Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk GetWmiObject User Account with PowerShell production 2026-05-13
splunk GetWmiObject DS User with PowerShell Script Block production 2026-05-13
splunk GetWmiObject DS User with PowerShell production 2026-05-13
splunk GetWmiObject Ds Group with PowerShell Script Block production 2026-05-13
splunk GetWmiObject Ds Group with PowerShell production 2026-05-13
splunk GetWmiObject Ds Computer with PowerShell Script Block production 2026-05-13
splunk GetWmiObject Ds Computer with PowerShell production 2026-05-13
splunk GetNetTcpconnection with PowerShell Script Block production 2026-05-13
splunk GetNetTcpconnection with PowerShell production 2026-05-13
splunk GetLocalUser with PowerShell Script Block production 2026-05-13
splunk GetLocalUser with PowerShell production 2026-05-13
splunk GetDomainGroup with PowerShell Script Block production 2026-05-13
splunk ESXi Syslog Config Change production 2026-05-13
splunk GetDomainGroup with PowerShell production 2026-05-13
splunk GetDomainController with PowerShell Script Block production 2026-05-13
splunk GetDomainController with PowerShell production 2026-05-13
splunk GetDomainComputer with PowerShell Script Block production 2026-05-13
splunk GetDomainComputer with PowerShell production 2026-05-13
splunk GetCurrent User with PowerShell Script Block production 2026-05-13
splunk GetCurrent User with PowerShell production 2026-05-13
splunk GetAdGroup with PowerShell Script Block production 2026-05-13
splunk GetAdGroup with PowerShell production 2026-05-13
splunk GetAdComputer with PowerShell Script Block production 2026-05-13
splunk GetAdComputer with PowerShell production 2026-05-13
splunk Get WMIObject Group Discovery with Script Block Logging production 2026-05-13
splunk Get WMIObject Group Discovery production 2026-05-13
splunk Get-ForestTrust with PowerShell Script Block production 2026-05-13
splunk Get-ForestTrust with PowerShell production 2026-05-13
splunk Get DomainUser with PowerShell Script Block production 2026-05-13
splunk Get DomainUser with PowerShell production 2026-05-13
splunk Get-DomainTrust with PowerShell Script Block production 2026-05-13
splunk Get-DomainTrust with PowerShell production 2026-05-13
splunk Get DomainPolicy with Powershell Script Block production 2026-05-13
splunk Get DomainPolicy with Powershell production 2026-05-13
splunk Get ADUserResultantPasswordPolicy with Powershell Script Block production 2026-05-13
splunk Get ADUserResultantPasswordPolicy with Powershell production 2026-05-13
splunk Get ADUser with PowerShell Script Block production 2026-05-13
splunk Get ADUser with PowerShell production 2026-05-13
splunk Get ADDefaultDomainPasswordPolicy with Powershell Script Block production 2026-05-13
splunk Get ADDefaultDomainPasswordPolicy with Powershell production 2026-05-13