Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET MALWARE ViperSoftX HTTP CnC Activity rev 1 2022-12-30
sigma Change User Account Associated with the FAX Service test 2022-12-30
sigma Privilege Escalation via Named Pipe Impersonation test 2022-12-30
sigma Change the Fax Dll test 2022-12-30
sigma Deletion of Volume Shadow Copies via WMI with PowerShell test 2022-12-30
sigma Suspicious Usage Of ShellExec_RunDLL test 2022-12-30
sigma Suspicious Extrac32 Alternate Data Stream Execution test 2022-12-30
sigma Microsoft IIS Connection Strings Decryption test 2022-12-30
sigma Windows Firewall Profile Disabled test 2022-12-30
sigma Potential Suspicious Activity Using SeCEdit test 2022-12-30
sigma Use Of Hidden Paths Or Files test 2022-12-30
snort ET GAMES Multiple Game Cheat Application Related Activity rev 1 2022-12-29
sigma Potential Suspicious Windows Feature Enabled test 2022-12-29
sigma ImagingDevices Unusual Parent/Child Processes test 2022-12-29
sigma Invoke-Obfuscation COMPRESS OBFUSCATION test 2022-12-29
sigma Potential Suspicious Windows Feature Enabled - ProcCreation test 2022-12-29
sigma Lolbin Runexehelper Use As Proxy test 2022-12-29
snort ET TROJAN Win32/Uwamson.A!ml CnC Checkin rev 1 2022-12-28
snort ET CURRENT_EVENTS Successful US Government Bid Credential Phish 2022-12-28 rev 1 2022-12-28
snort ET CURRENT_EVENTS Successful MetaMask Pass Phrase Phish 2022-12-27 rev 1 2022-12-28
snort ET INFO Suspicious Empty User-Agent rev 22 2022-12-28
snort ET CURRENT_EVENTS Successful Netflix Credential Phish 2022-12-27 rev 1 2022-12-28
snort ET CURRENT_EVENTS US Government Bid Credential Phish Landing Page 2022-12-28 rev 1 2022-12-28
suricata ET PHISHING Successful US Government Bid Credential Phish 2022-12-28 rev 1 2022-12-28
suricata ET PHISHING Successful Netflix Credential Phish 2022-12-27 rev 1 2022-12-28
suricata ET PHISHING US Government Bid Credential Phish Landing Page 2022-12-28 rev 1 2022-12-28
sigma Suspicious Execution via macOS Script Editor test 2022-12-28
sigma Potential Discovery Activity Using Find - MacOS test 2022-12-28
sigma System Network Connections Discovery - MacOs test 2022-12-28
sigma Potential Discovery Activity Using Find - Linux test 2022-12-28
sigma SES Identity Has Been Deleted test 2022-12-28
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-27 rev 1 2022-12-27
snort ET MALWARE Win32/Atshz.A Checkin rev 2 2022-12-27
snort ET MALWARE Win32/Atshz.A Checkin M2 rev 2 2022-12-27
snort ET TROJAN Antinum HTTP Checkin rev 1 2022-12-27
snort ET TROJAN Antinum WebSockets Start rev 1 2022-12-27
suricata ET PHISHING Generic Credential Phish Landing Page 2022-12-27 rev 1 2022-12-27
sigma Suspicious SQL Query test 2022-12-27
sigma First Time Seen Remote Named Pipe - Zeek test 2022-12-27
sigma Remote Task Creation via ATSVC Named Pipe - Zeek test 2022-12-27