Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk ESXi Shell Access Enabled production 2026-05-13
splunk ESXi SSH Brute Force production 2026-05-13
splunk ESXi SSH Enabled production 2026-05-13
splunk ESXi System Information Discovery production 2026-05-13
splunk ESXi User Granted Admin Role production 2026-05-13
splunk ESXi VIB Acceptance Level Tampering production 2026-05-13
splunk ESXi VM Discovery production 2026-05-13
splunk ESXi VM Exported via Remote Tool production 2026-05-13
splunk Ivanti VTM New Account Creation production 2026-05-13
splunk Monitor Email For Brand Abuse experimental 2026-05-13
splunk Suspicious Email Attachment Extensions experimental 2026-05-13
splunk Suspicious Java Classes experimental 2026-05-13
splunk Zoom High Video Latency experimental 2026-05-13
splunk Zoom Rare Audio Devices experimental 2026-05-13
splunk Zoom Rare Input Devices experimental 2026-05-13
splunk Zoom Rare Video Devices experimental 2026-05-13
splunk Amazon EKS Kubernetes cluster scan detection experimental 2026-05-13
splunk Amazon EKS Kubernetes Pod scan detection experimental 2026-05-13
splunk O365 Service Principal Privilege Escalation production 2026-05-13
splunk ASL AWS Concurrent Sessions From Different Ips production 2026-05-13
splunk ASL AWS Create Access Key production 2026-05-13
splunk ASL AWS Create Policy Version to allow all resources production 2026-05-13
splunk ASL AWS Credential Access GetPasswordData production 2026-05-13
splunk ASL AWS Credential Access RDS Password reset production 2026-05-13
splunk ASL AWS Defense Evasion Delete Cloudtrail production 2026-05-13
splunk ASL AWS Defense Evasion Delete CloudWatch Log Group production 2026-05-13
splunk ASL AWS Defense Evasion Impair Security Services production 2026-05-13
splunk ASL AWS Defense Evasion PutBucketLifecycle production 2026-05-13
splunk ASL AWS Defense Evasion Stop Logging Cloudtrail production 2026-05-13
splunk ASL AWS Defense Evasion Update Cloudtrail production 2026-05-13
splunk ASL AWS Detect Users creating keys with encrypt policy without MFA production 2026-05-13
splunk ASL AWS Disable Bucket Versioning production 2026-05-13
splunk ASL AWS EC2 Snapshot Shared Externally production 2026-05-13
splunk ASL AWS ECR Container Upload Outside Business Hours production 2026-05-13
splunk ASL AWS ECR Container Upload Unknown User production 2026-05-13
splunk ASL AWS IAM AccessDenied Discovery Events production 2026-05-13
splunk ASL AWS IAM Assume Role Policy Brute Force production 2026-05-13
splunk ASL AWS IAM Delete Policy production 2026-05-13
splunk ASL AWS IAM Failure Group Deletion production 2026-05-13
splunk ASL AWS IAM Successful Group Deletion production 2026-05-13