Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Suspicious msbuild path production 2026-05-13
splunk Suspicious MSBuild Spawn production 2026-05-13
splunk Suspicious mshta child process production 2026-05-13
splunk Suspicious mshta spawn production 2026-05-13
splunk Suspicious PlistBuddy Usage experimental 2026-05-13
splunk Suspicious PlistBuddy Usage via OSquery experimental 2026-05-13
splunk Suspicious Reg exe Process production 2026-05-13
splunk Suspicious Regsvr32 Register Suspicious Path production 2026-05-13
splunk Suspicious Rundll32 dllregisterserver production 2026-05-13
splunk Suspicious Rundll32 no Command Line Arguments production 2026-05-13
splunk Suspicious Rundll32 PluginInit production 2026-05-13
splunk Suspicious Rundll32 StartW production 2026-05-13
splunk Suspicious Scheduled Task from Public Directory production 2026-05-13
splunk Suspicious SearchProtocolHost no Command Line Arguments production 2026-05-13
splunk Suspicious SQLite3 LSQuarantine Behavior experimental 2026-05-13
splunk Suspicious Ticket Granting Ticket Request production 2026-05-13
splunk Suspicious WAV file in Appdata Folder production 2026-05-13
splunk Suspicious writes to windows Recycle Bin production 2026-05-13
splunk System Info Gathering Using Dxdiag Application production 2026-05-13
splunk System Information Discovery Detection production 2026-05-13
splunk System User Discovery With Query production 2026-05-13
splunk Trickbot Named Pipe production 2026-05-13
splunk UAC Bypass MMC Load Unsigned Dll production 2026-05-13
splunk UAC Bypass With Colorui COM Object production 2026-05-13
splunk Uninstall App Using MsiExec production 2026-05-13
splunk Unknown Process Using The Kerberos Protocol production 2026-05-13
splunk Unload Sysmon Filter Driver production 2026-05-13
splunk Unloading AMSI via Reflection production 2026-05-13
splunk Unusual Number of Computer Service Tickets Requested experimental 2026-05-13
splunk Unusual Number of Kerberos Service Tickets Requested production 2026-05-13
splunk Unusual Number of Remote Endpoint Authentication Events experimental 2026-05-13
splunk Unusually Long Command Line experimental 2026-05-13
splunk User Discovery With Env Vars PowerShell production 2026-05-13
splunk User Discovery With Env Vars PowerShell Script Block production 2026-05-13
splunk USN Journal Deletion production 2026-05-13
splunk Verclsid CLSID Execution production 2026-05-13
splunk WBAdmin Delete System Backups production 2026-05-13
splunk Wbemprox COM Object Execution production 2026-05-13
splunk Web or Application Server Spawning a Shell production 2026-05-13
splunk Web Servers Executing Suspicious Processes experimental 2026-05-13