New

Detections Digest #20260914

This week’s update highlights the most significant changes to detection rules from 7 of the 50+ monitored GitHub repositories. Between Sep 7 and Sep 14, 2026, contributors added 16 new rules and updated 22 existing ones.

Stay informed about the latest changes in detection engineering to improve your threat detection coverage and operational efficiency.

Key Takeaways

LOLRMM and Sublime Security updated detections for abused remote monitoring and management (RMM) software. LOLRMM added Sigma coverage tracking RMMmax file drops, process execution, service persistence, and network traffic, while Sublime removed vendor domain restrictions to detect ConnectWise ScreenConnect guest-access parameters across self-hosted infrastructure. (magicsword-io/LOLRMM, sublime-security/sublime-rules)
Email security updates target visual and structural evasion methods across multiple file formats and links. Sublime added rules for passcode-protected PDFs, BEC Excel documents with legal disclaimers, and fake Cloudflare verification pages, while jkerai1 corrected an extension parsing defect in Microsoft Defender queries by formatting file extensions with leading periods. (sublime-security/sublime-rules, jkerai1/KQL-Queries)
Identity monitoring and prompt inspection rules received targeted engineering fixes. ep3p updated Entra ID AD FS queries to correlate session IDs against trusted named locations rather than legacy proxy IPs, while Agent-Threat-Rules replaced unbounded regular expressions with complement automata to prevent ReDoS engine stalls during many-shot prompt injection analysis. (ep3p/Sentinel_KQL, Agent-Threat-Rule/agent-threat-rules)

Automate one recurring security report

BlackStork’s Report Implementation Program turns one reporting workflow into an automated pipeline - from security data and analyst input to a consistent PDF, HTML, or Markdown deliverable.

Bring a report your team repeatedly assembles from SIEMs, APIs, tickets, or spreadsheets. We’ll implement and validate the workflow with you.

Submit a reporting workflow

Corporate repositories (5)
- splunk/security_content (+1, ✎1)
- sublime-security/sublime-rules (+11, ✎13)
- magicsword-io/LOLDrivers (✎4)
- magicsword-io/LOLRMM (+4, ✎1)
- Agent-Threat-Rule/agent-threat-rules (✎1)
Personal repositories (2)
- ep3p/Sentinel_KQL (✎1)
- jkerai1/KQL-Queries (✎1)
Feedback
Disclaimer
Powered by

Corporate repositories (5)

splunk/security_content (+1, ✎1)

+ New rules

New detection covers ClickFix attack techniques where users are manipulated into copying malicious commands from a web browser and executing them through the Windows Run dialog. The logic correlates RunMRU registry activity (Sysmon Event ID 13) with browser-originated clipboard events (Sysmon Event ID 24) by comparing SHA256 hashes of the command payloads. (Windows Content Copied from Browser was Executed)

✎ Modified rules

Updated pattern matching for PowerShell Script Block Logging (EventCode 4104) to refine detection of offensive frameworks, evasion techniques, and activity associated with CVE-2025-59287. String match patterns were corrected in the initial filter and eval statements by fixing wildcard syntax for credential dumping keywords and standardizing base64 decoding indicators. (PowerShell 4104 Hunting)

sublime-security/sublime-rules (+11, ✎13)

+ New rules

New Sublime Security rules expand detection of malicious PDF delivery techniques. They target credential phishing by matching known malicious embedded object hashes, detecting dub.sh shortened URLs inside PDF attachments, and identifying evasion lures where HTML body cues highlight passwords or codes to open protected PDFs. (Attachment: PDF with bolded passcode, Attachment: PDF with dub.sh shortened link, Attachment: PDF object hash cred phish)

Two new rules identify malicious Excel spreadsheets deployed in business email compromise and phishing workflows. Detection focuses on .xls files containing legal confidentiality disclaimer text designed to mimic legitimate corporate threads, as well as EXIF metadata containing hyperlinks to suspicious TLDs, free file hosts, or URL shorteners paired with BEC language models. (Attachment: XLS with legal confidentiality disclaimer, Attachment: Excel file with hyperlinks to suspicious domains)

Detection capabilities now flag evasive phishing campaigns that obscure recipient lists and serve payloads via Cloudflare-backed infrastructure. These rules inspect inbound messages directed to empty or undisclosed recipients with low link counts, focusing on destination landing pages on suspicious TLDs that execute client.js or load the Cloudflare Insights beacon script. (Link: Suspicious TLD hosting client.js with cf beacon, Link: Fake Cloudflare verification landing page)

Added coverage for phishing and credential harvesting that exploit legitimate platforms and hosting infrastructure. The rules flag self-service platform URLs that redirect to newly registered domains with suspicious TLDs, as well as explicit HTML impersonation of Webmail HostingServer services via hardcoded support addresses and specific header tags. (Link: Fake webmail hosting, Service abuse: Self-service platform redirecting to newly registered suspicious domain)

New rules target socially engineered financial fraud and calendar abuse using natural language understanding (NLU). They catch advance-fee and BEC themes originating from domains registered within 90 days, alongside ICS calendar invite lures sent from free webmail services that fake file-sharing notifications using Outlook groups or open redirectors. (BEC: Wealth management lure from newly registered domain, Attachment: ICS calendar invite with photo/file share lure)

✎ Modified rules

Detection rules targeting brand and government agency impersonation were updated to widen lure coverage. Survey-themed phishing detection was expanded to cover brands such as Sam’s Club, Kobalt, Lowe’s, and Blackstone Griddle, while USPS detection incorporates survey reward patterns and free file hosts. Additional logic matches federal agency pretexts targeting SAM.gov and the Small Business Administration via CAGE codes and renewal status keywords, and Netflix credential theft is identified using NLU classification when brand names initiate the body text. (Brand impersonation: Netflix, Brand impersonation: USPS, Brand impersonation: Survey request with credential theft indicators, Impersonation: SAM/SBA federal registration)

