Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Potentially Suspicious Child Process of KeyScrambler.exe test 2024-05-13
sigma Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock test 2024-05-12
sigma Potentially Suspicious Malware Callback Communication - Linux test 2024-05-10
sigma UAC Notification Disabled test 2024-05-10
sigma All Backups Deleted Via Wbadmin.EXE test 2024-05-10
sigma File Recovery From Backup Via Wbadmin.EXE test 2024-05-10
sigma Sensitive File Recovery From Backup Via Wbadmin.EXE test 2024-05-10
sigma UAC Secure Desktop Prompt Disabled test 2024-05-10
sigma Windows Backup Deleted Via Wbadmin.EXE test 2024-05-10
sigma Sensitive File Dump Via Wbadmin.EXE test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application test 2024-05-10
sigma New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE test 2024-05-10
sigma Suspicious External WebDAV Execution test 2024-05-10
sigma UAC Disabled stable 2024-05-10
sigma New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock test 2024-05-10
snort ET TROJAN AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
snort ET CURRENT_EVENTS Possible Microsoft Phishing HTML Class Tag rev 1 2024-05-09
snort ET TROJAN AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
snort ET TROJAN DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
suricata ET MALWARE DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
suricata ET MALWARE AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
suricata ET PHISHING Possible Microsoft Phishing HTML Class Tag rev 1 2024-05-09
suricata ET MALWARE AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
snort ET TROJAN DNS query for Morto RDP worm related domain qfsl.net rev 4 2024-05-08
snort ET POLICY tor4u tor2web .onion Proxy DNS lookup rev 4 2024-05-08
snort ET TROJAN DNS query for Morto RDP worm related domain jifr.info rev 4 2024-05-08
suricata ET MALWARE DNS Query Sykipot Domain rusview.net rev 6 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain jaifr.com rev 7 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain jifr.info rev 7 2024-05-08
suricata ET MALWARE DNS Query Sykipot Domain insdet.com rev 6 2024-05-08
suricata ET INFO tor4u tor2web .onion Proxy DNS lookup rev 6 2024-05-08
suricata ET MALWARE DNS query for Morto RDP worm related domain qfsl.net rev 7 2024-05-08
suricata ET INFO DNS Query for try2check.me Carder Tool rev 8 2024-05-08
suricata ET SCAN Tomcat admin-admin login credentials rev 13 2024-05-07
suricata ET SCAN Tomcat admin-blank login credentials rev 11 2024-05-07
suricata ET MALWARE Suspicious Accept-Language HTTP Header zh-cn likely Kernelbot/Conficker Trojan Related rev 11 2024-05-07
suricata ET HUNTING Suspicious Empty User-Agent rev 27 2024-05-07
suricata ET ADWARE_PUP ZenoSearch Spyware User-Agent rev 16 2024-05-07
suricata ET SCAN DEBUG Method Request with Command rev 7 2024-05-07
suricata ET MALWARE Conficker/MS08-067 Worm Traffic Outbound rev 12 2024-05-07