Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET INFO Observed DNS Query to .work TLD rev 3 2022-11-21
snort ET INFO Redirect Link in TikTok URL rev 1 2022-11-21
snort ET INFO Dotted Quad Host DOC Request rev 4 2022-11-21
suricata ET INFO infinityfree .net Domain in DNS Lookup rev 2 2022-11-21
suricata ET INFO DNS Query for Suspicious .icu Domain rev 4 2022-11-21
suricata ET INFO Observed DNS Query to .world TLD rev 5 2022-11-21
suricata ET INFO Observed DNS Query to .work TLD rev 5 2022-11-21
suricata ET INFO Observed DNS Query to .biz TLD rev 5 2022-11-21
suricata ET INFO Observed DNS Query to .life TLD rev 5 2022-11-21
suricata ET INFO Observed DNS Query to .fit TLD rev 5 2022-11-21
suricata ET INFO HTTP Request to Suspicious *.world Domain rev 5 2022-11-21
suricata ET INFO Observed DNS Query to .desi TLD rev 5 2022-11-21
suricata ET MALWARE Golang Aurora Stealer Exfil Activity rev 1 2022-11-21
suricata ET HUNTING Redirect Link in TikTok URL rev 1 2022-11-21
suricata ET INFO Observed DNS Query to .okinawa TLD rev 5 2022-11-21
suricata ET P2P Possible Torrent Download via HTTP Request rev 12 2022-11-21
suricata ET INFO HTTP Request to Suspicious *.life Domain rev 5 2022-11-21
suricata ET INFO HTTP Request to Suspicious *.work Domain rev 5 2022-11-21
sigma Suspicious Recursive Takeown test 2022-11-21
snort ET CURRENT_EVENTS TA399/Sidewinder Credential Phish Landing Page M1 2022-11-18 rev 1 2022-11-18
snort ET CURRENT_EVENTS TA399/Sidewinder Credential Phish Landing Page M2 2022-11-18 rev 1 2022-11-18
suricata ET PHISHING TA399/Sidewinder Credential Phish Landing Page M1 2022-11-18 rev 1 2022-11-18
sigma Suspicious Service Path Modification test 2022-11-18
sigma Suspicious Modification Of Scheduled Tasks test 2022-11-18
sigma Schtasks From Suspicious Folders test 2022-11-18
sigma Suspicious Powercfg Execution To Change Lock Screen Timeout test 2022-11-18
sigma Suspicious New Service Creation test 2022-11-18
sigma Windows Webshell Strings test 2022-11-18
sigma Disable Windows Defender AV Security Monitoring test 2022-11-18
snort ET TROJAN Win32/Corrempa/HZRAT CnC Checkin rev 1 2022-11-17
suricata ET MALWARE Win32/Corrempa/HZRAT CnC Checkin rev 1 2022-11-17
sigma Suspicious Msbuild Execution By Uncommon Parent Process test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet test 2022-11-17
sigma PST Export Alert Using New-ComplianceSearchAction test 2022-11-17
sigma PST Export Alert Using eDiscovery Alert test 2022-11-17
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell test 2022-11-17
sigma Computer Discovery And Export Via Get-ADComputer Cmdlet test 2022-11-17
sigma User Discovery And Export Via Get-ADUser Cmdlet - PowerShell test 2022-11-17
sigma Active Directory Group Enumeration With Get-AdGroup test 2022-11-17
sigma Invoke-Obfuscation CLIP+ Launcher test 2022-11-17