Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Sdclt UAC Bypass production 2026-05-13
splunk Sdelete Application Execution production 2026-05-13
splunk SearchProtocolHost with no Command Line with Network production 2026-05-13
splunk SecretDumps Offline NTDS Dumping Tool production 2026-05-13
splunk ServicePrincipalNames Discovery with PowerShell production 2026-05-13
splunk ServicePrincipalNames Discovery with SetSPN production 2026-05-13
splunk Services Escalate Exe production 2026-05-13
splunk Services LOLBAS Execution Process Spawn production 2026-05-13
splunk Shai-Hulud Workflow File Creation or Modification production 2026-05-13
splunk Shim Database File Creation production 2026-05-13
splunk Shim Database Installation With Suspicious Parameters production 2026-05-13
splunk Short Lived Windows Accounts production 2026-05-13
splunk SilentCleanup UAC Bypass production 2026-05-13
splunk Single Letter Process On Endpoint production 2026-05-13
splunk SLUI RunAs Elevated production 2026-05-13
splunk SLUI Spawning a Process production 2026-05-13
splunk Spike in File Writes experimental 2026-05-13
splunk Spoolsv Spawning Rundll32 production 2026-05-13
splunk Spoolsv Suspicious Loaded Modules production 2026-05-13
splunk Spoolsv Suspicious Process Access production 2026-05-13
splunk Spoolsv Writing a DLL production 2026-05-13
splunk Spoolsv Writing a DLL - Sysmon production 2026-05-13
splunk Sqlite Module In Temp Folder production 2026-05-13
splunk Steal or Forge Authentication Certificates Behavior Identified production 2026-05-13
splunk Sunburst Correlation DLL and Network Event experimental 2026-05-13
splunk Suspicious Computer Account Name Change production 2026-05-13
splunk Suspicious Copy on System32 production 2026-05-13
splunk Suspicious Curl Network Connection experimental 2026-05-13
splunk Suspicious DLLHost no Command Line Arguments production 2026-05-13
splunk Suspicious GPUpdate no Command Line Arguments production 2026-05-13
splunk Suspicious IcedID Rundll32 Cmdline production 2026-05-13
splunk Suspicious Image Creation In Appdata Folder production 2026-05-13
splunk Suspicious Kerberos Service Ticket Request production 2026-05-13
splunk Suspicious Linux Discovery Commands production 2026-05-13
splunk Suspicious microsoft workflow compiler usage production 2026-05-13
splunk Suspicious msbuild path production 2026-05-13
splunk Suspicious MSBuild Spawn production 2026-05-13
splunk Suspicious mshta child process production 2026-05-13
splunk Suspicious mshta spawn production 2026-05-13
splunk Suspicious PlistBuddy Usage experimental 2026-05-13