Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Possible DarkFinger tasklist Retrieval attempt rev 2 2024-09-13
snort ET TROJAN Fake Captcha Page Containing Powershell Inbound rev 1 2024-09-13
suricata ET MALWARE Fake Captcha Page Containing Powershell Inbound rev 1 2024-09-13
sigma Network Connection Initiated To BTunnels Domains test 2024-09-13
snort ET RETIRED 000Stealer Data Exfiltration M2 rev 6 2024-09-12
snort ET RETIRED Eternity Stealer Screen Capture Activity rev 2 2024-09-12
snort ET RETIRED Eternity Stealer Data Exfiltration Activity rev 5 2024-09-12
snort ET RETIRED BlackGuard_v2 Data Exfiltration Observed rev 3 2024-09-12
snort ET RETIRED Nerbian RAT Data Exfiltration rev 4 2024-09-12
snort ET RETIRED Zingo/GinzoStealer Stealer Exfiltration Observed rev 2 2024-09-12
snort ET RETIRED Matrix Max Stealer Exfiltration Observed rev 2 2024-09-12
snort ET RETIRED IceApple User-Agent observed rev 2 2024-09-12
snort ET RETIRED PowerShell/CustomRAT CnC Traffic rev 3 2024-09-12
snort ET RETIRED Bluebox Data Exfiltration rev 3 2024-09-12
snort ET RETIRED PennyWise Stealer Data Exfil M1 rev 4 2024-09-12
snort ET RETIRED BlueShtorm Infostealer Data Exfiltration rev 5 2024-09-12
snort ET RETIRED Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M1 rev 4 2024-09-12
snort ET RETIRED Nerbian RAT CnC Checkin rev 3 2024-09-12
suricata ET RETIRED Eternity Stealer Data Exfiltration Activity rev 6 2024-09-12
suricata ET RETIRED Win32/TrojanDownloader.Agent.GEM Maldoc Remote Template Request M1 rev 5 2024-09-12
suricata ET RETIRED Zingo/GinzoStealer Stealer Exfiltration Observed rev 5 2024-09-12
suricata ET RETIRED Eternity Stealer Screen Capture Activity rev 4 2024-09-12
suricata ET RETIRED BlackGuard_v2 Data Exfiltration Observed rev 4 2024-09-12
suricata ET RETIRED Nerbian RAT CnC Checkin rev 5 2024-09-12
suricata ET RETIRED 000Stealer Data Exfiltration M2 rev 7 2024-09-12
suricata ET RETIRED Nerbian RAT Data Exfiltration rev 6 2024-09-12
suricata ET RETIRED BlueShtorm Infostealer Data Exfiltration rev 6 2024-09-12
suricata ET RETIRED PennyWise Stealer Data Exfil M1 rev 5 2024-09-12
suricata ET RETIRED Bluebox Data Exfiltration rev 4 2024-09-12
suricata ET RETIRED IceApple User-Agent observed rev 4 2024-09-12
suricata ET RETIRED PowerShell/CustomRAT CnC Traffic rev 3 2024-09-12
suricata ET RETIRED Matrix Max Stealer Exfiltration Observed rev 4 2024-09-12
sigma UNC2452 Process Creation Patterns test 2024-09-12
sigma PwnKit Local Privilege Escalation test 2024-09-11
snort ET WEB_SPECIFIC_APPS Jenkins Script Console Authenticated Session rev 1 2024-09-06
suricata ET WEB_SPECIFIC_APPS Jenkins Script Console Authenticated Session rev 1 2024-09-06
sigma Startup/Logon Script Added to Group Policy Object test 2024-09-06
snort ET TROJAN VenomRAT CnC Server Keepalive rev 1 2024-09-05
snort ET TROJAN Malicious CobaltStrike SSL/TLS Certificate Observed rev 1 2024-09-05
suricata ET MALWARE VenomRAT CnC Server Keepalive rev 1 2024-09-05