Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_SERVER Suspected HrServ Webshell Related Activity M2 rev 1 2024-01-12
suricata ET MALWARE HailBot Server Response rev 1 2024-01-12
suricata ET WEB_SERVER Suspected HrServ Webshell Related Activity M1 rev 1 2024-01-12
suricata ET MALWARE Hailbot CnC Checkin rev 1 2024-01-12
sigma GCP Access Policy Deleted test 2024-01-12
sigma Google Workspace Application Access Level Modified test 2024-01-12
sigma GCP Break-glass Container Workload Deployed test 2024-01-12
snort ET TROJAN Suspected UTA0178 Domain in DNS Lookup rev 1 2024-01-11
snort ET TROJAN Suspected UTA0178 Domain in DNS Lookup rev 1 2024-01-11
snort ET TROJAN UTA0178 Domain in DNS Lookup rev 1 2024-01-11
sigma PUA - PingCastle Execution From Potentially Suspicious Parent test 2024-01-11
sigma Renamed PingCastle Binary Execution test 2024-01-11
sigma Potential Persistence Via MyComputer Registry Keys test 2024-01-11
sigma PUA - PingCastle Execution test 2024-01-11
snort ET TROJAN TrollAgent Checkin rev 1 2024-01-10
snort ET TROJAN RisePro TCP Heartbeat Packet rev 3 2024-01-10
snort ET TROJAN Sea Turtle APT Checkin rev 1 2024-01-10
suricata ET MALWARE RisePro TCP Heartbeat Packet rev 3 2024-01-10
suricata ET MALWARE Sea Turtle APT Checkin rev 1 2024-01-10
sigma Uncommon Extension Shim Database Installation Via Sdbinst.EXE test 2024-01-10
snort ET CURRENT_EVENTS Meta Credential Phish Landing Page 2024-01-08 rev 1 2024-01-08
snort ET TROJAN hacker87 checkin rev 2 2024-01-08
sigma Windows Filtering Platform Blocked Connection From EDR Agent Binary test 2024-01-08
snort ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M1 rev 1 2024-01-05
snort ET WEB_SPECIFIC_APPS GL.iNet add_user API Request - Backdoor root User Attempt rev 1 2024-01-05
snort ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2 rev 1 2024-01-05
snort ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool rev 1 2024-01-05
suricata ET EXPLOIT Inbound Setup Message from SMTP Smuggling Tool rev 1 2024-01-05
sigma Forfiles.EXE Child Process Masquerading test 2024-01-05
sigma HackTool - NoFilter Execution test 2024-01-05
snort ET EXPLOIT Possible Google Cookie Token Manipulation Activity rev 1 2024-01-04
sigma Screen Capture Activity Via Psr.EXE test 2024-01-04
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03
snort ET ATTACK_RESPONSE Havoc/Sliver Framework TLS Certificate Observed rev 2 2024-01-03