Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma WordPress Wp2shell REST Batch Endpoint Exploitation experimental 2026-07-19
sigma WordPress Wp2shell Webshell Plugin Access experimental 2026-07-19
splunk Linux Suspicious Child Process of PostgreSQL production 2026-07-17
splunk Linux PF_ALG Registration Outside of Boot Window production 2026-07-17
splunk Linux Binary Launched Process with Null Argv production 2026-07-17
suricata ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query rev 3 2026-07-15
snort ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query rev 2 2026-07-15
snort ET INFO DYNAMIC_DNS HTTP Request to a *.blogs .or .id domain rev 1 2026-07-15
snort ET INFO DYNAMIC_DNS Query to a *.blogs .or .id domain rev 1 2026-07-15
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.blogs .or .id domain rev 1 2026-07-15
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.blogs .or .id domain rev 1 2026-07-15
splunk Windows Local LLM Framework Execution production 2026-07-15
splunk Local LLM Framework DNS Query production 2026-07-15
splunk LLM Model File Creation production 2026-07-15
splunk Windows PowerShell FakeCAPTCHA Clipboard Execution production 2026-07-14
splunk Windows Curl Upload to Remote Destination production 2026-07-14
splunk Windows MSIExec Remote Download production 2026-07-14
splunk Detect RClone Command-Line Usage production 2026-07-14
splunk Windows InstallUtil Remote Network Connection production 2026-07-14
splunk Detect HTML Help URL in Command Line production 2026-07-14
splunk Windows InstallUtil URL in Command Line production 2026-07-14
splunk Windows File Download Via CertUtil production 2026-07-14
splunk Windows HTTP Network Communication From MSIExec production 2026-07-14
splunk Windows File Download Via PowerShell production 2026-07-14
splunk WMIC XSL Execution via URL production 2026-07-14
sigma Webshell Detection With Command Line Keywords test 2026-07-14
snort ET INFO ScreenConnect Initial Origin Checkin rev 1 2026-07-13
suricata ET INFO ScreenConnect Initial Origin Checkin rev 1 2026-07-13
sigma Potential System DLL Sideloading From Non System Locations test 2026-07-10
sigma AWS Bedrock Guardrail Deleted experimental 2026-07-10
sigma AWS Bedrock Guardrail Updated experimental 2026-07-10
splunk Suspicious Process Executed From Container File production 2026-07-09
splunk Linux Netcat Outbound Connection production 2026-07-08
splunk Linux Root Execution of id production 2026-07-08
splunk Linux File Creation In System Generator Directory production 2026-07-08
splunk Linux Shell History Access Via Command Line Utility production 2026-07-08
splunk Linux Shell Pseudo Device Reverse Shell production 2026-07-08
splunk Linux EFI Bootloader File Deletion production 2026-07-08
splunk Linux Suspicious Docker Build Command Execution production 2026-07-08
splunk Linux Binary Executed from Shared Memory Directory production 2026-07-08