Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Linux File Creation In Init Boot Directory production 2026-05-13
splunk Linux Possible Ssh Key File Creation production 2026-05-13
splunk Linux File Creation In Profile Directory production 2026-05-13
splunk Linux Find Privilege Escalation production 2026-05-13
splunk Linux GDB Privilege Escalation production 2026-05-13
splunk Linux Gdrive Binary Activity production 2026-05-13
splunk Linux Gem Privilege Escalation production 2026-05-13
splunk Linux GNU Awk Privilege Escalation production 2026-05-13
splunk Linux Hardware Addition SwapOff production 2026-05-13
splunk Linux High Frequency Of File Deletion In Boot Folder production 2026-05-13
splunk Linux High Frequency Of File Deletion In Etc Folder production 2026-05-13
splunk Linux Impair Defenses Process Kill production 2026-05-13
splunk Linux Indicator Removal Clear Cache production 2026-05-13
splunk Linux Indicator Removal Service File Deletion production 2026-05-13
splunk Linux Ingress Tool Transfer Hunting production 2026-05-13
splunk Linux Ingress Tool Transfer with Curl production 2026-05-13
splunk Linux Insert Kernel Module Using Insmod Utility production 2026-05-13
splunk Linux Install Kernel Module Using Modprobe Utility production 2026-05-13
splunk Linux Iptables Firewall Modification production 2026-05-13
splunk Linux Kernel Module Enumeration production 2026-05-13
splunk Linux Kworker Process In Writable Process Path production 2026-05-13
splunk Linux Magic SysRq Key Abuse production 2026-05-13
splunk Linux Make Privilege Escalation production 2026-05-13
splunk Linux Medusa Rootkit production 2026-05-13
splunk Linux MySQL Privilege Escalation production 2026-05-13
splunk Linux Ngrok Reverse Proxy Usage production 2026-05-13
splunk Linux Node Privilege Escalation production 2026-05-13
splunk Linux NOPASSWD Entry In Sudoers File production 2026-05-13
splunk Linux Obfuscated Files or Information Base64 Decode production 2026-05-13
splunk Linux Octave Privilege Escalation production 2026-05-13
splunk Linux OpenVPN Privilege Escalation production 2026-05-13
splunk Linux Persistence and Privilege Escalation Risk Behavior production 2026-05-13
splunk Linux PHP Privilege Escalation production 2026-05-13
splunk Linux pkexec Privilege Escalation production 2026-05-13
splunk Linux Possible Access Or Modification Of sshd Config File production 2026-05-13
splunk Linux Possible Access To Credential Files production 2026-05-13
splunk Linux Possible Access To Sudoers File production 2026-05-13
splunk Linux Possible Append Command To At Allow Config File production 2026-05-13
splunk Linux Possible Append Cronjob Entry on Existing Cronjob File production 2026-05-13
splunk Linux Possible Cronjob Modification With Editor production 2026-05-13