Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET REMOTE_ACCESS Tunneled RDP Handshake rev 2 2024-06-10
suricata ET REMOTE_ACCESS ScreenConnect/ConnectWise Initial Checkin Packet M2 rev 4 2024-06-10
suricata ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent rev 6 2024-06-10
suricata ET EXPLOIT Hongjing eHR Showmedia.jsp SQL Injection Inbound rev 1 2024-06-10
suricata ET REMOTE_ACCESS Tunneled RDP msts Handshake rev 2 2024-06-10
snort ET MOBILE_MALWARE Android Botnet CnC Domain in DNS Lookup rev 1 2024-06-07
snort ET EXPLOIT HikVision iSecure Center RCE Attempt Inbound rev 1 2024-06-07
suricata ET EXPLOIT HikVision iSecure Center RCE Attempt Inbound rev 1 2024-06-07
suricata ET MOBILE_MALWARE Android Botnet CnC Domain in DNS Lookup rev 1 2024-06-07
snort ET TROJAN UNC1151 Payload Retrieval Attempt rev 1 2024-06-06
snort ET TROJAN Silverfox Payload Retrieval Attempt rev 1 2024-06-06
snort ET TROJAN Win32/OfferCore Checkin M1 rev 1 2024-06-06
snort ET TROJAN HTTP Request to URL Ending in Payload .bin rev 1 2024-06-06
snort ET TROJAN Win32/OfferCore Checkin M2 rev 1 2024-06-06
suricata ET ADWARE_PUP Win32/OfferCore Checkin M2 rev 1 2024-06-06
suricata ET MALWARE UNC1151 Payload Retrieval Attempt rev 1 2024-06-06
suricata ET ADWARE_PUP Win32/OfferCore Checkin M1 rev 1 2024-06-06
suricata ET MALWARE HTTP Request to URL Ending in Payload .bin rev 1 2024-06-06
suricata ET MALWARE Silverfox Payload Retrieval Attempt rev 1 2024-06-06
suricata ET MALWARE Spyder Loader CnC Checkin rev 1 2024-06-05
snort ET TROJAN Spyder Loader CnC Checkin rev 1 2024-06-05
sigma LSASS Process Reconnaissance Via Findstr.EXE test 2024-06-04
sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location test 2024-06-04
sigma Copying Sensitive Files with Credential Data test 2024-06-04
sigma New Remote Desktop Connection Initiated Via Mstsc.EXE test 2024-06-04
sigma Lolbin Unregmp2.exe Use As Proxy test 2024-06-04
sigma File Download Via Nscurl - MacOS test 2024-06-04
snort ET TROJAN W32/Agent.XXZBEN Downloader Activity rev 3 2024-06-03
suricata ET EXPLOIT Possible Misfortune Cookie - SET rev 5 2024-06-03
suricata ET MALWARE W32/Agent.XXZBEN Downloader Activity rev 4 2024-06-03
sigma Potentially Suspicious Usage Of Qemu test 2024-06-03
snort ET TROJAN Win32/RiskWare.YouXun.X CnC Server Response rev 3 2024-06-02
suricata ET ADWARE_PUP Win32/RiskWare.YouXun.X CnC Server Response rev 2 2024-06-02
sigma Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted test 2024-06-02
sigma Windows Recall Feature Enabled - Registry test 2024-06-02
sigma Windows Recall Feature Enabled Via Reg.EXE test 2024-06-02
snort ET TROJAN Allasenha/CarnavalHeist RAT CnC Checkin rev 1 2024-05-31
snort ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992 rev 2 2024-05-31
suricata ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992 rev 2 2024-05-31
suricata ET MALWARE Allasenha/CarnavalHeist RAT CnC Checkin rev 1 2024-05-31