Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN SantaStealer Data Exfiltration Attempt rev 1 2025-12-16
suricata ET PHISHING TA397/Bitter CnC Fence Response rev 1 2025-12-16
snort ET CURRENT_EVENTS TA397/Bitter CnC Activity rev 2 2025-12-15
snort ET TROJAN TA397/Bitter CnC Domain in DNS Lookup rev 1 2025-12-15
snort ET CURRENT_EVENTS TA446 PHP Redirect rev 1 2025-12-15
suricata ET PHISHING TA446 PHP Redirect rev 1 2025-12-15
suricata ET MALWARE Observed TA397/Bitter Domain in TLS SNI rev 1 2025-12-15
suricata ET PHISHING TA397/Bitter CnC Activity rev 2 2025-12-15
suricata ET MALWARE TA397/Bitter CnC Domain in DNS Lookup rev 1 2025-12-15
sigma Potential Product Reconnaissance Via Wmic.EXE test 2025-12-15
sigma Potential Process Reconnaissance via Wmic.EXE test 2025-12-15
sigma Potential Tampering With Security Products Via WMIC test 2025-12-15
snort ET TROJAN CastleLoader Malware Outbound Checkin rev 1 2025-12-12
suricata ET MALWARE CastleLoader Malware Outbound Checkin rev 1 2025-12-12
snort ET TROJAN TA393 Phishing Redirect rev 1 2025-12-11
suricata ET PHISHING TA393 Phishing Redirect rev 1 2025-12-11
sigma Curl Web Request With Potential Custom User-Agent test 2025-12-11
snort ET TROJAN Peerblight ZinFoq Backdoor CnC Beacon rev 1 2025-12-10
snort ET TROJAN PeerBlight BitTorrent DHT CnC Checkin rev 1 2025-12-10
suricata ET MALWARE PeerBlight BitTorrent DHT CnC Checkin rev 1 2025-12-10
suricata ET MALWARE Peerblight ZinFoq Backdoor CnC Beacon rev 1 2025-12-10
sigma Legitimate Application Writing Files In Uncommon Location experimental 2025-12-10
sigma Malicious PowerShell Commandlets - PoshModule test 2025-12-10
sigma Malicious PowerShell Scripts - PoshModule test 2025-12-10
sigma File Download Via Bitsadmin To A Suspicious Target Folder test 2025-12-10
sigma Malicious PowerShell Scripts - FileCreation test 2025-12-10
sigma Malicious PowerShell Commandlets - ScriptBlock test 2025-12-10
sigma Malicious PowerShell Commandlets - ProcessCreation test 2025-12-10
snort ET CURRENT_EVENTS Microsoft Support Phish Landing Page 2025-12-09 rev 1 2025-12-09
suricata ET PHISHING Microsoft Support Phish Landing Page 2025-12-09 rev 1 2025-12-09
sigma Desktop.INI Created by Uncommon Process test 2025-12-09
sigma Renamed Office Binary Execution test 2025-12-09
sigma Potential Malicious Usage of CloudTrail System Manager test 2025-12-08
sigma Wow6432Node CurrentVersion Autorun Keys Modification test 2025-12-08
sigma Rare Remote Thread Creation By Uncommon Source Image test 2025-12-08
sigma System Info Discovery via Sysinfo Syscall experimental 2025-12-05
sigma Webshell Remote Command Execution test 2025-12-05
sigma Special File Creation via Mknod Syscall experimental 2025-12-05
sigma Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall experimental 2025-12-05
sigma ASLR Disabled Via Sysctl or Direct Syscall - Linux experimental 2025-12-05