Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET SHELLCODE Rothenburg Shellcode rev 3 2010-07-30
snort ET P2P Edonkey Publicize File ACK rev 3 2010-07-30
snort ET WEB_SPECIFIC_APPS Openfire Jabber-Server type Parameter UPDATE SET SQL Injection Attempt rev 2 2010-07-30
snort ET TROJAN SC-KeyLog Keylogger Installed - Sending Initial Email Report rev 4 2010-07-30
snort ET CHAT GaduGadu Chat Receive Message rev 3 2010-07-30
snort ET TROJAN Conficker.b Shellcode rev 6 2010-07-30
snort ET POLICY HSRP Active Router Changed rev 2 2010-07-30
snort ET TROJAN Backdoor.Win32.VB.brg C&C Checkin rev 5 2010-07-30
snort ET P2P Kazaa over UDP rev 5 2010-07-30
snort ET POLICY Club World Casino Client in Use rev 4 2010-07-30
snort ET CHAT GaduGadu Chat Server Available Status Packet rev 3 2010-07-30
snort ET CHAT Facebook Chat using XMPP rev 4 2010-07-30
snort ET FTP Possible FTP Daemon Username SELECT FROM SQL Injection Attempt rev 2 2010-07-30
snort ET VOIP Multiple Unauthorized SIP Responses TCP rev 6 2010-07-30
snort ET GAMES Gold VIP Club Casino Client in Use rev 5 2010-07-30
snort ET POLICY Dameware Remote Control Service Install rev 5 2010-07-30
snort ET POLICY Google Talk TLS Client Traffic rev 4 2010-07-30
snort ET P2P Manolito Ping rev 3 2010-07-30
snort ET TROJAN Perfect Keylogger FTP Initial Install Log Upload rev 3 2010-07-30
sentinel Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121) Scheduled —
sentinel PHP Worker Process Spawning Shell/Recon Tool Scheduled —
snort ET WEB_CLIENT WSO 2.6 Webshell Accessed on External Compromised Server rev 2 —
sentinel Changes to Application Ownership Scheduled —
sentinel User login from different countries within 3 hours (Uses Authentication Normalization) Scheduled —
sentinel Potential Password Spray Attack (Uses Authentication Normalization) Scheduled —
sentinel Changes to PIM Settings Scheduled —
sentinel Failed AzureAD logons but success logon to host Scheduled —
sentinel DNS events related to ToR proxies (ASIM DNS Schema) Scheduled —
sentinel Changes to Application Logout URL Scheduled —
sentinel Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization) Scheduled —
sentinel DNS events related to mining pools (ASIM DNS Schema) Scheduled —
sentinel A client made a web request to a potentially harmful file (ASIM Web Session schema) Scheduled —
sentinel Probable AdFind Recon Tool Usage (Normalized Process Events) Scheduled —
sentinel Known Mint Sandstorm group domains/IP - October 2020 — —
sentinel Known Phosphorus group domains/IP — —
sentinel New External User Granted Admin — —
sentinel New access credential added to Application or Service Principal — —
sentinel NRT User added to Microsoft Entra ID Privileged Groups — —
sentinel Phishing link click observed in Network Traffic Scheduled —
sentinel Known Plaid Rain IP — —