Forensic Analysis

• Brian Carrier at Cyber Triage
  SOC Investigations at Machine Speed: Decision Making

• Oleg Afonin at Elcomsoft
  iOS Acquisition Troubleshooting: Where The Logs Are?

• Hal Pomeranz at ‘Righteous IT’
  Dealing With Binary Data In The Linux Shell

• Kevin Pagano at Hexordia
  Unlocking iOS Sysdiagnose and Unified Logs: Hexordia Contributes New Parsers to iLEAPP

• Invictus Incident Response
  Can You Investigate Claude Misuse? | Invictus Incident Response

• Alexis Brignoni at LEAPPs Blog
  Reviewing, Tagging, and Exporting LEAPP Cases with LAVA

• Chad Gish at Magnet Forensics
  That One Artifact: The video that mapped a murder

• Amber Schroader at Paraben Corporation
  Avoiding AI Slop: A Digital Investigator’s Checklist for Quality Tools

• John Patzakis at X1 Discovery
  Microsoft Purview eDiscovery Problems Are Structural—and Growing

Threat hunting/threat intelligence

• Eliad Kimhy, Santiago Pontiroli, and Subhajeet Singha at Acronis
  BOSSAI: Inside the AI attack mesh that targeted Taiwan’s emergency services

• Joe Leon at Aikido
  Deleting a leaked key from your repo doesn’t protect you

• Aditya K Sood and Bikash Dash at Aryaka
  Peeling Back the Layers of PowerShell Loader: Tracing a Multi-Stage Windows Payload Chain

• Christine Barry at Barracuda
  Malware Brief: Trusted software, AI, and post-quantum ransomware

• BlackFog

  • The State of Ransomware: October 2026
  • How TeamPCP Turned Developer Tools Into a Route for Data Theft

• Siddhant Mishra at Bloo
  SharpShooter v2.0: Deep-Dive Detection Guide

• Bob Rudis
  IP-Lookup, Proxy-Judge, and Proxy-Pool Destinations to Hunt For in Your Logs

• Brian Krebs at ‘Krebs on Security’

  • Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
  • Want to Rent an Internet Address at the White House?

• Bridewell

  • Intelligence Insights: October 2026
  • THE STATE OF RANSOMWARE Q3 2026

• BushidoToken
  UK Cybercrime Journal: Beacon CRM Breach Impacts Over 1,500 Charities

• Censys

  • European Refrigeration Controller Exposure: A Second Attack Wave
  • ARTEX: Agentic Asbestos

• CERT-AGID

  • Backdoor nei modelli open-weight
  • Sintesi riepilogativa delle campagne malevole nella settimana del 31 ottobre – 6 novembre

• Chainalysis
  DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance

• Check Point

  • 2nd November – Threat Intelligence Report
  • Storm Ransomware Is Scaling Fast and Selling an AI Powered Image
  • Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles
  • HYFLOCK Ransomware Evolves with New Builds and Encryption Weaknesses
  • ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
  • Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns
  • Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks

• Chris Brumm
  A second look at AuthCodeFix (ConsentFix)

• Lacie Blythe and Jaime Duque at CrowdStrike
  How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders

• Cyderes
  UltraFinder Ran Document Macros During Content Search

• Cyfirma

  • Australia & New Zealand Government Sector Cyber Threat Landscape (2025–2026)
  • RANSOM WATCH : TRACKING RANSOMWARE, October 2026
  • THREAT HORIZON : After Black October. Where Supply Chain Risk and AI-Enabled Attacks Are Heading
  • Weekly Intelligence Report – 06 Nov 2026

• Cyllex
  Introducing Argus: Threat Intelligence That Cites Its Sources

• DCSO CyTec
  Cyber Conflict Briefing Q3 2026

• Detect FYI

  • Implementing Detection as Code as a multi-platform MSSP
  • KQL of the Week | Hunting for suspicious client secret authentication attempts

