Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma UAC Bypass Using Disk Cleanup test 2024-12-01
sigma Potential CVE-2021-41379 Exploitation Attempt test 2024-12-01
sigma Suspicious RazerInstaller Explorer Subprocess test 2024-12-01
sigma UAC Bypass Using ChangePK and SLUI test 2024-12-01
sigma Potential RDP Session Hijacking Activity test 2024-12-01
sigma Non-privileged Usage of Reg or Powershell test 2024-12-01
sigma Potential Privilege Escalation via Service Permissions Weakness test 2024-12-01
sigma Suspicious Spool Service Child Process test 2024-12-01
sigma Setup16.EXE Execution With Custom .Lst File test 2024-12-01
sigma Suspicious Scheduled Task Creation via Masqueraded XML File test 2024-12-01
suricata ET HUNTING http string in hex Possible Obfuscated Exploit Redirect rev 4 2024-11-29
suricata ET HUNTING Possible RTF File With Obfuscated Version Header rev 4 2024-11-29
snort ET TROJAN W32/InstallRex.Adware Initial CnC Beacon rev 3 2024-11-28
snort ET TROJAN PUP TheSZ AutoUpdate CnC Beacon rev 3 2024-11-28
snort ET TROJAN NivesroCheat CnC Activity M2 rev 3 2024-11-28
snort ET TROJAN Nivesro Cheat CnC Activity M1 rev 3 2024-11-28
snort ET TROJAN PUP Win32/Conduit.SearchProtect.O CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/InstallRex.Adware Report CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/Stan Malvertising.Dropper CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/RocketfuelNextUp.Adware CnC Beacon rev 4 2024-11-28
snort ET WEB_SERVER Possible SQL Injection Using MSSQL sp_configure Command in HTTP URI rev 6 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon rev 5 2024-11-28
snort ET TROJAN W32/PicColor Adware CnC Beacon rev 3 2024-11-28
snort ET TROJAN MSIL/Adload.AT Beacon rev 7 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 3 rev 3 2024-11-28
snort ET TROJAN RelevantKnowledge Adware CnC Beacon rev 4 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 4 rev 3 2024-11-28
snort ET TROJAN MALWARE W32/WinWrapper.Adware POST CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/Softpulse PUP Install Failed Beacon rev 3 2024-11-28
snort ET TROJAN SoundCloud Downloader Install Beacon rev 3 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 2 rev 4 2024-11-28
snort ET TROJAN W32/PullUpdate.Adware CnC Beacon rev 6 2024-11-28
suricata ET WEB_SERVER Possible SQL Injection Using MSSQL sp_configure Command in HTTP URI rev 6 2024-11-28
snort ET INFO DYNAMIC_DNS Query to a *.eduarmor .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .gewamed .de Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .meridiano .com .br Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .grid2road .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a *.daustin .com domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a *.daustin .com domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a * .fumoff .com Domain rev 2 2024-11-27