All pull requests

Pull requests

• build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in the actions group

  dco-signoff: yesdependenciesgithub_actionssize/XS
  #391·dependabot[bot] opened Oct 13, 2026Bot·

  ·
  1

• new(rules): detect Python startup hook (.pth) modification (T1546.018)

  area/maturity-incubatingarea/rulesdco-signoff: yeskind/featuresize/M
  #390·lydiagraslie opened Sep 28, 2026·

  ·
  5

• chore(.github): add version 0.45.0 to the testing matrix

  approvedarea/automationdco-signoff: yeskind/featuresize/XS
  #388·leogr opened Sep 21, 2026Member·

  ·
  2

• fix(falco_rules): handle "sh -c --" and tighten postgres_running_cnpg

  area/maturity-stablearea/rulesdco-signoff: yeskind/bugsize/S
  #387·scribblrsam opened Sep 18, 2026·

  ·
  1

  3

• Add sandbox rule for container escape via kernel usermode helper overwrite

  dco-signoff: yessize/S
  #381·ChrisJr404 opened Aug 26, 2026·

  ·
  2

• new(rules): detect security tool impairment in containers (T1562.001)

  dco-signoff: yessize/M
  #367·JayKnowSo opened May 15, 2026·

  ·
  11

• docs: add STYLE_GUIDE.md for rules doc comments (closes #150)

  dco-signoff: yessize/XL
  #364·koiakoia opened Apr 29, 2026·

  ·
  1

  18

  

• feat(rules): detect container shell spawn for MITRE T1059

  dco-signoff: yessize/M
  #363·JayKnowSo opened Apr 20, 2026·

  ·
  14