Detection rules for document and file-sharing lures were modified to counter visual and HTML obfuscation techniques. An XPath check now identifies Google Drive impersonation where text characters are fragmented across styled span elements to evade string matching. OCR text evaluation for Adobe Acrobat and e-signature credential phishing now uses regular expressions with flexible whitespace to handle segmentation variances, while detection for fake PDF attachments incorporates EXIF metadata and XPath checks to identify embedded icons mimicking documents. (Link: Multistage landing - Abused Adobe Acrobat hosted PDF, Brand impersonation: Google Drive fake file share, Self-sent fake PDF attachment with misleading link)

Detections targeting social engineering pretexts across media lures, calendar events, and conversational threads were broadened. Calendar attachment inspection now catches additional voicemail pretexts such as pending, unheard, missed, and confidential audio lures. Rules for fake video links from newly registered domains were expanded by dropping local-part sender restrictions, and photo-sharing pretext detections now match phrases like ‘ring a bell’ without requiring display names in the subject line. (Spam: Fake photo share, Link: Fake video link from newly registered domain, Attachment: ICS voicemail lure with suspicious link)

Detection coverage for unauthorized ConnectWise ScreenConnect deployment was broadened to identify self-hosted and non-standard infrastructure. By removing the domain restriction for ‘screenconnect.com’, the rule now inspects executable downloads (.msi and .exe) across any domain for specific guest access query parameters indicative of unattended access sessions. (Link: ScreenConnect remote access tool delivery with unattended guest access)

Network telemetry inspection was updated by refreshing the Spamhaus ASN-DROP IP list. Detection updates add newly malicious autonomous system network prefixes and remove obsolete entries such as prefixes under AS152194, maintaining precise identification of inbound email routed through cybercriminal-controlled infrastructure. (Spamhaus: Mail transiting an ASN-DROP listed network)

magicsword-io/LOLDrivers (✎4)

✎ Modified rules

Coverage for Bring Your Own Vulnerable Driver (BYOVD) attacks and malicious kernel driver loading has been expanded across Windows driver load telemetry. Hash-based detection rules monitoring MD5, SHA1, SHA256, and IMPHASH values were synchronized with the latest LOLDrivers dataset to detect known malicious and vulnerable drivers regardless of HVCI state. Additionally, filename-based detection rules monitoring the ImageLoaded path were updated with newly cataloged driver names to identify kernel-level tampering and privilege escalation attempts. (Malicious Driver Load, Vulnerable Driver Load Despite HVCI, Vulnerable Driver Load By Name, Malicious Driver Load By Name)

magicsword-io/LOLRMM (+4, ✎1)

+ New rules

New Sigma rules provide coverage for malicious or unauthorized use of the RMMmax Remote Monitoring and Management tool across Windows telemetry sources. The detections identify process execution involving RMMmaxAgentSetup.exe and RMMmaxAgentService.exe, registry modifications targeting service definitions and Run key persistence, file creation artifacts, and outbound network traffic to RMMmax infrastructure for command and control. (Potential RMMmax RMM Tool Network Activity, Potential RMMmax RMM Tool Registry Activity, Potential RMMmax RMM Tool File Activity, Potential RMMmax RMM Tool Process Activity)

✎ Modified rules

Detection for DNS queries targeting Remote Monitoring and Management (RMM) infrastructure has been updated with refreshed domain indicators. The rule matches requested domain names in DNS telemetry against known RMM service hostnames to identify potential unauthorized remote access or command-and-control channels while supporting exclusions for authorized tools. (DNS Queries to Known RMM Domains)

Agent-Threat-Rule/agent-threat-rules (✎1)

✎ Modified rules

Detection for many-shot prompt injection attacks has been optimized for performance by replacing unconstrained regex matches with complement automata patterns that exclude colons and newlines. The rule targets extended multi-turn Q&A chains designed to condition LLMs prior to requesting sensitive credentials or overrides, eliminating catastrophic backtracking and ReDoS vulnerabilities while preserving RE2 engine compatibility. (Many-Shot Repetition Override via Extended Q&A Chain)

Personal repositories (2)

ep3p/Sentinel_KQL (✎1)

✎ Modified rules

Detection for unexpected AD FS authentication flows in Entra ID sign-in logs was updated to improve fidelity against federated token abuse and authentication bypasses. The logic cross-references session and correlation IDs across interactive and non-interactive sign-ins, replacing legacy proxy IP filters with trusted named locations from the Activity-ExpectedSignificantActivity watchlist and parsing NetworkLocationDetails to filter expected traffic. (Multiple-Unexpected AD FS authentication flow)

jkerai1/KQL-Queries (✎1)

✎ Modified rules

Updated detection for high-risk email attachments in Microsoft 365 Defender corrects extension matching logic. The query now prepends a leading period to entries from the external extension list using strcat, properly aligning them with the FileExtension field format in EmailAttachmentInfo to accurately identify suspicious inbound attachments. (Unexpected Attachment Types in Emails)

Feedback

Your input helps us improve! If you spot any issues, mistakes, or omissions in this digest issue, or have any other suggestions, we’d love to hear from you. Contact us at team@rulecheck.io - we value your feedback and are committed to improving the content we produce.

Disclaimer

The summaries in this report are generated by LLM based on the provided system and user prompts. While every effort is made to consolidate accurate and relevant insights, the model may occasionally misinterpret, misrepresent, or hallucinate information. Readers are strongly advised to verify all key points by consulting the original sources linked for complete context and accuracy.