• Disconinja

  • Tracking Information-Stealing Scripts Embedded in a Video Site
  • アダルト動画サイトに組み込まれた情報窃取スクリプト群を追う
  • Weekly Threat Infrastructure Investigation(Week45)

• Dr. Massimiliano Dal Cero at DRIFT Linux
  Dusk Network Botnet: React2Shell to an Ethereum C2

• Dr. Neal Krawetz at ‘The Hacker Factor Blog’
  AI-Enabled Scams

• Dr. Web
  Insolence beyond belief. Threat actors target information security developers on GitHub

• Michael Rothschild at Dragos
  Reverse Engineer Anything: What AI-Driven REA Means for Critical Infrastructure

• Kfir Fleischer at Dream
  PHP2Shell: Helping Defend the Systems That Are Hardest to Patch

• Elastic Security Labs

  • When trust becomes the payload: Inside the threats, etc quarterly report
  • Monitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflows

• Eric J. Taylor at Barricade Cyber Solutions
  WHisKEY and CloudDesk: Inside a Fake RMM Platform Handing Attackers SYSTEM Access

• Nadine Abdulkarim at Esentire
  PHP2Shell: Two Critical PHP Flaws Explained

• FalconFeeds

  • Stolen Credentials on the Dark Web: A Step-by-Step Fix for Compromised Logins and Session Cookies
  • Ransomware Protection in 2026: The Shift From Recovery Plans to Early Detection
  • Data Leaks vs. Data Breaches: Key Differences, Cybersecurity Risks, and a Threat Intelligence Breakdown
  • Binance Hack 2026: Inside the $6.3 Billion Crypto Heist, Historical Security Breaches, and the Future of Exchange Security
  • PHP Vulnerabilities in 2026: From Historical Exploits to Emerging Threats and Real-World Business Impact

• Assaf Morag at Flare
  Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure

• Flashpoint
  Inside BTMob: How a Source Code Leak Expanded Access to a Mobile RAT

• Florian Roth
  The Tipping Point: When Cyber Attacks Stop Being Limited by People

• Daniel Beneš at Gen
  BillBait: When SMS autofill comes with a subscription

• Google Cloud Threat Intelligence

  • ARTEX and Friends: Enter Agentic Offensive Frameworks
  • The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
  • Shutting the Door on the XCPE Botnet

• Group-IB

  • From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META
  • Infostealers In Banking Fraud: How Stolen Credentials Lead To Silent Intrusions

• Halkyn Security

  • The Ransomware Payment Decision: What Leaders Weigh
  • Using LLMs for DFIR: A Realistic Assessment
  • Privileged Insider Investigation: The Admin Case
  • ELF File Analysis During an Investigation
  • AWS CloudTrail Investigation: A Responder’s Guide
  • LLM Data Exfiltration Through a Model

• Stephan Meza at Hunt & Hackett
  Investigating BEC at two speeds

• Hunt IO

  • ARTEX Exposed: Mapping the Infrastructure Behind the South Korean Bank Breaches
  • Inside the PHP2Shell Arsenal: A Complete Dissection of a PAN-OS Mass-Exploitation Open Directory

• Infrawatch
  10.3K Exposed Fridges: Shared Suppliers and Residential Proxies

• Niklas Kerner at Insinuator
  Token Theft in Microsoft Entra ID (Part 4 of 4): OAuth 2.0 Standard Gaps

• Intel 471

  • Why is Italy a top target for cybercrime?
  • Hand AI the Legwork, You Keep the Judgment

• Ruben Madar at Intrinsec
  Malicious browser extensions ecosystem overview

• Yuval Moravchick and Natan Nehorai at JFrog
  bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

• Jonathan Cran at Mallory

  • Binance Hack in Context: The Recent History of Developer Targeting by DPRK
  • What 859 Public PHP2Shell Exploit Repos Actually Contain

• Konrads Klints
  The malware is gone. Where did it call back?

