Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 4 2024-09-04
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M4 rev 2 2024-09-04
suricata ET MALWARE Angry Stealer Data Exfiltration Attempt rev 1 2024-09-04
suricata ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 5 2024-09-04
sigma Group Policy Abuse for Privilege Addition test 2024-09-04
sigma Persistence and Execution at Scale via GPO Scheduled Task test 2024-09-04
sigma Process Deletion of Its Own Executable test 2024-09-03
sigma PowerShell Web Access Feature Enabled Via DISM test 2024-09-03
sigma PowerShell Web Access Installation - PsScript test 2024-09-03
sigma Capsh Shell Invocation - Linux test 2024-09-02
sigma Shell Invocation via Apt - Linux test 2024-09-02
sigma Suspicious Invocation of Shell via AWK - Linux test 2024-09-02
sigma Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location test 2024-09-02
sigma Shell Execution via Find - Linux test 2024-09-02
sigma Potential Remote WMI ActiveScriptEventConsumers Activity test 2024-09-02
sigma Inline Python Execution - Spawn Shell Via OS System Library test 2024-09-02
sigma Shell Execution via Nice - Linux test 2024-09-02
sigma Shell Execution via Git - Linux test 2024-09-02
sigma Shell Execution GCC - Linux test 2024-09-02
sigma Shell Execution via Flock - Linux test 2024-09-02
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-EBCDIC rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M4 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
snort ET TROJAN Godzilla Webshell Interaction Attempt rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-1 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
snort ET INFO Byte-order mark UTF-7 rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-7 rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-1 rev 1 2024-08-30
suricata ET MALWARE Godzilla Webshell Interaction Attempt rev 1 2024-08-30
suricata ET HUNTING Byte-order mark UTF-EBCDIC rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M1 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M3 rev 1 2024-08-30
suricata ET MALWARE Lumma Stealer Related Fake Captcha URI Structure M2 rev 1 2024-08-30
snort ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M2 rev 1 2024-08-29
snort ET TROJAN TA452 Trojan CnC Checkin M1 rev 1 2024-08-29
snort ET TROJAN Lumma Stealer Related Fake Captcha Page Inbound M1 rev 1 2024-08-29
snort ET TROJAN TA452 Trojan CnC Checkin M2 rev 1 2024-08-29
snort ET WEB_SPECIFIC_APPS Fortra FileCatalyst Workflow Insecure HSQLDB Default Credentials rev 1 2024-08-29