Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Potential Secure Deletion with SDelete test 2024-12-13
snort ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound rev 2 2024-12-12
snort ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound rev 2 2024-12-12
snort ET ATTACK_RESPONSE PowerShell Internet Connectivity Check via Network GUID Inbound rev 4 2024-12-12
snort ET INFO DYNAMIC_DNS Query to a *.piminer .org domain rev 1 2024-12-12
snort ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href rev 3 2024-12-12
snort ET ATTACK_RESPONSE PowerShell Geo Check Before Execution rev 4 2024-12-12
snort ET INFO DYNAMIC_DNS Query to a *.thisoldrack .org domain rev 1 2024-12-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.thisoldrack .org domain rev 1 2024-12-12
snort ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe rev 3 2024-12-12
snort ET ATTACK_RESPONSE Microsoft Powershell Banner Outbound rev 5 2024-12-12
snort ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound rev 2 2024-12-12
snort ET INFO DYNAMIC_DNS HTTP Request to a *.piminer .org domain rev 1 2024-12-12
suricata ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href rev 3 2024-12-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.thisoldrack .org domain rev 1 2024-12-12
suricata ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe rev 3 2024-12-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thisoldrack .org domain rev 1 2024-12-12
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.piminer .org domain rev 1 2024-12-12
suricata ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound rev 2 2024-12-12
suricata ET ATTACK_RESPONSE PowerShell Internet Connectivity Check via Network GUID Inbound rev 4 2024-12-12
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.piminer .org domain rev 1 2024-12-12
suricata ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound rev 2 2024-12-12
suricata ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound rev 2 2024-12-12
suricata ET ATTACK_RESPONSE PowerShell Geo Check Before Execution rev 3 2024-12-12
suricata ET ATTACK_RESPONSE Microsoft Powershell Banner Outbound rev 5 2024-12-12
sigma Terminate Linux Process Via Kill test 2024-12-12
snort ET TROJAN PeakLight/Emmenhtal Loader Payload Delivery Template Observed rev 1 2024-12-11
suricata ET MALWARE PeakLight/Emmenhtal Loader Payload Delivery Template Observed rev 1 2024-12-11
sigma bXOR Operator Usage In PowerShell Command Line - PowerShell Classic test 2024-12-11
snort ET INFO DYNAMIC_DNS Query to a *.co-m .org domain rev 1 2024-12-10
snort ET TROJAN QuickResponseC2 Default Response Struct rev 1 2024-12-10
snort ET INFO DYNAMIC_DNS HTTP Request to a *.co-m .org domain rev 1 2024-12-10
snort ET INFO TryCloudFlare Domain in TLS SNI rev 1 2024-12-10
snort ET TROJAN QuickResponseC2 Default Tasking Struct rev 1 2024-12-10
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.co-m .org domain rev 1 2024-12-10
suricata ET HUNTING TryCloudFlare Domain in TLS SNI rev 1 2024-12-10
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.co-m .org domain rev 1 2024-12-10
suricata ET MALWARE QuickResponseC2 Default Response Struct rev 1 2024-12-10
suricata ET MALWARE QuickResponseC2 Default Tasking Struct rev 1 2024-12-10
sigma Local System Accounts Discovery - Linux test 2024-12-10