• Adam Goss at Kraven Security
  CU-GIR: How to Use the Cyber Underground General Intelligence Requirements to Get Ahead of Cybercrime

• Layer3 Intel
  Residential Proxies Detected on White House Network

• Malbear Labs
  Operation Snowball: Inside an Autonomous AI Intrusion Campaign

• Bastian Eymery and Neal Swaelens at Manifold
  Introducing the Agent Incident Ledger: AI agents gone wrong

• Microsoft Security

  • What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
  • Fake-download campaign uses trojanized installers to deliver monetization payloads
  • Threat actors use agentic AI tooling to find and abuse exposed secrets
  • Email threat landscape: Q3 2026 trends and insights
  • ARTEX abuse expands as cybercriminals target financial sector

• MII Cyber Security

  • Kunai Analysis #1 — Analyzing Linux Activity with Kunai
  • Hunting on the Wire : A Practical Guide to Network Threat Hunting — Part 3

• Ray Fernandez at Moonlock
  Fake Homebrew installer linked to record-breaking $6.3 billion Binance heist

• Natto Thoughts
  The ZRON Leak, Part 3: What Does It Take for a Little Fish to Survive Among Sharks?

• Ganesh Sunkari at Netenrich
  Payment API Abuse: How AI Turns Leaked Keys Into Payouts

• Thomas Elling at NetSPI
  Leveraging Microsoft Graph API Change Notifications for Data Exfiltration

• Felix Hartmond at NVISO Labs
  Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 2 – Execution

• Ohad Zaidenberg
  Patch by Evidence, Not by Severity

• Okta

  • Credential stuffing attacks poised to accelerate with AI | Threat Intelligence
  • Agentic attack tools accelerate reconnaissance of identity flows | Threat Intelligence

• Oleg Skulkin at ‘Know Your Adversary’
  421. Threat Actors Abuse Power BI to Bypass Defenses

• OpenSourceMalware
  Why Conventional Reputation Feeds Miss Software Supply Chain Attacks

• Ashraf Gamal at OSINT Team
  Automated SigmaHQ to Wazuh XML Rule Conversion

• Moshe Siman Tov Bustan at OX Security
  PolinRider Returns: Hijacked npm Packages Use Ethereum Blockchain to Conceal Malware Infrastructure

• Palo Alto Networks

  • Unit 42 Threat Intelligence Highlights – Nov. 2, 2026
  • Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System

• Alphie Champion at Phorion
  Browser Cache Smuggling on macOS: Reproducing and Defending the Technique

• Prodaft

  • Pestilent Ladybug: Tax Impersonation, Remote Access and Infrastructure in Southeast Asia
  • Multi-Architecture Linux Botnet: Divergent Scanners and DDoS Control

• Profero
  Inside the AI Operator

• Luke Jennings at Push Security
  Fake event invites combine Kali365 and VoidProxy payloads

• Qi’anxin X Lab

  • 警惕 cwpdoor：寄生在 Control Web Panel 中的零检出被动后门
  • CWPdoor: The Invisible Backdoor Living Inside Control Web Panel

• Ransom-ISAC

  • EByte Ransomware: Prince Code Behind a New Locker
  • The Copeland Incident

• Rapid7
  Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

• Tristano Di Liberto at at ReliaQuest
  Ransomware and Cyber Extortion in Q3 2026

• Scott Helme at Report URI
  SuperPixel: The Card Skimmer Hiding Inside Your Own jQuery

• Rick Martin

  • I Wanted to Catch Hackers. Two Years Later, I’m Building the Future of Detection Engineering
  • PHP2Shell Exposed More Than a Vulnerability. It Exposed the Blind Spots in Your SIEM.

