Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN Win32/Sality.NBA CnC Checkin rev 1 2022-07-18
snort ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2022-07-18 rev 1 2022-07-18
suricata ET PHISHING Facebook Credential Phish Landing Page 2022-07-18 rev 1 2022-07-18
suricata ET MALWARE Win32/Sality.NBA CnC Checkin rev 1 2022-07-18
sigma New CA Policy by Non-approved Actor test 2022-07-18
sigma UEFI Persistence Via Wpbbin - FileCreation test 2022-07-18
sigma UEFI Persistence Via Wpbbin - ProcessCreation test 2022-07-18
sigma Start of NT Virtual DOS Machine test 2022-07-16
snort ET TROJAN Possible Hiloti DNS Checkin Message explorer_exe rev 4 2022-07-15
snort ET CURRENT_EVENTS Sliver Related Domain in DNS Lookup rev 1 2022-07-15
snort ET TROJAN Win32/Wacapew CnC Checkin rev 1 2022-07-15
snort ET TROJAN Win32/Wacapew.C!ml CnC Checkin rev 1 2022-07-15
suricata ET MALWARE Possible Hiloti DNS Checkin Message explorer_exe rev 4 2022-07-15
snort ET CURRENT_EVENTS Successful OWA Credential Phish 2022-07-13 rev 1 2022-07-14
snort ET TROJAN JS/TrojanDropper.Agent.OHE CnC Checkin rev 1 2022-07-14
snort ET TROJAN Unknown APT Related Domain in DNS Lookup rev 1 2022-07-14
suricata ET PHISHING Successful OWA Credential Phish 2022-07-13 rev 1 2022-07-14
suricata ET MALWARE Dark Halo/SUNBURST Related DNS Lookup to webcodez .com rev 2 2022-07-14
suricata ET MALWARE JS/TrojanDropper.Agent.OHE CnC Checkin rev 1 2022-07-14
sigma PowerShell Script Run in AppData test 2022-07-14
sigma Suspicious Processes Spawned by WinRM test 2022-07-14
sigma Run PowerShell Script from ADS test 2022-07-14
sigma Suspicious Serv-U Process Pattern test 2022-07-14
sigma Suspicious Use of CSharp Interactive Console test 2022-07-14
sigma MMC Spawning Windows Shell test 2022-07-14
sigma Suspicious Execution of Systeminfo test 2022-07-14
sigma Fsutil Drive Enumeration test 2022-07-14
sigma Script Event Consumer Spawning Process test 2022-07-14
sigma NTDS.DIT Creation By Uncommon Process test 2022-07-14
sigma Execution of Powershell Script in Public Folder test 2022-07-14
sigma RDP to HTTP or HTTPS Target Ports test 2022-07-14
sigma Suspicious PowerShell Parameter Substring test 2022-07-14
sigma Suspicious MsiExec Embedding Parent test 2022-07-14
snort ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M1 rev 1 2022-07-13
snort ET TROJAN DNS Reply Sinkhole - Microsoft - 131.253.18.11-12 rev 7 2022-07-13
snort ET TROJAN Win64/Agent.qwiakk CnC Checkin rev 1 2022-07-13
snort ET DNS Reply Sinkhole - Zinkhole.org rev 6 2022-07-13
snort ET TROJAN DNS Reply Sinkhole Microsoft NO-IP Domain rev 3 2022-07-13
snort ET CURRENT_EVENTS Successful Standard Bank Credential Phish 2022-07-12 M3 rev 1 2022-07-13
snort ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111 rev 5 2022-07-13