Corrections

A wrong registry path or an unmentioned false-positive rate costs somebody a night, so finding one is worth more to the next reader than the original piece was. Tell us, or say so in the community, corrections are credited to whoever caught them unless they would rather not be.

1. Correction6 September 2026q3-detection-rule-pack

   The pack's own page claimed eleven Sigma rules and three YARA signatures. It contained one Sigma rule and two indicators, and both of those indicators were fabricated: one was the SHA-256 of an empty string labelled 'placeholder', the other a .example domain that cannot resolve, described as C2 from a case. The attached IOC payload also rendered nothing at all to members, because the attachment block printed only the body field and an IOC payload keeps its entries elsewhere.

   Written from an intended pack rather than the shipped one, then never reconciled. It was an enterprise-tier paid asset for the whole time. The counts on the page are now generated from the payloads, the indicators are CISA-published with the advisory linked on every row, and the attachment block renders them.