Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma UAC Bypass Using NTFS Reparse Point - File test 2022-10-09
sigma Telegram Bot API Request test 2022-10-09
sigma Suspicious Driver Install by pnputil.exe test 2022-10-09
sigma PCRE.NET Package Image Load test 2022-10-09
sigma Suspicious DNS Query with B64 Encoded String test 2022-10-09
sigma Cobalt Strike DNS Beaconing test 2022-10-09
sigma InfDefaultInstall.exe .inf Execution test 2022-10-09
sigma UAC Bypass Using .NET Code Profiler on MMC test 2022-10-09
sigma Azure AD Health Monitoring Agent Registry Keys Access test 2022-10-09
sigma UAC Bypass Using Windows Media Player - File test 2022-10-09
sigma UAC Bypass Using IEInstal - File test 2022-10-09
sigma UAC Bypass Using MSConfig Token Modification - File test 2022-10-09
sigma Suspicious MacOS Firmware Activity test 2022-10-09
sigma Azure AD Health Service Agents Registry Keys Access test 2022-10-09
sigma UAC Bypass Abusing Winsat Path Parsing - File test 2022-10-09
sigma MSExchange Transport Agent Installation test 2022-10-09
sigma Remote PowerShell Session Host Process (WinRM) test 2022-10-09
sigma NetNTLM Downgrade Attack test 2022-10-09
sigma AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl test 2022-10-09
sigma RDP Login from Localhost test 2022-10-09
sigma UAC Bypass Using WOW64 Logger DLL Hijack test 2022-10-09
sigma Suspicious Plink Port Forwarding test 2022-10-09
sigma CVE-2021-26858 Exchange Exploitation test 2022-10-09
sigma Register new Logon Process by Rubeus test 2022-10-09
sigma Remote PowerShell Sessions Network Connections (WinRM) test 2022-10-09
sigma PCRE.NET Package Temp Files test 2022-10-09
sigma Disabling Security Tools test 2022-10-09
sigma Operation Wocao Activity test 2022-10-09
sigma Powershell Add Name Resolution Policy Table Rule test 2022-10-09
sigma Esentutl Gather Credentials test 2022-10-09
sigma Admin User Remote Logon test 2022-10-09
sigma Detected Windows Software Discovery test 2022-10-09
sigma MSSQL Extended Stored Procedure Backdoor Maggie test 2022-10-09
snort ET TROJAN TrueBot/Silence.Downlaoder Screenshot Post M1 rev 1 2022-10-07
snort ET CURRENT_EVENTS Successful Outlook Phish 2022-10-06 rev 1 2022-10-07
snort ET TROJAN TrueBot/Silence.Downlaoder Screenshot Post M2 rev 1 2022-10-07
snort ET CURRENT_EVENTS Binance Credential Phish Landing Page 2022-10-07 rev 1 2022-10-07
snort ET CURRENT_EVENTS DHL Credential Phish Landing Page 2022-10-07 rev 1 2022-10-07
snort ET MALWARE Win32/Adware.WDJiange.A CnC Checkin M1 rev 1 2022-10-07
snort ET MALWARE Win32/Adware.Agent.NSF CnC Checkin M1 rev 1 2022-10-07