion for OneDrive to tune false positives in Potential process hollowing rule

  #450 merged Mar 31, 2025

• feat(rules): New Suspicious object symbolic link creation rule

  #463 merged Mar 31, 2025

• fix(rule-engine): Check process state before evaluation

  #477 merged Mar 29, 2025

• fix(rule-engine): Add expire sequence condition for CreateThread event

  #465 merged Mar 28, 2025

6 Pull requests opened by 2 people

• chore(deps): bump github.com/spf13/viper from 1.6.2 to 1.20.1

  #474 opened Mar 27, 2025

• feat(rules): New `LSASS handle leak via Seclogon` rule

  #475 opened Mar 27, 2025

• feat(rules): New `LSASS access from unsigned executable` rule

  #476 opened Mar 27, 2025

• feat(rules): New `Suspicious Netsh Helper DLL execution` rule

  #479 opened Apr 1, 2025

• feat(rules): New `Potential shellcode execution via ETW logger thread` rule

  #481 opened Apr 2, 2025

• fix(callstack): Rework final user frame heuristics

  #482 opened Apr 2, 2025