Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Account Created And Deleted Within A Close Time Frame test 2022-08-18
sigma Third Party Software DLL Sideloading test 2022-08-17
snort ET TROJAN RShell Backdoor Keepalive rev 1 2022-08-16
suricata ET MALWARE RShell Backdoor Keepalive rev 1 2022-08-16
sigma PowerShell Write-EventLog Usage test 2022-08-16
sigma Privileged Account Creation test 2022-08-16
sigma Powerview Add-DomainObjectAcl DCSync AD Extend Right test 2022-08-16
snort ET TROJAN Win32/VB.QTV CnC Checkin rev 1 2022-08-15
snort ET TROJAN Arkei/Vidar/Mars Stealer Variant Data Exfiltration Attempt rev 1 2022-08-15
snort ET TROJAN Win.Backdoor.Kolobko-9950676-0 Retrieving CnC Commands rev 1 2022-08-15
suricata ET MALWARE Win.Backdoor.Kolobko-9950676-0 Retrieving CnC Commands rev 1 2022-08-15
sigma Ursnif Malware Download URL Pattern stable 2022-08-15
sigma Suspicious Application Installed test 2022-08-14
sigma Ntdsutil Abuse test 2022-08-14
sigma Loading Diagcab Package From Remote Path test 2022-08-14
sigma Suspicious GUP Usage test 2022-08-13
sigma Suspicious Extrac32 Execution test 2022-08-13
sigma LSASS Access Detected via Attack Surface Reduction test 2022-08-13
sigma Suspicious Diantz Download and Compress Into a CAB File test 2022-08-13
sigma Writing Local Admin Share test 2022-08-13
sigma Suspicious Interactive PowerShell as SYSTEM test 2022-08-13
sigma Suspicious New-PSDrive to Admin Share test 2022-08-13
sigma Malicious DLL File Dropped in the Teams or OneDrive Folder test 2022-08-12
snort ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz rev 3 2022-08-11
snort ET INFO Possible Fake 404 Credential Phish Landing Page rev 1 2022-08-11
snort ET TROJAN Win32/Packed.BlackMoon.A CnC Checkin rev 1 2022-08-11
snort ET TROJAN Win32/Korplug.HQ CnC Activity rev 1 2022-08-11
snort ET TROJAN Win32/RecordBreaker - Library Request rev 1 2022-08-11
snort ET TROJAN Win32/RecordBreaker - Observed UA M2 rev 1 2022-08-11
snort ET TROJAN Win32/RecordBreaker - Observed UA M1 rev 1 2022-08-11
suricata ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz rev 6 2022-08-11
suricata ET MALWARE Win32/Packed.BlackMoon.A CnC Checkin rev 1 2022-08-11
sigma Suspicious PsExec Execution test 2022-08-11
sigma Possible PetitPotam Coerce Authentication Attempt test 2022-08-11
sigma DCERPC SMB Spoolss Named Pipe test 2022-08-11
sigma Possible Impacket SecretDump Remote Activity test 2022-08-11
snort ET INFO HTTP POST Request XOR Key f8 rev 2 2022-08-10
snort ET INFO HTTP GET Request XOR Key 39 rev 2 2022-08-10
snort ET INFO HTTP GET Request XOR Key 72 rev 2 2022-08-10
snort ET INFO HTTP POST Request XOR Key cd rev 2 2022-08-10