Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
elastic AWS Bedrock Agent or Action Group Manipulation production 2026-09-25
elastic LLM-Based Wget Activity Triage via Auditd production 2026-09-25
elastic Unusual High Confidence Content Filter Blocks Detected production 2026-09-25
elastic Anthropic Organization Domain Boundary Changed production 2026-09-25
elastic Anthropic Organization Data Export Accessed production 2026-09-25
elastic Claude Cowork VM Boot Image Tamper production 2026-09-25
elastic GenAI CLI Started with Unsafe Permission Bypass production 2026-09-25
elastic Anthropic Multiple Authentication Failures production 2026-09-25
elastic Anthropic Session Reuse Impossible Travel production 2026-09-25
elastic Execution via OpenClaw Agent production 2026-09-25
elastic Anthropic Extra Usage Spend Limit Deleted production 2026-09-25
elastic Anthropic Admin Role Assigned to User production 2026-09-25
elastic Anthropic Compliance API Key Created production 2026-09-25
elastic Anthropic Organization Deletion production 2026-09-25
elastic Anthropic Artifact Shared Publicly production 2026-09-25
elastic AWS Bedrock Guardrail Deleted or Weakened production 2026-09-25
elastic Anthropic Primary Owner Transferred production 2026-09-25
elastic AWS Bedrock Third-Party or External Knowledge Base Associated to Agent production 2026-09-25
elastic Unusual High Denied Topic Blocks Detected production 2026-09-25
elastic AWS Bedrock API Key Used for Destructive or Anti-Recovery Action production 2026-09-25
elastic AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt production 2026-09-25
elastic AWS Bedrock Provisioned Model Throughput Tampering production 2026-09-25
elastic AWS Bedrock Detected Multiple Validation Exception Errors by a Single User production 2026-09-25
elastic Unusual High Denied Sensitive Information Policy Blocks Detected production 2026-09-25
elastic AWS Bedrock High Risk Filesystem or Execution Tool Invocation production 2026-09-25
elastic Potential Abuse of Resources by High Token Count and Large Response Sizes production 2026-09-25
elastic AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request production 2026-09-25
elastic AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User production 2026-09-25
elastic AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata production 2026-09-25
elastic AWS Bedrock AgentCore Resource Created with IAM Execution Role production 2026-09-25
elastic AWS Bedrock Foundation Model Access Enabled or Entitlement Granted production 2026-09-25
elastic AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session production 2026-09-25
elastic AWS Bedrock Agent Created by IAM User or Root production 2026-09-25
elastic AWS Bedrock Unauthorized Foundation Model Access Attempt production 2026-09-25
elastic AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session production 2026-09-25
elastic Azure OpenAI Insecure Output Handling production 2026-09-25
elastic AWS Bedrock Model Invocation Logging Disabled or Modified production 2026-09-25
elastic Anthropic MCP Server Created production 2026-09-25
elastic AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key production 2026-09-25
elastic Anthropic Impossible Travel Login production 2026-09-25