• Ridgeline Cyber
  What Revoke Sessions Actually Stops in Microsoft Entra ID

• Robin Dost at Synaptic Systems
  You’ve Got Spam: The Kyiv Independent Hack

• Tim Geschwindt and Gavin Hull at S-RM
  Artex in the wild: Lessons from responding to agentic AI attacks

• SANS Internet Storm Center

  • Mutipath TCP: Use and Detection, (Mon, Nov 2nd)
  • The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th)
  • Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)

• Securelist

  • CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
  • MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices
  • The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
  • Virtualization security: attack layers and misconfiguration impact

• Security Alliance

  • SEAL weekly stats: 28 Oct – 3 Nov 2026
  • TraderTraitor vs Contagious Interview – A Look at Binance’s Initial Incident Report

• Security Scorecard

  • Announcing GFMX: An X.509 Fingerprinting Technique for the Post-Quantum Era
  • A Dish Served Lukewarm: The Refrigerator Botnet

• Pedro Tavares at Segurança Informática
  Recorteiro: a Rust banking trojan that cuts holes in your screen and hides behind fake electricity bills in Portugal

• Sekoia
  Poisoned Source: APT29 Watering Holes Targets Mobile Devices

• Tom Hegel at SentinelOne
  Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks

• Sumedh Barde at Simbian
  Indirect Prompt Injection: How Logs Can Hijack AI SOC Agents

• Kush Pandya at Socket
  Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools

• SOCRadar
  Dark Web Profile: Nova Ransomware

• Mitch Pronschinske at Sophos
  The State of Ransomware in Financial Services 2026

• Sai Likhith at Step Security
  Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines

• Stephan Berger

  • Abusing Linux fanotify for Anti-Forensics
  • Modern Authentication, Legacy Problems

• Sygnia

  • Investigating Data Extortion Involving Trusted Vendor Access
  • Incident Response Best Practices: Strategies, Tools & Plans

• Symantec Enterprise
  New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org

• System Weakness
  Detecting AMSI Bypass Attempts: A Blue Team Guide

• Tehtris
  Deobfuscating the ToRat malware

• ThreatBreach
  Is Your Package Malicious ?

• ThreatMon

  • The Fake Zero-Day Trap: How a Crypto Exploit Became a Wallet Hijacking Scheme
  • Inside ARTEX: AI-Powered Intrusions, Cloud Compromise, and Cyber Espionage
  • 82,478 Rows and a Google Drive Folder: How One C2 Server Pulled Data From Mexican Organizations
  • A Typo, a Leaked Token and Booby-Trapped Go Packages: Inside the CCDS C2 Server
  • Ransomware 2026 Report October
  • Make $500 in 30 Minutes”: The Fake Changelly Exploit That Swaps Your Wallet Address
  • An 82-Day Breach, a 38 GB Leak and a Gang That Was Supposed to Be Gone: October 2026 in Ransomware
  • When the Browser Talks to Your AI Agent: Inside the Claude Dispatch Flaw

• Nicholas Koken at Todyl
  Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads

• Trellix

  • Your SOC’s AI Can Act on Its Own. But Can It Tell You Why?
  • The speed of threats is changing. Introducing the Trellix November 2026 CyberThreat Report.

• Richard Grainger at Triskele Labs
  State of Cyber 2025 – DFIR

• Sina Kheirkhah at watchTowr Labs
  Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

• Joff Thyer at White Knight Labs
  Exploiting PHP Foundational Vulnerabilities

• Heath Moodie at Xintra
  Could consequence modelling have stopped Ukraine’s APT grid attacks?

• Блог Solar 4RAYS
  AppTrickster. История одной неудавшейся уязвимости

Upcoming events/webinars

• ADF Solutions

  • ADF Weekly Mobile Training Sessions
  • ADF Weekly Computer Training Sessions

• Black Hills Information Security
  Follow the Sign-in: Entra ID (Azure AD) investigations in the SIEM

• Blackberry
  Can Your Team Still Coordinate When Your Systems Are Isolated?

