Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
One rule, and the quarter's published indicators collected behind it. The rule
came out of casework; the indicators did not, and the section below says where
each one did come from.
What is in it
Counted rather than described, because this pack once said otherwise:
