Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sentinel SUNSPOT malware hashes — —
sentinel Azure VM Run Command operation executed during suspicious login window Scheduled —
sentinel Known Ruby Sleet domains and hashes — —
sentinel Risky user signin observed in non-Microsoft network device Scheduled —
sentinel Privileged Accounts - Sign in Failure Spikes — —
sentinel Security Event log cleared — —
sentinel Distributed Password cracking attempts in AzureAD — —
sentinel Microsoft Entra ID Health Monitoring Agent Registry Keys Access Scheduled —
sentinel Microsoft Entra ID Health Service Agents Registry Keys Access Scheduled —
sentinel Scheduled Task Hide — —
sentinel Attempts to sign in to disabled accounts — —
sentinel AD FS Abnormal EKU object identifier attribute Scheduled —
sentinel Attempt to bypass conditional access rule in Microsoft Entra ID — —
sentinel ADFS Database Named Pipe Connection — —
sentinel TI map IP entity to W3CIISLog — —
sentinel Brute force attack against a Cloud PC — —
sentinel Brute Force Attack against GitHub Account — —
sentinel NRT Base64 encoded Windows process command-lines — —
sentinel Azure Portal Signin from another Azure Tenant — —
sentinel NRT Process executed from binary hidden in Base64 encoded file — —
sentinel Microsoft Entra ID PowerShell accessing non-Entra ID resources — —
sentinel Authentications of Privileged Accounts Outside of Expected Controls Scheduled —
sentinel Authentication Attempt from New Country Scheduled —
sentinel Silk Typhoon Suspicious Exchange Request Scheduled —
sentinel Service Principal Name (SPN) Assigned to User Account Scheduled —
sentinel New user created and added to the built-in administrators group Scheduled —
sentinel New EXE deployed via Default Domain or Default Domain Controller Policies — —
sentinel Changes to internet facing AWS RDS Database instances — —
sentinel Base64 encoded Windows process command-lines (Normalized Process Events) Scheduled —
sentinel Changes to Amazon VPC settings — —
sentinel Changes made to AWS CloudTrail logs — —
sentinel Login to AWS Management Console without MFA — —
sentinel A host is potentially running a crypto miner (ASIM Web Session schema) Scheduled —
sentinel SUNBURST suspicious SolarWinds child processes (Normalized Process Events) Scheduled —
sentinel Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) Scheduled —
sentinel Dev-0228 File Path Hashes November 2021 (ASIM Version) Scheduled —
sentinel Sdelete deployed via GPO and run recursively (ASIM Version) Scheduled —
sentinel Potential re-named sdelete usage (ASIM Version) Scheduled —
sentinel New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) Scheduled —
sentinel Brute force attack against user credentials (Uses Authentication Normalization) Scheduled —