Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS Query to a Suspicious no-ip Domain rev 12 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.6600.org rev 11 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.ittelecom .pl Domain rev 3 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.trudireaume .com domain rev 3 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ez-dns.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.extremelyorange .com domain rev 2 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.addns .org Domain rev 3 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gotgeeks.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.3d-game.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.suroot.com Domain rev 11 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ddns.name Domain rev 9 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net rev 15 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.scieron.com Domain rev 8 2024-12-01
sigma UAC Bypass Using Consent and Comctl32 - Process test 2024-12-01
sigma UAC Bypass Tools Using ComputerDefaults test 2024-12-01
sigma CMSTP UAC Bypass via COM Object Access stable 2024-12-01
sigma UAC Bypass Using Disk Cleanup test 2024-12-01
sigma UAC Bypass Using ChangePK and SLUI test 2024-12-01
sigma Potential RDP Session Hijacking Activity test 2024-12-01
sigma UAC Bypass Using DismHost test 2024-12-01
sigma Exploiting CVE-2019-1388 stable 2024-12-01
sigma UAC Bypass Using PkgMgr and DISM test 2024-12-01
sigma UAC Bypass Using IDiagnostic Profile test 2024-12-01
sigma UAC Bypass Abusing Winsat Path Parsing - Process test 2024-12-01
sigma UAC Bypass Using Windows Media Player - Process test 2024-12-01
sigma UAC Bypass Using IEInstal - Process test 2024-12-01
sigma UAC Bypass Using MSConfig Token Modification - Process test 2024-12-01
sigma UAC Bypass Using NTFS Reparse Point - Process test 2024-12-01
sigma Potential UAC Bypass Via Sdclt.EXE test 2024-12-01
sigma Suspicious Child Process Created as System test 2024-12-01
sigma Possible Privilege Escalation via Weak Service Permissions test 2024-12-01
sigma Always Install Elevated Windows Installer test 2024-12-01
sigma Suspicious ShellExec_RunDLL Call Via Ordinal test 2024-12-01
sigma Suspicious High IntegrityLevel Conhost Legacy Option test 2024-12-01
sigma UAC Bypass WSReset test 2024-12-01
sigma Non-privileged Usage of Reg or Powershell test 2024-12-01
sigma Suspicious Spool Service Child Process test 2024-12-01
sigma Setup16.EXE Execution With Custom .Lst File test 2024-12-01
sigma Suspicious Scheduled Task Creation via Masqueraded XML File test 2024-12-01
sigma Potential Privilege Escalation via Service Permissions Weakness test 2024-12-01