• Magnet Forensics

  • Magnet User Summit 2027: Your presentation catalog is here
  • AI Unpacked S2:E4 // The art and science of AI prompting in digital investigations

• Joe Toley at Spur Intelligence
  Uncovering the Infrastructure Behind AI Traffic

• Sygnia
  Cyber Insurance in Practice: What to Know Before an Incident

Presentations/podcasts

• Gerald Auger at Simply Cyber and Jessica Hyde at Hexordia
  How Do You Keep Digital Evidence Admissible in Court?

• Blue Team بالعربي
  Beyond the Alert: Build A SOC Investigation Through Pivoting EP1

• Cyber Social Hub
  How to Create an Acquisition of iOS and Android Devices in ADF Pro and MDI

• Huntress

  • Bring Your Own Vulnerable Driver
  • From Floppy Disks to AI-Powered Cybercrime

• John Hammond

  • malware.mob
  • A Database of Malware (in Minecraft)

• Magnet Forensics

  • Why customers are excited about Magnet Graykey 2
  • Cyber Unpacked S3:E2 // IR beyond malware: Investigating business email compromise and fraud
  • Get ahead of the deadline: Grant readiness for 2027

• Microsoft Threat Intelligence Podcast
  PHP2Shell: What’s Real, What’s Noise, and What Actions to Take

• Monolith Forensics

  • 5 Practical Ways to Keep Your Cases Organized in Monolith [Monolith Mondays]
  • Task Templates – Monolith Settings

• MSAB
  #MSABMonday – Bruteforcing

• MyDFIR
  10 Things I Learned After 10 Years in SOC/DFIR

• Off By One Security
  Off By One Security: Open Session!

• Open Source Forensics Lab
  LEAKED OFFICIAL SECURITY + PBQ: Determine the Infected Endpoints Forensics Walkthrough

• OpenSourceMalware
  The OpenSourceMalware Show #28

• Paraben Corporation

  • Micro Webinar AI Driven E Discovery Culling and Early Case Assessment
  • Micro Webinar Google Takeout Series 1

• SANS
  Stop Blaming Humans: Rethinking Security Culture with John Scott

• SANS Cyber Defense
  You Can’t Fight What You Don’t Understand: The Quantum Threat Demystified for Security Practitioners

• Team Cymru
  Paul McCarty & Jenn Gile on how 540 packages under one maintainer expose a supply chain blind spot

• THE AI & Security Insights Show
  The AI & Security Insights Show – Episode 299 – Sentinel and ISOC

• The Weekly Purple Team
  Who Smuggled That In? It Wasm’t Me.

Malware analysis

• Darktrace
  CikaBika Bot: Inside a Discord RAT Campaign

• ExaTrack
  SectopRat’s GPULoader and VMLoader

• Cara Lin at Fortinet
  BITTER Expands Its Arsenal with PapRAT

• Lenny Zeltser
  Designing a Malware Analysis Lab With REMnux

• Shmuel Uzan at Morphisec
  From Business Emails to XLoader: An Order Lure That Led to In-Memory Injection 

• Adithya V at Secjuice
  Practical Malware Analysis: A Beginner Takes On Salat Stealer

• Gabriel Bernadett-Shapiro and Aleksandar Milenkoski at SentinelOne
  VerifiedIDA | Making LLM-Driven Reverse Engineering Inspectable, Continuable and Reusable

• Seqrite

  • The Evolution of Qilin (Agenda): A Comparative Reverse Engineering Analysis of Qilin Ransomware Across 2026
  • Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto

• Shubho57
  Analysis of an ELF file (Open Directory and a SH file)

• WeLiveSecurity

  • Gorbag: Orcs at the border harvesting intelligence from Ukraine
  • SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

• Zhassulan Zhussupov
  Malware development trick 68: Module overloading. Simple C example

• Шифровальщики-вымогатели The Digest “Crypto-Ransomware”
  CocaWare

Miscellaneous

• Belkasoft
  The Silent Observer: Forensic Analysis of Apple Unified Logs

• Brett Shavers
  My last writing on WinFE. Probably.

