Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sentinel Suspicious link sharing pattern Scheduled —
sentinel Exchange Server Suspicious File Downloads. Scheduled —
sentinel Silk Typhoon Suspicious File Downloads. Scheduled —
sentinel Exchange AuditLog disabled — —
sentinel Rare and potentially high-risk Office operations — —
sentinel New executable via Office FileUploaded Operation — —
sentinel Multiple users email forwarded to same destination — —
sentinel NRT Malicious Inbox Rule NRT —
sentinel Multiple Teams deleted by a single user — —
sentinel Malicious Inbox Rule — —
sentinel Mail redirect via ExO transport rule — —
sentinel Exchange workflow MailItemsAccessed operation anomaly — —
sentinel Possible Forest Blizzard attempted credential harvesting - Sept 2020 — —
sentinel External user added and removed in short timeframe — —
sentinel Accessed files shared by temporary external user — —
sentinel Malicious BEC Inbox Rule — —
sentinel Identify Mango Sandstorm powershell commands Scheduled —
sentinel Zinc Actor IOCs domains hashes IPs and useragent - October 2022 — —
sentinel Zinc Actor IOCs files - October 2022 — —
sentinel AV detections related to Zinc actors — —
sentinel Alert for IOCs related to Windows/ELF malware - IP, Hash IOCs - September 2021 — —
sentinel High-Risk Cross-Cloud User Impersonation — —
sentinel User impersonation by Identity Protection alerts — —
sentinel User agent search for log4j exploitation attempt — —
sentinel External guest invitation followed by Microsoft Entra ID PowerShell signin — —
sentinel Unauthorized user access across AWS and Azure — —
sentinel Time series anomaly for data size transferred to public internet Scheduled —
sentinel Tarrask malware IOC - April 2022 — —
sentinel Suspicious VM Instance Creation Activity Detected Scheduled —
sentinel Suspicious modification of Global Administrator user properties Scheduled —
sentinel Suspicious Login from deleted guest account Scheduled —
sentinel Suspicious AWS console logins by credential access alerts — —
sentinel M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity Scheduled —
sentinel Successful AWS Console Login from IP Address Observed Conducting Password Spray — —
sentinel Star Blizzard C2 Domains August 2022 Scheduled —
sentinel Solorigate Domains Found in VM Insights — —
sentinel Solorigate Network Beacon — —
sentinel Silk Typhoon UM Service writing suspicious file — —
sentinel Cisco - firewall block but success logon to Microsoft Entra ID Scheduled —
sentinel Security Service Registry ACL Modification Scheduled —