Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE Malicious CobaltStrike SSL/TLS Certificate Observed rev 1 2024-09-05
sigma Potential CommandLine Obfuscation Using Unicode Characters test 2024-09-05
snort ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 4 2024-09-04
snort ET TROJAN Angry Stealer Data Exfiltration Attempt rev 1 2024-09-04
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M4 rev 2 2024-09-04
suricata ET MALWARE Angry Stealer Data Exfiltration Attempt rev 1 2024-09-04
suricata ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 5 2024-09-04
sigma Persistence and Execution at Scale via GPO Scheduled Task test 2024-09-04
sigma Group Policy Abuse for Privilege Addition test 2024-09-04
sigma PowerShell Web Access Feature Enabled Via DISM test 2024-09-03
sigma Process Deletion of Its Own Executable test 2024-09-03
sigma PowerShell Web Access Installation - PsScript test 2024-09-03
sigma Shell Invocation via Apt - Linux test 2024-09-02
sigma Capsh Shell Invocation - Linux test 2024-09-02
sigma Suspicious Invocation of Shell via AWK - Linux test 2024-09-02
sigma Potential Remote WMI ActiveScriptEventConsumers Activity test 2024-09-02
sigma Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location test 2024-09-02
sigma Shell Execution via Find - Linux test 2024-09-02
sigma Shell Execution via Flock - Linux test 2024-09-02
sigma Inline Python Execution - Spawn Shell Via OS System Library test 2024-09-02
sigma Shell Execution via Nice - Linux test 2024-09-02
sigma Shell Execution GCC - Linux test 2024-09-02
sigma Shell Execution via Git - Linux test 2024-09-02
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M4 rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-7 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-EBCDIC rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-1 rev 1 2024-08-30
snort ET TROJAN Godzilla Webshell Interaction Attempt rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-1 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
suricata ET MALWARE Godzilla Webshell Interaction Attempt rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-7 rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-EBCDIC rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M2 rev 1 2024-08-29
snort ET TROJAN TA452 Trojan CnC Checkin M2 rev 1 2024-08-29