• Cellebrite
  Managing CSAM Investigations at Scale: How AI-Powered Triage Is Transforming Child Protection

• Giuseppe Scalzi at Compass Security
  Security Monitoring of AI Agents in Microsoft Defender XDR

• Decrypting a Defense
  Data Breach Leads to Criminal Accusations, Fighting Surveillance Procurement, 4th Cir. Cell Site Simulator Decision & More

• Henri Hambartsumyan at Falcon Force
  Dissecting WerFault

• Forensic Focus

  • AI For Investigations: 5 Myths, Debunked
  • How Detego Global’s AI Technology Is Transforming Child Abuse Investigations
  • Forensics Europe Expo 2027 Returns To Excel London With Expanded Opportunities For Forensic Professionals
  • Forensics Forward 2026 (Online, November 10): A Global Day Of Digital Forensics, Cybersecurity And Law
  • CCTV Review Under Pressure: How S21 CCTV Helps Investigators Find What Matters Faster
  • Dead Ends And Data Recovery: The Importance Of Remaining Tool Agnostic In Digital Forensics
  • Page One’s Rob Fried And Andrew Milauskas On Using AI In Digital Forensics And E-Discovery
  • Forensic Focus Digest, 06 Nov 2026

• Jason Yung
  由Azure Sentinel＋Logic App＋AI砌一套自動化 SOC Playbook — 第二篇: phishing email response playbook

• Kevin Pagano at Stark 4N6
  Forensics StartMe Updates (November 2026)

• Open Source DFIR

  • Discontinuing l2tscaffolder
  • The best DFIR metrics are derived, not collected

• Crystal Morin at Sysdig
  Refreshing the 555 Benchmark for Cloud Detection and Response in the AI era

Software releases/updates

• AppliedIR
  Valhuntir v0.6.6

• Belkasoft
  Belkasoft X 2.13: A Sneak Peek

• Canadian Centre for Cyber Security
  Assemblyline 4.8.0.1

• CCL Solutions
  RabbitHole v4 launches with additional data formats and enhanced SQLite forensics

• DFIRe
  1.16.0 — November 7, 2026

• Digital Sleuth
  winfor-salt v2026.14.8

• Doug Burks
  so-crates v5.2.0

• Doug Metz at Baker Street Forensics
  The Next Evolution: MalChela on Windows

• Ghassan Elsman
  Crow-Eye v0.15.0 — Sentinel Glance

• Intrinsec
  OrcDecryptNet: a .NET decryptor for DFIR-ORC archives

• Konrads Klints
  cryptnet-dump v1.0.0

• LEAPPs

  • ALEAPP v2026.4.5
  • iLEAPP v2026.4.6
  • LAVA v2026.1.2
  • RLEAPP v2026.4.5
  • VLEAPP v2026.4.5

• Magnet Forensics

  • New ways to scale investigations with Graykey Fastrak
  • Scale your forensic workflows with Magnet Automate 5.2
  • Magnet Graykey 2: Expanding the capabilities of mobile investigations
  • Magnet Axiom 10.5: Investigate more evidence with greater confidence
  • Magnet Witness 2.0: Expanded enhancement, large-case performance, and improved reporting

• Marco Neumann

  • crush-forensics chore: prepare v0.25.0
  • peach-forensics v0.11.0

• North Loop Consulting
  Arsenic Mobile Triage v4

• OpenCTI

  • 7.260811.0-lts.2
  • 7.261106.0

• Phil Harvey
  ExifTool 13.61

• radare2
  6.2.6

• Rory Wagner
  Hayabusa-Bulk-Runner v0.12.0

• Security Onion
  Security Onion 3.4.0 Now Available including Agentic AI Automations!

• SigmaHQ
  pySigma v2.0.2

• Toño Diaz
  masstin v1.4.3

• USB Detective
  Version 1.7.0 (11/04/2026)

• Yaniv Radunsky

  • DFIR Companion v0.45.0
  • DFIR Companion Detection rules rules-2026.11.06.2

• Yogesh Khatri
  mac_apt 20261106