Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Kubernetes Admission Controller Modification test 2024-07-11
sigma Forest Blizzard APT - File Creation Activity test 2024-07-11
sigma Potential DLL Sideloading Of MpSvc.DLL test 2024-07-11
sigma LoadBalancer Security Group Modification test 2024-07-11
snort ET TROJAN Imposter Interpol Stealer CnC Checkin rev 1 2024-07-10
suricata ET MALWARE Imposter Interpol Stealer CnC Checkin rev 1 2024-07-10
sigma Microsoft Word Add-In Loaded test 2024-07-10
sigma Potential Bucket Enumeration on AWS test 2024-07-10
snort ET TROJAN ZharkBot User-Agent Observed rev 1 2024-07-09
snort ET INFO Referrer-Policy set to unsafe-url rev 1 2024-07-09
snort ET TROJAN ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
suricata ET HUNTING TinyURL to Netlify Redirect rev 1 2024-07-09
suricata ET MALWARE ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
suricata ET MALWARE ZharkBot User-Agent Observed rev 1 2024-07-09
suricata ET INFO Referrer-Policy set to unsafe-url rev 1 2024-07-09
sigma PDF File Created By RegEdit.EXE test 2024-07-08
snort ET TROJAN UNK_ConsoleCollie URI Observed in HTTP Request rev 1 2024-07-05
suricata ET MALWARE UNK_ConsoleCollie URI Observed in HTTP Request rev 1 2024-07-05
sigma Hypervisor Enforced Paging Translation Disabled test 2024-07-05
sigma Windows Hypervisor Enforced Code Integrity Disabled test 2024-07-05
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
snort ET CURRENT_EVENTS UEFA 2024 Tickets/Hospitality Landing Page rev 1 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET PHISHING UEFA 2024 Tickets/Hospitality Landing Page rev 1 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M3 rev 3 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
snort ET TROJAN SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
suricata ET MALWARE SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
sigma Kapeka Backdoor Scheduled Task Creation test 2024-07-03
sigma Kapeka Backdoor Configuration Persistence test 2024-07-03
sigma Kapeka Backdoor Autorun Persistence test 2024-07-03
sigma Kapeka Backdoor Execution Via RunDLL32.EXE test 2024-07-03
sigma Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process test 2024-07-03
sigma Kapeka Backdoor Persistence Activity test 2024-07-03
sigma Kapeka Backdoor Loaded Via Rundll32.EXE test 2024-07-03