Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Drop Binaries Into Spool Drivers Color Folder test 2022-07-28
snort ET TROJAN Win32/SuperBOT CnC Checkin rev 1 2022-07-27
snort ET TROJAN Win32/Sabsik.TE.B!ml CnC Checkin rev 1 2022-07-27
suricata ET MALWARE Win32/Sabsik.TE.B!ml CnC Checkin rev 1 2022-07-27
suricata ET MALWARE Win32/SuperBOT CnC Checkin rev 1 2022-07-27
sigma Azure AD Only Single Factor Authentication Required test 2022-07-27
snort ET TROJAN Win32/VB.NBI CnC Checkin rev 1 2022-07-26
snort ET TROJAN Win32/VB.QPK CnC Checkin rev 1 2022-07-26
suricata ET MALWARE Win32/VB.NBI CnC Checkin rev 1 2022-07-26
sigma Linux Shell Pipe to Shell test 2022-07-26
snort ET CURRENT_EVENTS Successful Idaho Central CU Phish 2022-07-24 rev 1 2022-07-25
snort ET TROJAN VBS/Agent.6B29!tr CnC Checkin rev 1 2022-07-25
snort ET TROJAN Win32/Loli Stealer CnC Activity rev 1 2022-07-25
suricata ET MALWARE Win32/Loli Stealer CnC Activity rev 1 2022-07-25
suricata ET MALWARE VBS/Agent.6B29!tr CnC Checkin rev 1 2022-07-25
elastic Auditd Login from Forbidden Location deprecated 2022-07-25
elastic Auditd Max Login Sessions deprecated 2022-07-25
elastic Auditd Login Attempt at Forbidden Time deprecated 2022-07-25
elastic Auditd Max Failed Login Attempts deprecated 2022-07-25
elastic Unusual Process Execution - Temp deprecated 2022-07-25
elastic Attempt to Disable IPTables or Firewall deprecated 2022-07-25
sigma UAC Bypass Using Iscsicpl - ImageLoad test 2022-07-25
snort ET TROJAN MSIL/Spy.Agent.CSS Exfil rev 1 2022-07-22
snort ET TROJAN Bitter APT Payload Request rev 1 2022-07-22
sigma New PDQDeploy Service - Client Side test 2022-07-22
sigma New PDQDeploy Service - Server Side test 2022-07-22
snort ET TROJAN Win32/Shrine.A CnC Checkin rev 1 2022-07-21
snort ET CURRENT_EVENTS Successful FedEx Phish 2022-07-20 rev 1 2022-07-21
snort ET TROJAN Win32/Stealerium Stealer Checkin via Discord rev 1 2022-07-21
suricata ET MALWARE MSIL/Firebird RAT CnC Checkin rev 4 2022-07-21
suricata ET MALWARE Win32/Stealerium Stealer Checkin via Discord rev 1 2022-07-21
sigma Renamed PsExec Service Execution test 2022-07-21
snort ET TROJAN Win32/MSIL.Heracles Checkin rev 1 2022-07-20
sigma Apache Spark Shell Command Injection - ProcessCreation test 2022-07-20
snort ET CURRENT_EVENTS Successful Coinbase Phish 2022-07-18 rev 1 2022-07-19
snort ET CURRENT_EVENTS Successful Facebook Phish 2022-07-18 rev 1 2022-07-19
snort ET CURRENT_EVENTS Successful RoundCube Phish 2022-07-18 rev 1 2022-07-19
suricata ET PHISHING Successful Coinbase Phish 2022-07-18 rev 1 2022-07-19
sigma CA Policy Removed by Non Approved Actor test 2022-07-19
snort ET MALWARE Win32 Handy Cafe Checkin rev 1 2022-07-18