Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32/TrojanDropper.Agent.SRM Exfil via Discord rev 1 2022-10-13
suricata ET MALWARE Win32/TrojanDropper.Agent.SRM Exfil via Discord rev 1 2022-10-13
sigma WMIC Loading Scripting Libraries test 2022-10-13
snort ET INFO MSSQL SELECT SPID Query Observed rev 1 2022-10-12
snort ET TROJAN MSSQL maggie backdoor sp_addextendedproc Command Observed rev 1 2022-10-12
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-10-12 rev 1 2022-10-12
snort ET TROJAN VBA/Agent.AAV CnC Checkin rev 1 2022-10-12
snort ET CURRENT_EVENTS Generic Credential Phish 2022-10-12 rev 1 2022-10-12
snort ET TROJAN Win32/Spy.Mekotio.EY Payload Request rev 1 2022-10-12
snort ET INFO MSSQL sp_addextendedproc Command Observed rev 1 2022-10-12
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-12 rev 1 2022-10-12
suricata ET MALWARE MSSQL maggie backdoor sp_addextendedproc Command Observed rev 1 2022-10-12
suricata ET MALWARE Win32/Spy.Mekotio.EY Payload Request rev 1 2022-10-12
suricata ET PHISHING Generic Credential Phish 2022-10-12 rev 1 2022-10-12
suricata ET INFO MSSQL SELECT SPID Query Observed rev 1 2022-10-12
suricata ET INFO MSSQL sp_addextendedproc Command Observed rev 1 2022-10-12
suricata ET MALWARE VBA/Agent.AAV CnC Checkin rev 1 2022-10-12
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2022-10-11 rev 1 2022-10-11
snort ET TROJAN Polonium APT PAPACREEP Backdoor Related Activity rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
snort ET CURRENT_EVENTS Generic Successful Phish 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Generic Credential Phish Landing Page M1 2022-10-11 rev 1 2022-10-11
suricata ET MALWARE Polonium APT PAPACREEP Backdoor Related Activity rev 1 2022-10-11
suricata ET PHISHING Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Successful Generic Credential Phish 2022-10-11 rev 1 2022-10-11
suricata ET PHISHING Generic Successful Phish 2022-10-11 rev 1 2022-10-11
sigma WMI Persistence - Script Event Consumer test 2022-10-11
snort ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2 rev 6 2022-10-10
snort ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-10 rev 1 2022-10-10
suricata ET PHISHING Successful Generic Credential Phish 2022-10-10 rev 1 2022-10-10
sigma Cleartext Protocol Usage stable 2022-10-10
sigma Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet test 2022-10-10
sigma Reg Add Suspicious Paths test 2022-10-10
sigma Operation Wocao Activity test 2022-10-09
sigma Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet test 2022-10-09
sigma Turla Group Lateral Movement test 2022-10-09
sigma MSSQL Extended Stored Procedure Backdoor Maggie test 2022-10-09
sigma Dropping Of Password Filter DLL test 2022-10-09