Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.etowns.net Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cnew .ir Domain rev 3 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tribeoftwo .com domain rev 4 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bbsindex.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mrbasic.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ekcal .com domain rev 1 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ddns.info Domain rev 9 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gotgeeks.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.org rev 14 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a Suspicious *.dnsip.ru Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.extremelyorange .com domain rev 2 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.3d-game.com Domain rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.suroot.com Domain rev 11 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a dns-stuff.com Domain *.dns-stuff.com rev 7 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.8866.org rev 13 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a Suspicious no-ip Domain rev 12 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a *.4irc.com Domain rev 10 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS Query to a Suspicious *.ez-dns.com Domain rev 8 2024-12-01
suricata ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dyndns-web.com Domain rev 8 2024-12-01
sigma Exploiting CVE-2019-1388 stable 2024-12-01
sigma Suspicious High IntegrityLevel Conhost Legacy Option test 2024-12-01
sigma Suspicious Spool Service Child Process test 2024-12-01
sigma Suspicious Scheduled Task Creation via Masqueraded XML File test 2024-12-01
sigma UAC Bypass WSReset test 2024-12-01
sigma Setup16.EXE Execution With Custom .Lst File test 2024-12-01
sigma UAC Bypass Using MSConfig Token Modification - Process test 2024-12-01
sigma UAC Bypass Using NTFS Reparse Point - Process test 2024-12-01
sigma Always Install Elevated Windows Installer test 2024-12-01
sigma File and Directory Discovery - Linux test 2024-12-01
sigma Suspicious Child Process Created as System test 2024-12-01
sigma Possible Privilege Escalation via Weak Service Permissions test 2024-12-01
sigma Suspicious ShellExec_RunDLL Call Via Ordinal test 2024-12-01
sigma Password Policy Discovery - Linux stable 2024-12-01
sigma Non-privileged Usage of Reg or Powershell test 2024-12-01
sigma UAC Bypass Using Windows Media Player - Process test 2024-12-01
sigma UAC Bypass Abusing Winsat Path Parsing - Process test 2024-12-01
sigma Potential Privilege Escalation via Service Permissions Weakness test 2024-12-01
sigma Potential RDP Session Hijacking Activity test 2024-12-01
sigma UAC Bypass Using ChangePK and SLUI test 2024-12-01
sigma UAC Bypass Using Disk Cleanup test 2024-12-01