Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Remote Access Tool - NetSupport Execution From Unusual Location test 2024-11-23
sigma HackTool - HandleKatz LSASS Dumper Execution test 2024-11-23
sigma HackTool Named File Stream Created test 2024-11-23
sigma HackTool - Impersonate Execution test 2024-11-23
sigma Renamed AutoIt Execution test 2024-11-23
sigma HackTool - LocalPotato Execution test 2024-11-23
sigma HackTool - PCHunter Execution test 2024-11-23
sigma Malicious DLL Load By Compromised 3CXDesktopApp test 2024-11-23
snort ET TROJAN Glove Stealer C2 Response rev 1 2024-11-22
snort ET TROJAN Glove Stealer Data Exfiltration Attempt rev 1 2024-11-22
suricata ET MALWARE Glove Stealer C2 Response rev 1 2024-11-22
suricata ET MALWARE Glove Stealer Data Exfiltration Attempt rev 1 2024-11-22
snort ET TROJAN Snake/Best Private Keylogger CnC Exfil Via Telegram rev 1 2024-11-21
snort ET TROJAN TA426/Zebrocy Hatvibe CnC Server Response M1 rev 1 2024-11-21
suricata ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram rev 1 2024-11-21
suricata ET MALWARE TA426/Zebrocy Hatvibe CnC Server Response M1 rev 1 2024-11-21
snort ET TROJAN LokiBot Request for C2 Commands Detected M2 rev 3 2024-11-20
snort ET TROJAN LokiBot Checkin rev 4 2024-11-20
snort ET INFO Win32/BROOXML OOXML File Format Inbound rev 1 2024-11-20
snort ET INFO Win32/BROOXML PDF File Format Inbound rev 1 2024-11-20
snort ET INFO Win32/BROOXML Document Fingerprint rev 1 2024-11-20
snort ET TROJAN LokiBot Fake 404 Response rev 4 2024-11-20
suricata ET MALWARE LokiBot Checkin rev 8 2024-11-20
suricata ET MALWARE LokiBot Request for C2 Commands Detected M2 rev 7 2024-11-20
suricata ET MALWARE LokiBot Fake 404 Response rev 7 2024-11-20
suricata ET HUNTING Win32/BROOXML Document Fingerprint rev 1 2024-11-20
suricata ET HUNTING Win32/BROOXML PDF File Format Inbound rev 1 2024-11-20
suricata ET HUNTING Win32/BROOXML OOXML File Format Inbound rev 1 2024-11-20
snort ET ATTACK_RESPONSE CMDASP Webshell Default Title in HTTP Response rev 2 2024-11-19
suricata ET ATTACK_RESPONSE CMDASP Webshell Default Title in HTTP Response rev 2 2024-11-19
snort ET EXPLOIT Fortinet FortiManager Unauthenticated Get File Transfer Handle rev 1 2024-11-18
snort ET EXPLOIT Fortinet FortiManager Unauthenticated Open Server-Side Channel rev 1 2024-11-18
snort ET EXPLOIT Fortinet FortiManager File Transfer Handle Response rev 1 2024-11-18
snort ET TROJAN Reverse Base64 Encoded MZ Header Payload Inbound rev 1 2024-11-18
snort ET WEB_SPECIFIC_APPS Wordpress WPLMS Learning Management System Directory Traversal rev 1 2024-11-18
suricata ET EXPLOIT Fortinet FortiManager Unauthenticated Get File Transfer Handle rev 1 2024-11-18
suricata ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound rev 1 2024-11-18
suricata ET EXPLOIT Fortinet FortiManager Unauthenticated Open Server-Side Channel rev 1 2024-11-18
suricata ET EXPLOIT Fortinet FortiManager File Transfer Handle Response rev 1 2024-11-18
suricata ET WEB_SPECIFIC_APPS Wordpress WPLMS Learning Management System Directory Traversal rev 1 2024-11-18