Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Linux DD File Overwrite production 2026-05-13
splunk Linux Decode Base64 to Shell production 2026-05-13
splunk Linux Deleting Critical Directory Using RM Command production 2026-05-13
splunk Linux Deletion Of Cron Jobs production 2026-05-13
splunk Linux Deletion Of Init Daemon Script production 2026-05-13
splunk Linux Deletion Of Services production 2026-05-13
splunk Linux Deletion of SSL Certificate production 2026-05-13
splunk Linux Disable Services production 2026-05-13
splunk Linux Doas Conf File Creation production 2026-05-13
splunk Linux Doas Tool Execution production 2026-05-13
splunk Linux Docker Shell Execution production 2026-05-13
splunk Linux Edit Cron Table Parameter production 2026-05-13
splunk Linux Emacs Privilege Escalation production 2026-05-13
splunk Linux File Created In Kernel Driver Directory production 2026-05-13
splunk Linux File Creation In Init Boot Directory production 2026-05-13
splunk Linux Possible Ssh Key File Creation production 2026-05-13
splunk Linux File Creation In Profile Directory production 2026-05-13
splunk Linux Find Privilege Escalation production 2026-05-13
splunk Linux GDB Privilege Escalation production 2026-05-13
splunk Linux Gdrive Binary Activity production 2026-05-13
splunk Linux Gem Privilege Escalation production 2026-05-13
splunk Linux GNU Awk Privilege Escalation production 2026-05-13
splunk Linux Hardware Addition SwapOff production 2026-05-13
splunk Linux High Frequency Of File Deletion In Boot Folder production 2026-05-13
splunk Linux High Frequency Of File Deletion In Etc Folder production 2026-05-13
splunk Linux Impair Defenses Process Kill production 2026-05-13
splunk Linux Indicator Removal Clear Cache production 2026-05-13
splunk Linux Indicator Removal Service File Deletion production 2026-05-13
splunk Linux Ingress Tool Transfer Hunting production 2026-05-13
splunk Linux Ingress Tool Transfer with Curl production 2026-05-13
splunk Linux Insert Kernel Module Using Insmod Utility production 2026-05-13
splunk Linux Install Kernel Module Using Modprobe Utility production 2026-05-13
splunk Linux Iptables Firewall Modification production 2026-05-13
splunk Linux Kernel Module Enumeration production 2026-05-13
splunk Linux Kworker Process In Writable Process Path production 2026-05-13
splunk Linux Magic SysRq Key Abuse production 2026-05-13
splunk Linux Make Privilege Escalation production 2026-05-13
splunk Linux Medusa Rootkit production 2026-05-13
splunk Linux Suspicious React or Next.js Child Process production 2026-05-13
splunk Linux System Network Discovery production 2026-05-13